B1: Corporate Governance & Operations Management Flashcards
Board of Directors
- fiduciary duties, act in best interests of corp
- right to rely on info from officers/employees/ others
- liable for unlawful dividends (if unable to pay debts or assets less than liabilities)
- duty of loyalty: can’t compete w/ corp (or serve on board of competitor), if conflict disclose and abstain (liable if transaction unfair)
- corporate opportunity: must offer first to corp and can use only if corp declines
- may indemnify directors and limit liability (except for bad faith/ethical violations)
Officers
- agents of corp and can bind the corp
- selected and removable by directors
- authority: actual (oral/written instruction) and apparent (title/position)
- owe fiduciary duties and may be indemnified
- may be directors, do not need to be shareholders
Sarbanes-Oxley
- corporate responsibility: audit committee (oversees auditor, independent, establish whistleblower procedures), corporate responsibility for financial reports (CEO/CFO representations in periodic reports concerning report accuracy and internal controls), bonus/ profit forfeiture (reimburse corp if restatement for violation of securities laws)
- enhanced disclosures: disclose off-balance sheet and related-party transactions, no loans to directors/officers, mgt assessment of controls, officer code of ethics, audit committee financial expert
- accountability: penalties for altering docs (auditors retain docs for 7 years), whistleblower protections, 25 years prison for securities fraud
Internal Control: Definition and Objectives
- a process to provide assurance about achievement of objectives
- objectives: reliability of financial reporting, effectiveness/efficiency of operations, compliance w/ laws & regulations
COSO Framework
- private professional organizations
- framework of internal control best practices
- focus on financial reporting objectives
COSO: Internal Control Components
C – Control environment: tone at the top (PHRASED)
R – Risk assessment: mgt ID of risk
I – Information and communication systems: means of recording transactions and communicating responsibilities
M – Monitoring: assess internal control effectiveness and report deficiencies
E – Existing control activities: control policies and procedures
COSO Control Environment
P – Philosophy and operating style of mgt H – Human resources R – Reporting (financial) competencies A – Authority and responsibilities S – Structure (organizational) E – Ethical values and integrity D – Directors
COSO Control Environment: Philosophy and operating style
- congruent w/ effective financial reporting and internal control
- emphasize reliable reporting, support objective selection of acct principles and rigorous development of estimates, articulate GAAP compliance as objective of reporting
- emphasize reducing risk of misstatements, insist on proper documentation of transactions, reporting personnel informed of mgt commitment to fair reporting
COSO Control Environment: Human Resources
-commitment to competence and ethics, recruitment, training, reward ethical behaviors, background checks, compensate at fair market rates tied to nonfinancial goals (less emphasis on financial performance)
COSO Control Environment: Financial Reporting Competencies
-competent financial reporting personnel, training, ongoing evaluation, directors/audit committee evaluate CFO competencies
COSO Control Environment: Authority and Responsibility
- assign responsibilities regarding internal controls
- audit committee oversees mgt definition of responsibility for key financial reporting roles, executive mgt responsible for starting/ maintaining internal controls, functional mgt responsible for ensuring all know their responsibilities and adhere to control policies
- segregation of responsibilities, not too centralized; clear job description
COSO Internal Control: Organizational Structure
- structure provides relevant info at appropriate levels, and facilitates reporting and communications on internal control
- org charts, align roles to processes, job descriptions, no more than 3 layers between CFO and financial reporting personnel, internal auditors report to CFO w/ direct audit committee access
COSO Internal Control: Ethical Values and Integrity
- ethical standards adopted by mgt and demonstrated throughout org
- zero tolerance for lack of ethics, training/ informing employees about code of ethics, whistleblowing procedures
COSO Internal Control: Directors
- active oversight of financial reporting and internal controls
- independent, audit committee, monitor risk/ reliability, some meetings w/o mgt present, look for skilled independent members
COSO Risk Assessment
- consideration of risk of material misstatement
- objectives of reporting: accordance w/ GAAP, condensed by include all necessary detail and reflect org activities
- reporting risks: consider processes/ personnel/IT systems, consider external risk factors, set triggers (acct principle change, variance analysis) to evaluate control effectiveness
- fraud risk: consider incentives to commit and fraud policies, how to overcome mgt override, conduct fraud assessments
COSO Information and communication
- identify, capture, process and distribute info supporting accomplishment of reporting objectives
- financial reporting info: timely, current, accurate reporting of financial transactions
- internal control info: capture control compliance and trigger responses if needed
- internal communication: w/ employees and board
- external communication: open comm w/ all interested external parties
COSO Monitoring
- assessment of controls and reporting deficiencies
- objective evaluations of controls integrated w/ org operations, evaluators knowledgeable about reporting and controls
- metrics compare performance w/ targets, self-assessments, test computer network, internal audit, prioritize evaluation on riskiest areas
- deficiencies: report to who can control/ correct process errors and one level above, significant deficiencies to top mgt and board, compliance and ethics hotlines for reporting
COSO Existing Control Activities
- activities should mitigate assessed risks
- control selection: cost-benefit analysis, efficiency/effectiveness, segregation of duties
- IT: application and general controls, systems development, system changes, security
COSO Enterprise Risk Management – Integrated Framework
- comprehensive response to risk mgt
- effectively deal w/ uncertainty, evaluate risk acceptance and build value
- maximize value when strategy balances risks and rewards, and efficiency/effectiveness in accomplishing objectives, make capital investments w/in risk constraints
ERM Objectives
S – Strategic: high level goals
O – Operations: effective/efficient resource use
R – Reporting: reliable reporting
C – Compliance: w/ laws/regulations
ERM Components
-broader than COSO, beyond just financial reporting I – Internal environment S – Setting objectives E – Event identification A – Assessment of risk R – Risk response A – control Activities I – Information and communication M – Monitoring
ERM: Internal Environment
P – Philosophy of risk management
H – Human resources standards
R – Risk appetite (diff’t from COSO framework)
A – Authority and responsibility
S – Structure (organizational)
E – Ethical values and integrity
D – Directors
C – Commitment to competence (not in COSO framework)
-otherwise, same as COSO framework, but all applicable to all org goals, not just reporting
ERM: Internal Environment – Risk appetite
-amount of risk org will accept in pursuit of value, important to balancing strategy with return
