The goal of this diploma thesis, which is related to the nature, interconnections and differences of external and internal audit, is to bring interested persons closer to the reason for inception of external and internal audit and to define their position and importance in 21st century. Approximation of both audit's contents and going, with regard to their goals, is naturally also a part of work. A piece of work is particularly devoted to external and internal auditor's personality and thus to personal and professional demands for such profession. Not forgotten is the legal adaptation of both audits and it is explain, which audit is under more strict adaptation and why. In the thesis conclusion is located an external-internal auditor comparison summary, together with practical part with examples, that are helpful for better understanding risks of auditor profession and with such disciplines and why internal audit is confused with them.

The diploma thesis discusses information security management in the context of ITIL framework. In the introductory part is explained the concept of information security, its importance and main goals. In subsequent chapters, the work aims to explore methodologies, frameworks and standards related to information security and internal control. Selected frameworks and models and described and compared with each other based on different criteria. The comparison is also one of the benefits of the work because similar topics which compare different models of internal control and information security are quite rare in the literature. The practical part of the thesis forms new methodology on basis of researched models and standards, including ISO 27000, ITIL and COBIT. This methodology provides a relatively simple way to evaluate the level of information security in an organization. It uses process capability model which is applied on selected company. Another benefit of the thesis is the developed methodology and its demonstration on a selected company.

Bakgrund: Intern styrning och kontroll är ett centralt begrepp i en organisations verksamhet och finns till för att hjälpa organisationen till en effektiv verksamhet och en tillförlitlig ekonomisk rapportering där lagar och regler efterföljs. Detta ska i sin tur hjälpa organisationen att uppnå sina mål med verksamheten. Ett flertal skandaler i såväl privat som offentlig verksamhet har uppmärksammats efter felaktigheter såsom misstag, bedrägerier och korruption begåtts. Med en god och fungerande intern kontroll hade sådana felaktigheter kunnat förhindras vilket även stärker organisationens möjligheter att nå målen med verksamheten.   Syfte: Syftet med denna studie är att undersöka kommunernas arbete med den interna kontrollen utifrån COSO-modellen.  Teoretisk referensram: Studien baseras på COSO-modellen och dess fem komponenter, kommunernas uppbyggnad och ansvar samt intressent- och legitimitetsteorin.  Metod: Denna flerfallstudie har en kvalitativ ansats med ett abduktivt angreppssätt. Det empiriska materialet samlades in genom fyra delvis strukturerade intervjuer där intervjuerna genomfördes med två personer från respektive kommun. Det empiriska materialet baseras även på kommunernas reglementen och andra interna dokument.   Slutsats: Slutsatsen med denna studie är att Borlänge och Ludvika kommun arbetar på ett liknande sätt med den interna kontrollen. Vi kan utläsa vissa olikheter mellan kommunerna men generellt sett så sker arbetet likartat och utifrån COSO´s ramverk för intern kontroll. Studien visar på att den interna kontrollen för kommunala verksamheter syftar till att säkra en effektiv verksamhet där lagar och regler efterföljs samt bevara förtroendet hos kommunernas intressenter och framstå som legitim i medborgarnas ögon. / Background: Internal control is a central concept in an organization's operations and exists to assist the organization to become an effective operation with reliable financial reporting where laws and regulations are followed. This, in turn, will help the organization achieve their goals with the operation. Several scandals in both the private and public sectors have been noted for errors such as mistakes, fraud and corruption. With a good and functioning internal control, such errors could have been prevented, which also strengthens the organization's ability to achieve the goals of the operation.  Purpose: The purpose of this study is to investigate the municipalities' work on internal control based on the COSO model.  Theoretical framework: The study is based on the COSO model and its five components, the municipalities' structure and responsibility and the theory of stakeholder and legitimacy theory.  Methodology: This multi-case study has a qualitative approach with an abductive profile. The empirical material was collected through four partially structured interviews, where the interviews were conducted with two people from each municipality. The empirical material is also based on the municipal regulations and other internal documents.  Conclusions: The conclusion of this study is that Borlänge and Ludvika municipality work in a similar way with internal control. There are some differences between the municipalities, but in general, the work is done similarly and based on the COSO framework for internal control. The study shows that the internal control of municipal functions aims to ensure an efficient operation where laws and regulations are followed and to maintain the trust of the municipal stakeholders and appear legitimate in the eyes of the citizens.

I en värld där teknologi möjliggör förflyttning av pengar skyndsamt till varje hörn, blir arbete mot penningtvätt allt viktigare. På en global nivå tvättas stora belopp årligen och i Sverige uppmärksammas penningtvättsskandaler inom banksektorn. Denna studie är utformad för att försöka förstå varför penningtvätt kan förekomma trots intern kontroll i banker. Detta genom att använda Internal Control Maturity Model för att mäta nivån på den befintliga interna kontrollen i storbanker. För att motarbeta penningtvätt har finansinspektionen skapat interna riktlinjer för att svenska banker ska kunna verka lagligt. Dessa riktlinjer har använts som underlag för en kvalitativ undersökning som har gjorts med hjälp av fem respondenter. Studiens resultat visade på att uppfyllelse av finansinspektionens riktlinjer innebär att bankerna håller sig inom lagen men att ändamålet som innebär motverkan av penningtvätt, inte alltid uppnås. Detta på grund av att nivån på bankernas interna kontroll inte alltid är fullt effektiv. Resultatet går dock inte att generalisera på grund av ett för litet urval av banker samt respondenter. Studien kan därför inte användas som underlag för bedömning av hur den interna kontrollen ser ut på andra banker.

El presente proyecto tiene como objetivo fundamental, establecer un modelo de negocio rentable que posibilite ofrecer a las medianas empresas servicio de auditorías operacionales, control interno, administración de riesgos y servicios forenses. El desarrollo de estos servicios posibilitará que las empresas puedan mitigar los riesgos de negocio, el fraude interno o externo, los cuales se traducen en pérdidas financieras dentro de las empresas, así como en la reducción de su rentabilidad futura, arriesgando su sostenibilidad en el mercado. Sin embargo, ante los diversos escenarios que ha atravesado el país, surge la necesidad, por parte del sector empresarial, de invertir en la mejora de sus capacidades y procesos para obtener ventajas competitivas y aumentar su cuota en el mercado, dado que la incertidumbre y la falta de información son obstáculos claves para la toma de decisiones en los distintos niveles de una organización. En esta línea, las empresas deben adaptar nuevos estándares de cumplimiento legal dentro de la lucha contra la corrupción plasmada en el Decreto Legislativo N° 1385, la cual motiva a que las empresas adopten medidas de control interno y riesgos y posibiliten el desarrollo de lineamientos y objetivos empresariales enfocados al control del fraude y la corrupción. Ciertamente, se puede inferir que las pequeñas y medianas empresas desatienden el desarrollo del control interno debido a su dimensión, dado que tienen dificultades para crecer a causa de su cultura desordenada de desarrollo, como cuando van creando áreas de acuerdo con la necesidad del momento, el cual puede generar mayores costos y una difícil detección de los procesos, lo que no permitiría un adecuado control y correcta gestión de riesgos. Frente a lo planteado, nuestra propuesta de negocio está orientada la atención de medianas empresas, con el fin de fortalecer las capacidades de estas empresas en los distintos sectores económicos del país y que, a la vez, les posibilite hacer frente a los nuevos riesgos, dentro y fuera, de sus organizaciones. Y si bien surgen en el mercado diversas consultoras que buscan cubrir estos servicios, la mayoría son extranjeras reconocidas, por lo que nuestra firma ingresa al mercado de la consultoría como una proveedora de los más apremiantes servicios, con bajos costos y al alcance de las empresas, con la finalidad de contribuir al desarrollo, crecimiento y generación de valor de dichas organizaciones. Por ello, los servicios propuestos en el Plan de negocio están definidos por paquetes alineados a una estrategia por diferenciación, por lo que ofrecemos servicios con características únicas y con posibilidades de obtener mayores precios en el mercado. En la primera etapa del Proyecto, los años uno y dos del periodo de análisis, la prioridad es consolidar el negocio a través de la formación del equipo de consultores y auditores altamente calificados, la implementación de procesos internos, uso y aplicación de tecnologías, sistemas de control y de dirección. Para ello, es indispensable el desarrollo de alianzas estratégicas con instituciones del ejercicio de la profesión contable, así como con las principales empresas y certificadoras de calidad asociadas para fortalecer los servicios. Con respecto a la expansión, a partir del tercer año del análisis. En esta etapa se consolidará las actividades de la etapa uno y para ello se requerirá incrementar la capacidad instalada, para lo cual se considerará el espacio físico requerido, así como a los consultores especializados y el equipamiento respectivo. Se busca, por tanto, crecer significativamente en facturación y acumulación de clientes. También, en esta etapa, se debe expandir el negocio a las regiones del interior del país, se consolidarán alianzas con asociaciones de empresas y se buscará integrar una red de socios externos de confianza y de organizaciones que impulsen la consultoría. El proyecto presenta niveles aceptables de rentabilidad sustentado en el mercado objetivo, al cual se orienta de acuerdo con el estudio de mercado y al tamaño de la demanda potencial. Por tanto, es un negocio viable porque existen las condiciones necesarias para implementar los servicios y porque se proyecta a un entorno favorable en el segmento empresarial peruano, que es impulsado desde el Gobierno central y respaldado por las proyecciones favorables de crecimiento en la actividad económica. Se puede concluir, que el mercado empresarial peruano es reacio a invertir en contratos de consultoría, por lo cual la tarea principal para la captación de clientes será difundir la importancia de los beneficios que genera la adquisición de los servicios propuestos en el presente Plan de negocio. Finalmente, la firma consultora busca, en el mediano plazo, ser reconocida en los sectores económicos objetivo y en las asociaciones como una consultora experta en potenciar a medianas empresas. / The main objective of this project is to establish a profitable business model that makes it possible to offer forensic audit and internal control and risk audit services to medium-sized companies. The development of these services will enable companies to mitigate business risks, internal or external fraud, which translate into financial results of companies, as well as reducing their future profitability, risking their sustainability in the market. However, faced with the different scenarios that the country has gone through, there is a need, on the part of the business sector, to invest in the improvement of its capacities and processes in order to obtain competitive advantages and increase its share in the market, given that the uncertainty and The lack of information are key obstacles to decision making at different levels of an organization. In this line, companies must adapt new standards of legal compliance within the fight against corruption embodied in Legislative Decree No. 1385, which motivates companies to adopt internal control measures and risks and enable the development of guidelines and business objectives focused on the control of fraud and corruption. Certainly, it can be inferred that small and medium enterprises disregard the development of internal control due to their size, given that they have difficulties to grow because of their disorderly culture of development, as when they are creating areas according to the need of the moment, which can generate higher costs and a difficult detection of the processes, which would not allow an adequate control and correct risk management. In light of the above, our business proposal is focused on the attention of medium-sized companies, in order to strengthen the capabilities of these companies in the different economic sectors of the country and, at the same time, make it possible to face the new risks, inside and outside, of their organizations. And while there are several consultants in the market that seek to cover these services, most are foreign recognized, so our firm enters the consulting market as a provider of the most pressing services, with low costs and within the reach of companies, with the purpose of contributing to the development, growth and generation of value of said organizations. Therefore, the services proposed in the Business Plan are defined by packages aligned to a differentiation strategy, which is why we offer services with unique characteristics and with the possibility of obtaining higher prices in the market. In the first stage of the Project, years one and two of the analysis period, the priority is to consolidate the business through the formation of a team of highly qualified consultants and auditors, the implementation of internal processes, use and application of technologies, systems of control and direction. For this, it is essential to develop strategic alliances with institutions in the accounting profession, as well as with the main companies and associated quality certifiers to strengthen the services. With respect to the expansion, from the third year of the analysis. In this stage, the activities of stage one will be consolidated and for that, it will be necessary to increase the installed capacity, for which the physical space required will be considered, as well as the specialized consultants and the respective equipment. Therefore, it seeks to grow significantly in billing and customer accumulation. Also, at this stage, the business should be expanded to the interior regions of the country, alliances with business associations should be consolidated, and a network of trusted external partners and organizations that promote the consultancy should be integrated. The project presents acceptable levels of profitability sustained in the target market, which is oriented according to the market study and the size of the potential demand. Therefore, it is a viable business because the necessary conditions exist to implement the services and because it is projected to a favorable environment in the Peruvian business segment, which is driven by the central government and supported by favorable projections of growth in economic activity. It can be concluded that the Peruvian business market is reluctant to invest in consulting contracts, so the main task for attracting customers will be to disseminate the importance of the benefits generated by the acquisition of the services proposed in this Business Plan. Finally, the consulting firm seeks, in the medium term, to be recognized in the target economic sectors and associations as an expert consultant in empowering medium-sized companies. / Trabajo de investigación

Though at the enterprises the estimation of a financial condition is annually, it is necessary to develop, to improve constantly and to evaluate the system of the internal control, necessary to develop a technique of the reporting quality estimation of the enterprise specially for the certain enterprise in view of all features, to take advantage of statistical data and to draw corresponding conclusions, to make constant monitoring. The purpose of development of the mechanism - detection of deviations of data in the reporting from actual results of activity, definition of clauses causing distortion of a real financial condition of the enterprise, revealing of size of influence of the given distortions and qualities of the reporting as a whole on decision-making, and also revealing of the reasons causing these deviations and distortions, and development of recommendations on corresponding correction separate directions for improvement of quality of the reporting. How can high reporting quality and internal control create an advantage? In survey of institutional investors is reported that investors apply a penalty if they believe a company’s internal control to be insufficient. Sixty-one percent of respondents said they had avoided investing in companies and 48% had de-invested in companies where internal control was considered inadequate. As additional support, they study went on to report that 82% of respondents agreed that good internal control was worth a premium on share price. These institutional investors are pushing for greater transparency on risk issues and related internal control efforts. Simply put, an organization’s ability to implement and maintain a leading-class control framework can create competitive advantage in today’s market. A system of the financial reporting conducting with strong management, quality control and good legislative base is the key factor of economic development. The trust of investors in the financial and not financial information is based on strong Internal Control, high-quality standards of the financial reporting, audit and ethics, thus, standards and Internal Control play the leading part in assistance of economic growth and financial stability in the country. Nevertheless, every company meets the problems of implementation of the internal control. Among them there can be problems in labor qualification, legislation and so on. It is also necessary to examine the successful experience at the micro level.

Esta investigación tuvo como objetivo principal determinar la incidencia del Control Interno en la gestión del Área de Abastecimiento para su información correcta en el área de patrimonio de un hospital público - Región Lambayeque 2022, a fin de analizar cómo esta institución está llevando a cabo sus procesos de abastecimiento, los tiempos en los que estos se realizan y sobre todo la calidad de los bienes adquiridos, siendo una institución de salud estatal que trabaja en beneficio de la sociedad y de los más vulnerables. Respecto a los resultados obtenidos se constató que el Control Interno sí incide en el área de abastecimiento, debido a que este Control significa sinónimo de transparencia según todas las actividades que se llevan a cabo. Por otro lado, también se certificó que el Control Interno tiene una confiabilidad media del 58.50%, mismo que se puede mejorar fortaleciendo las deficiencias en los factores de ambiente físico, seguridad, capacitación, experiencia, entre otros. Asimismo, en las conclusiones se determinó que los factores mencionados son de suma importancia a la hora de determinar la incidencia del Control Interno en el área de abastecimiento, debido a que estos factores reflejan la responsabilidad y ética con la que se está trabajando, evidencia los puntos débiles del área, lo cual ayuda en un futuro a reconfortar dicho ambiente de trabajo y como ya se mencionó anteriormente, esto con el fin de brindar una calidad de atención al ser una institución perteneciente al estado. / The main objective of this investigation was to determine the incidence of Internal Control in the management of the Supply Area for its correct information in the heritage area of a public hospital - Lambayeque Region 2022, this in order to analyze and study how this institution is carrying out its acquisition and supply processes, the times in which these are carried out and above all the quality of the goods acquired, being a state health institution that works for the benefit of society and the most vulnerable. Regarding the results obtained, it was found that Internal Control does affect the supply area, because this Internal Control means transparency based on all the activities that are carried out. On the other hand, it was also certified that Internal Control has an average reliability of 58.50%, not being a low result, which can be improved by strengthening the deficiencies found such as physical environment, security, training, experience factors, among others. Likewise, taking into account the conclusions, it can be determined that the aforementioned factors are of the utmost importance when determining the incidence of Internal Control in the supply area, because these factors reflect the responsibility and ethics with which it is currently being carried out. working, it also shows the weak points of said area, which helps in the future to comfort said work environment and as previously mentioned, this in order to provide quality care as it is an institution belonging to the state and the Region Lambayeque.

La presente investigación se centra en el control interno en la gestión de inventarios de las empresas comerciales. La investigación tuvo como propósito brindar información respecto a estas variables de manera que permita sincerar los stocks de los repuestos y autopartes, con esto se manejaría de manera oportuna y confiable la información contable. Asimismo, su objetivo general fue el análisis de la incidencia del sistema control interno en la gestión de inventarios de la empresa Charapo repuestos & autopartes E.I.R.L, Chiclayo – 2022. La investigación es de enfoque mixto, nivel descriptivo, tipo aplicada, diseño no experimental y transversal, la muestra estuvo compuesta por el área de almacén y el área de ventas, el muestreo es no probabilístico. Los resultados obtenidos son los siguientes: Se conocieron los aspectos generales de la empresa, en el cual se identifica que no tiene una visión y misión definida, no tiene una estructura organizacional detallada, además presenta deficiencias en su proceso de adquisición, almacenamiento y venta, de igual forma se encontró que el control interno es confiable el 38%; además, se realizaron indicadores de liquidez y gestión donde se concluye que los indicadores no son óptimos, porque su rotación de inventarios es baja, lo cual puede afectar su liquidez; del mismo modo, se elaboró políticas de control interno. En conclusión, la empresa no presenta un control interno confiable y su gestión de inventarios no es eficiente, por ende, se elaboraron políticas de control interno. / This research focuses on internal control in inventory management of commercial companies. The purpose of the research was to provide information regarding these variables in a way that allows honesty of the stocks of spare parts and auto parts, with this the accounting information would be handled in a timely and reliable manner. Likewise, its general objective was the analysis of the incidence of the internal control system in the inventory management of the company Charapo spare parts & autoparts E.I.R.L, Chiclayo – 2022. The research has a mixed approach, descriptive level, applied type, non-experimental design and transversal, the sample was composed of the warehouse area and the sales area, the sampling is non-probabilistic. The results obtained are the following: The general aspects of the company were known, in which it is identified that it does not have a defined vision and mission, it does not have a detailed organizational structure, and it also presents deficiencies in its acquisition, storage and sale process. Likewise, it was found that internal control is reliable 38%; In addition, management indicators were carried out where it is concluded that the indicators are not optimal, because their inventory rotation is low, which can affect their liquidity; Likewise, internal control policies were developed. In conclusion, the company does not have reliable internal control and its inventory management is not efficient, therefore, internal control policies were developed.

Syftet med denna studie är att undersöka bankernas syn på internkontroll och vidare undersöka vilka mekanismer som används föratt effektivisera den interna kontrollen. Studien riktar sig på attundersöka huruvida visselblåsning används som en av demmekanismerna för att stärka förmågan med att upptäcka ochförhindra oegentligheter av ekonomisk art. Studien använder en induktiv metod för att leda insamlingen avdatamaterial. Vidare använder studien en kvalitativ metod baseradpå intervjuer med fyra olika banker där datamaterialet analyserasmed datamaterialet i kapitel två. Studien visar att det finns en positiv syn på den interna kontrollenoch visselblåsning som mekanism för att skapa en framgångsrikverksamhet. Fastän visselblåsning anses ha en kompliceradfunktion, används den fortfarande för att upptäcka och förhindraoegentligheter, såsom ekonomiska brott. Förutom visselblåsning,använder bankerna mer mekanismer för att stärka och effektiviseraden interna kontrollen. Att uppmana medarbetarna att följa lagaroch principer, utbilda medarbetarna inom olika områden samt attskapa olika arbetarsätt inom verksamheten, att genomföra interntillsyn och ständiga granskningar är en del av de mekanismer somanvänds. / The purpose of the study is to examine the banks view of internalcontrol and further investigate what mechanisms are used tostreamline the internal controls. The study is directed into whetherthe whistle-blowing is used as one of the tools in the internalcontrol to enhance the ability to detect and prevent irregularities ofa financial character. The study use a inductive method to lead the collection of datamaterial. The study further use a qualitative method based on fourinterviews with different banks were this data material is comparedwith existing theories in the second chapter. The study shows that the view of internal control and whistleblowingis positive in the process to create a successful company inthe banks. Despite that the whistle- blowing is known as acomplicated function, it’s still used to detect and preventirregularities of crimes, such of financial character. Except whistleblowing,the banks are using more tools to streamline the internalcontrol. To urge employees to comply laws and other principles,education in different areas for employers but also to createdifferent work approaches in the company, to make internal checkupsand constant supervision of the organization work is some ofthe tools that are used.

隨著銀行經營環境丕變，引發作業風險的可能性大幅提高。有鑑於此，巴塞爾銀行監理委員會於2003年公佈的作業風險與監督十項準則，且在2004年6月公布新巴塞爾資本協定，除信用與市場風險外，將作業風險納入資本計提範疇。同時，委員會也對作業風險給予明確定義，亦針對整體作業風險管理流程及作業風險資本計提方式有所規範。 隨著作業風險管理漸漸受到重視，作業風險由最初的傳統階段以內部控制及事後稽核進行風險管理，開始發展進入認知階段作業，此時金融機構開始意識到作業風險管理重要性，接下來進入監控階段，除了開始設定足以反映各項作業風險的風險指標來進行風險的追蹤，也開始進行風險的自我評估，且由於質化的風險指標無法滿足作業風險管理的要求，量化風險指標漸漸為各金融機構發展的管理技術；最後當其成熟後，作業風險管理就可納入整體的風險管理體系。 隨著金融機構的策略、組織、作業與系統及衡量四個構面，作業風險管理組織的架構也依金融機構需求不斷演變。本研究藉由研究作業風險管理架構的發展及作業風險管理的四項核心流程，探討在操作實務中可能面臨的挑戰，摘要結論及建議如下: 1.作業風險管理成功的關鍵在於公司董事會、管理階層及所有員工均需體認「改變是必要的」，且須獲得董事會及高階管理階層的承諾與支持 2.作業風險管理單位除了在組織架構上需符合「獨立」的精神外，需積極參與風險控管方案有效性評估及作業風險管理工具/政策的執行 3.為彌補內部稽核先天的不足，作業風險管理單位應針對關鍵性的控制活動，發展以風險為導向的查核工具，以肩負起預防問題、發現問題及評估內部控制有效性的角色，同時內部稽核應轉變為以風險為導向的查核制度，將查核重心放在銀行經營風險最大部分，方可協助銀行運用稽核創造更高的價值。 4.作業風險辨識及評估的結果應與現行的自行查核制度進行連結，同時自行查核題庫也必須適時調整以符合現況。