Business Ethics

Internal Control

February 8, 2012

Mr. President,

I have received your letter concerning your company and its plans for going public in the future. After careful observation of your letter, I must inform you that your company needs to become familiar with the internal control requirements given by the Sarbanes -Oxley Act of 2002 (SOX).

The Sarbanes-Oxley Act of 2002 (SOX) requires all publicly traded U.S. corporations to maintain an adequate system of internal controls. SOX imposes more responsibilities on corporate executives and boards of directors to ensure that companies' internal controls are reliable and effective.

Companies must develop sound principles of control over financial reporting and continually assess that the controls are working. Independent outside auditors must attest to the level of internal controls.

To safeguard assets and enhance the accuracy and reliability of its accounting records, companies follow internal control principles. The following five internal control principles apply to most enterprises:

1. Establishment of Responsibility

An essential characteristic of internal control is the assignment of responsibility to specific individuals.

Control is most effective when only one person is responsible for a given task.

Establishing responsibility includes the authorization and approval of transactions.

2. Segregation of Duties

Segregation of duties is indispensable in a system of internal control.

The rationale for segregation of duties is that the work of one employee should, without a duplication of effort, provide a reliable basis for evaluating the work of another employee.

There are two common applications of this principle:

The responsibility for related activities should be assigned to different individuals.

The responsibility for record keeping for an asset should be separate from the physical custody of the asset.

Related Activities:

When one individual is responsible for all of the related activities, the potential for errors and irregularities is increased.

Related purchasing activities should be assigned to different individuals. Related purchasing activities include ordering merchandise, receiving goods, and paying (or authorizing payment) for merchandise.

Related sales activities also should be assigned to different individuals. Related sales activities include making a sale, shipping (or delivering) the goods to the customer, and billing the customer.

Record Keeping Separate from Physical Custody

The custodian of the asset is not likely to convert the assets to personal use if one employee maintains the record of the assets that should be on hand and a different employee has physical custody of the assets.

Documentation Procedures:

Documents provide evidence that transactions and events have occurred.

Documents should be pre-numbered and all documents should be accounted for.

Source documents for accounting entries should be promptly forwarded to the accounting department to help ensure timely recording of the transaction and event.

3. Physical, Mechanical, and Electronic Controls - Physical controls relate primarily to the safeguarding of assets. Mechanical and electronic controls safeguard assets and enhance the accuracy and reliability of the accounting records. Use of physical, mechanical, and electronic controls is essential. Examples of these controls include:

Safes, vaults, and safety deposit boxes for cash and business papers.

-Locked warehouses and storage cabinets for inventory and records.

-Computer facilities with pass key access or fingerprint or eyeball scans.

-Alarms to prevent break-ins.

-Television monitors and garment sensors to deter theft.

-Time clocks for recording time worked.

4. Independent Internal Verification

Independent internal verification involves the review, comparison, and reconciliation of data prepared by employees.

Verification should be made periodically or on a surprise basis.

Verification should be done by an employee independent of the personnel responsible for the information.

Discrepancies and exceptions should be