CEOs' Reports about Internal Control: A Content Analysis

Abstract

This article is about internal control as perceived by CEOs of French firms listed in the CAC 40 index. While the American regulator recommends COSO, French law prescribes no particular framework for the required report. Thus, management has more freedom, which should lead to more diversity of the content, and therefore more richness for lexical content analysis. The latter certainly confirms some trends identified by previous works (e.g. the importance of the risk topic and the financial dimension), but it also shows the shareholder-oriented notion of internal reports. Such a work, based on disclosures published in 2005, should extend former surveys and prefigure further researches.

Notes

Consequently, we will not analyse here the ‘report on the report’, i.e. the observations required from the external auditor regarding the report on internal control drafted by the senior executive. Indeed, this new report imposed on the external auditor appears a priori to follow a rigid format, modelled on the general reports. Their analysis of content is thus likely to have little relevance.

This conception is developed in the Action Plan on Modernizing Company Law and Enhancing Corporate Governance in the European Union. A Plan to Move Forward (2003) http://ec.europa.eu/internal_market/auditing/links_fr.htm. For more details see the position paper on Internal Auditing in Europe, ECIIA, February 2005: ‘Internal audit is an activity which is able to support risk management’ (p. 19).

We use the term dirigeant (senior executive) for the sake of simplicity. Officially, as stated above, this is the président du conseil d'administration (chairman of the management board) or the président du conseil de surveillance (chairman of the supervisory board). To tell the truth, we notice, on examining the reference documents, that the report in question is not always signed. Incidentally, it is reasonable to predict a considerable role for the auditors (internal and/or external) in drafting the reports. However, it should be noted that the external auditor (commissaire aux comptes) of the entity audited may not participate in the drafting of the report.

The term ‘concretion’ is derived from the field of organic chemistry. It designates an effect by which parts come together to form a solid whole. It has been used in the sphere of legal theory by Friedrich Müller to describe the work by which the jurist extracts from legal texts and from facts the elements necessary to produce the legal standard. This work is compared to the activity of miner under ground.

R.N. Anthony, the Harvard (Business School) professor considered a founding father of management control, did not refer to internal control in the strict sense, but to ‘planning and control systems’. See in particular the updated version of his conceptual framework (Anthony, 1988).

The choice of this software was dictated by opportunity: it was available and matched the skills of the authors who had used it in earlier research work.

The LVMH website did not contain any specific report on internal control, although the topic is raised by the report of the Annual General Meeting. We therefore have 39 reports at our disposal, of which eight have been de-duplicated, in other words 47 observations. The computations that follow incorporate this bias.

All the reports that cite COSO confirm using it as a frame of reference. The case of Sanofi-Aventis is a special one, since the word COSO is not cited there, whereas the content of the report is shown to be of the five-axis typology described in Figure 1. We have therefore imputed the report from this group to the COSO.

According to the listing of the NYSE (New York Stock Exchange) at the end of December 2005.

On average, a report on internal control is made up of 19,565 characters, excluding spaces (measured by Word), with a standard deviation of 11,552 characters. If we consider that a standard page contains 1500 characters, we thus have a confirmation of the lengthiness of the reports. The shortest (ST Microelectronics) comprised 3006 characters, and the longest (AGF) 54,719; we therefore formed them into three groups of 10,000 and a fourth group (Size 4) of ‘more than 30,000 characters’.

The items preceded by the symbol # are lexical groups based on the first six characters of a word. These groupings make it possible, for example, to consider the words ‘finance, finances, financial, financing,’ as a single identical occurrence. Certain incorrectly constituted groups have been eliminated: the term ‘insurance’, for example, gave rise to a segmentation according to the context in which it appears (does it refer to the business of insurance in which several CAC 40 companies are directly engaged, or the generic function of insurance involving the whole company?).Other groups have been ‘reworked’ in order to avoid confusing a number of completely different notions, such as ‘direct, directive, directors’ and so on. Words of less than three letters, as well as ‘functional words’ (in order to, thus, since, this, of course…) have been eliminated from the dictionary.

When the #[0] sign precedes a word, the latter represents a lexical group including several other declinations of the same concept: control, controls, controlling, controller are summarized by the #[0]control item.

It may also be noted on this point that a topic that is nonetheless popular, such as ‘sustainable development’ is only cited in five reports, and generally in an anecdotal fashion. Similarly, there is only one reference to a notion such as ‘citizenship’ (Sanofi-Aventis), or the notion of ‘social responsibility’ (Carrefour).

This means that these terms are the ones found most frequently one or two words before the word #risk.

Other reports do, however, mention alarm procedures where they concern external auditors or the audit committee. As for the practice of ‘whistle-blowing’, it should make progress in the coming years under the impulse of recent decisions by the CNIL which, having sanctioned to systems of alarm procedure in October 2005, issued during November 2005 some recommendations aimed at companies that would like to install such procedures.

Listed here are all the dependent correlations with a χ² value of 4.5, to be found in Appendix 2 or the details of the links revealed, as well as comments on them. In Table 3, all the links are positive, and the χ² associated with each link is shown in brackets.