Changes in internal controls in Icelandic companies 2008 – 2014

We are currently in the reporting phase for our research on changes in management accounting practices of Icelandic companies since 2008. A part of this research focuses on what characterizes the development of internal controls and weather the developments observed can be characterized as increasing or decreasing maturity of internal controls in Icelandic companies. This is currently being written for an academic publication, but here are a few highlights.

The data is based on two questionnaire surveys of internal control design and application carried out in 2008 and in 2014. The two surveys asked the same questions about internal controls in both years where we used the COSO framework as a guide for developing the questions as well as the ISACA internal control maturity framework. The population was in both years the 300 largest companies in Iceland and the response rates were 61 and 63 percent respectively.

The survey in 2008 was carried out months before the worst financial crisis in the history of Iceland hit the country. Although this was not the intention at the time, the 2008 survey documented management accounting practices – including internal control – in Icelandic companies at the end of the fastest expansion phase in Icelandic business history. The survey in 2014 was carried out after 6 years of financial restructuring, IMF interventions and general environmental turbulence and uncertainty. The comparison between these two data sets gives us some idea of what happens to management accounting practices when elements in the external environment suddenly change.

The below table gives an overview of some of the results from the internal control part of the survey.


Companies answering “Yes” in 2014

Companies answering “Yes” in 2008

Are internal controls of average or high importance?



Have internal controls been documented?



Has internal control processes been reviewed and approved by top management?



Is there in place a risk assessment and response plan for events that could threaten company objectives?



Have external auditors have advised on internal controls?



Are internal controls reviewed regularly to ensure alignment with risk and control conditions?



The results show that internal controls have developed significantly in the period after the crisis hit the companies in 2008. The management control literature concludes in general that behaviour orientated management controls become more flexible and result based with increasing levels of environmental turbulence. Our research  indicates however that accounting type, information focused controls seem to become stricter, more formalized and more activity centred. This tells us that management control system studies cannot  as such generalize findings for one part of a management control system to another. The study concludes that external disruptive events like a financial crisis spurs companies to increase the maturity of their internal controls.