Enterprise Internal Control Based on Risk Management with Moutai Group as an Example

Shumin YU

College of Economics and Management, Henan Agricultural University, Zhengzhou 450002, China

Abstract Focusing on the two themes of "internal control" and "risk management", this paper makes an in-depth analysis of the current situation of risk management and internal control of Moutai Group. It analyzes the current situation of risk management and internal control of Moutai Group. It is found that the risk management of Moutai Group is not perfect, the information exchange is not smooth, and the internal control assessment is not perfect. Finally, it puts forward some corresponding countermeasures, including establishing an effective information communication mechanism, perfecting the risk assessment system, and strengthening the construction of the professional talent team.

Key words Internal control, Risk management, Moutai Group

1 Introduction

Internal control and risk management are two core issues in corporate governance. Internal control refers to the formulation of a series of rules and regulations and processes in the daily operation of enterprises, and the use of information technology tools and other means to ensure that the business activities of enterprises are standardized, legitimate, safe and efficient. Risk management means that when enterprises are faced with various uncertain factors, they need to formulate risk management strategies and measures according to the actual situation, and use risk management tools to reduce or avoid the losses from risks. For the company, the internal control based on risk management has a positive effect, which is an inevitable requirement for the company to carry out effective management, and is also a necessary means for managers to achieve management objectives[1].

2 Basic concepts of internal control and risk management

2.1 Internal controlAs an important part of enterprise management, internal control refers to the formulation of a series of rules and regulations and processes, and the use of information technology tools and other methods to ensure that the business activities of enterprises are standardized, legitimate, safe and efficient. The fundamental objectives of internal control are to protect the assets of the enterprise, ensure the accuracy and reliability of financial reporting, improve operational efficiency and performance, and comply with laws, regulations and ethical guidelines[2].

2.2 Risk managementIn enterprise management, risk management is another important content. Risk management refers to the adoption of risk management strategies and measures, and the use of risk management tools and other methods to reduce or avoid the losses caused by risks when enterprises are faced with a variety of uncertain factors. The goal of risk management is to reduce the risks faced by the company, protect the company’s property and operation, and enhance the company’s competitiveness and sustainable development. In risk management, enterprises must have a perfect risk management system, clear risk management guidelines and procedures, and an effective risk management monitoring and evaluation mechanism.

2.3 Relationship between enterprise risk management and internal controlEnterprise risk management and internal control are two interrelated and mutually reinforcing concepts[3]. On the one hand, in the process of enterprise risk management, internal control is a very important part. The effective implementation of internal control is helpful for enterprises to understand and evaluate all kinds of risks, so as to reduce the harm of risks to enterprises. On the other hand, enterprise risk management can also promote the continuous optimization and improvement of internal control. Through the scientific identification and assessment of various risks, enterprises can better understand the defects and shortcomings of their internal control system, and then take appropriate measures to improve it. From a practical point of view, enterprises should combine internal control and risk management organically to ensure the steady development of enterprises.

3 Case analysis

3.1 Introduction to Moutai GroupMoutai was founded in 1999 with a registered capital of 1.85 billion yuan and is located in Moutai Town, Renhuai City in southwest Guizhou Province of China. At present, the company has become a state-owned company with the stock code of 600519. Moutai not only has a good reputation and good corporate image in China, but also occupies a large market share in the domestic liquor industry, dominating the high-end liquor market in China. The company’s main products include Guizhou Moutai series liquor, beverage, food, packaging materials, anti-counterfeiting technology research and development, as well as research and development of products related to the information industry.

3.2 Status of Moutai Group’s internal controls and risk managementThe reform of internal control and risk management of Moutai Group began around 2000. After a process of gradual improvement and continuous strengthening, a complete system has been basically formed. Moutai Group established the Internal Audit Department in 2002, which is fully responsible for the work of all business links of the company, and has formulated a set of standardized, standardized and procedural work processes. In 2010, Moutai Group set up the Compliance and Internal Control Department to further strengthen the company’s internal control and risk. Since then, Moutai Group has been improving its internal control and risk management system, strengthening the audit and evaluation of suppliers, and taking corresponding measures in financial and information technology security management. In 2018, Moutai Group established the Risk Management and Internal Control Committee to strengthen the supervision and management of the company’s internal control and internal control work. In addition, in order to ensure the correctness and correctness of the company’s business activities and financial statements, Moutai Group will further strengthen the supervision and control of its subsidiaries and affiliated enterprises.

Although Moutai Group has established a relatively complete risk management organization, it is only to cope with the inspection and has not played its due role. Moutai Group simply manages risk for projects involving venture capital. Risk management is not only strategic risk, but also involves other risks, such as market risk, legal risk, operational risk,etc.[4]. However, Moutai Group ignores this problem. This is obviously not in line with the requirements of enterprise risk management, and it also plays a negative role in the detection and prevention of risks. In terms of risk management, Moutai Group also has the problem of insufficient initiative. In the process of handling business, Moutai Group relies more on the risk management department to identify and evaluate risks, but fails to actively identify and evaluate risks in the process of handling business, and fails to sort out and prevent potential risks in time.

3.3 Problems and causes in the internal control system of Moutai Group

3.3.1Poor information transmission within the group. Information and communication are the important means to realize the effective operation of the internal control system, the lifeline to improve the internal control system, and the key to realize the correct operation of the internal management system[5]. Moutai Group has strong external communication and communication skills, but the information and communication within the enterprise is not smooth. A well-established enterprise requires open communication from top to bottom. However, in Moutai, there is only communication from top to bottom, not from bottom to middle. At present, Moutai Group has only set up a "bottom-up" information transmission tool of "leadership suggestion box" in its office space, but the "suggestion box" has never been used by grass-roots personnel, let alone to transmit information to management departments, board of directors and other departments. It can be seen that for the information transmission within Moutai Group, the information transmission from top to bottom is obviously not well executed.

3.3.2Lack of internal audit supervision. The financial internal audit organization of Moutai Group lacks independence and effective supervision over the financial internal audit, resulting in the inadequate implementation of the financial internal audit system. Firstly, the authority and independence of the audit department under the board of directors of Moutai Group is not strong. As the endogenous supervision subject of Moutai Group, the lack of independence and authority of internal audit makes it vulnerable to various factors within the enterprise in its work. Supervision departments at all levels have a systematic but unconstrained phenomenon, insufficient supervision strength, and a weak supervision mechanism, and have not formed a reasonable and effective coordinated supervision system. Secondly, at present, the internal audit of Moutai Group mainly focuses on financial audit and compliance audit, but does not pay enough attention to strategy, risk management, internal control and other fields, which can not achieve comprehensive coverage of the company’s operation and management. In addition, due to the insufficient attention of by the management of Moutai Group to the internal audit work, there are deficiencies in manpower and material resources, which restrict the smooth progress of the internal audit work.

3.3.3Lack of professionalism of internal audit team. Moutai Group has established an audit committee under the board of directors, and in order to strengthen the supervision of internal control, the company has also arranged a group of dedicated internal auditors and asked the relevant departments to rectify the problems found. However, through the internal control evaluation of Moutai Group in 2017-2020, it was found that some executives of Moutai in Guizhou had committed fraud in recent years, but the internal control evaluation report of the internal audit organization did not point out obvious or major loopholes. The causes of this phenomenon is partly due to the weakening of the audit committee’s supervisory responsibility and partly due to the internal audit organization did not supervise the effective implementation of internal control, resulting in the major defects of internal control were not found in time. The internal auditors of Moutai Group are not professional enough in terms of knowledge structure and professional quality, coupled with the lag of audit means and technology, resulting in the failure of timely supervision of the company, which has a certain impact on the company’s internal control system.

3.4 Measures for improving the internal control system of Moutai Group

3.4.1Establishing an effective information communication mechanism. The correctness of information will directly affect the company’s business decisions, to achieve timely transmission of information and smooth internal communication, is the most basic requirement of state-owned enterprises. To ensure the good information exchange, Moutai Group should firstly enhance the transmission of information. Within the company, enterprise managers should be clear about their management objectives, scope of responsibility and their role in internal control. The second is to ensure smooth communication between Moutai Group and investors, creditors, consumers, suppliers, regulators and other external authorities. In view of the current problems of Moutai Group, it is recommended to establish a bottom-up information and communication mechanism in the following ways. In the first place, Moutai Group should set up a suggestion box in the company’s office building, so that executives and low-level employees can communicate regularly. In the second place, a perfect communication system is not just a channel of communication. For the managers of the company, they should give enough respect to the thoughts and identities of the employees, believe in and recognize them, and let the employees have greater autonomy in their own field of work.

3.4.2Improving the risk assessment system. Moutai Group needs a sound risk assessment system, so as to better prevent and guard against risks, ensure the normal operation of the enterprise, and reduce it to a minimum. Therefore, Moutai Group must have a sound risk assessment system and carry out effective risk management. In the daily business process, the identified risks should be recorded and reported, and then the risk department should assess the risks, and the frequency and severity of the risks should be included in the supervision[6]. In daily business activities, it is required to report risks to the risk department as soon as they are found, so that the risk department can formulate a set of practical assessment and management mechanism to understand the risks faced by the company in real time and dynamically, so as to better monitor and assess the risks and make correct reports to the management[7]. After the event, it is necessary to supervise the implementation of the rectification measures, supervise the safety after the event, and ensure the perfection of the company’s system. In summary, it is necessary to strengthen the control of risk before, during and after the event, minimize the risk, and define the responsibility of risk-taking.

3.4.3Strengthening the construction of professional talent team. With the continuous development of Moutai Group, the requirements for financial personnel are getting higher and higher. It is of great significance for the long-term and healthy operation of the company to actively introduce high-level financial personnel and employ personnel with relevant work experience, especially those with professional skills and practical operation. It is recommended to carry out regular training for employees, carry out risk prevention training for employees of financial companies, and invite professional risk management personnel to give lectures to employees, improve the level of risk identification and risk prevention and control of employees, and carry out standardized management for employees through continuous communication and reference[8].

4 Conclusions and limitations

Based on the theory of risk management and internal control, we used the method of combining theory with case to analyze the current situation of internal control and risk management of Moutai Group in liquor industry. We found that Moutai Group has some problems in risk management, such as lack of effective internal control system, poor information exchange, and imperfect internal control assessment. We proposed that Moutai Group should establish an effective information communication mechanism, improve the risk assessment system, and strengthen the construction of professional personnel.

In this study, we combined theory with practice, but because of the individuality of the case, our viewpoints also have some limitations. Therefore, the risk-based internal control system introduced in this study should not be fully applied to every enterprise in the liquor industry. When constructing the risk-based internal control system, enterprises should also combine theory with practice, and improve their internal control system according to their own characteristics, and ultimately form a set of internal control system that conforms to the actual situation of enterprises and is based on risk management.