B1 - Review Flashcards
What are 3 keys of SOX 2002 Act?
- Corporate responsibility
- Enhance Financial Disclosure
- Corp and Criminal Fraud Accountability
What are 3 assessments for internal control (IC) that CEO and CFO will have assumed responsibility?
1.Design: IC has been designed to ensure material info was made available
2. Evaluate: - IC has been evaluated for Effectiveness within 90 days prior to the report
3. Conclusion to the effectiveness of IC based on their evaluation – must be included in the report.
DEC- (report in December)
What are SOX relating Corp and Criminal Accountability, including: Alter or make false doc, working paper for auditor, securities fraud and whistle-blowers?
- Alter/ make false doc- criminal penalty:- fine, in jail up to 20 yrs
- Auditor needs to review and retain workpapers for 7 years, if fail, get fined and/or in jail up to 10 yrs
- Security fraud: from 2-5 yrs in jail after the discovery. If intentionally, fine and/or in jail up to 25 years
- Whitle-Blower Protection:- file with Secretary of Labor with compen damage
What is penalty for corp officers who dont sign off Financial reports that required by SEC?
- Up to USD1M fine, and/or 10 yrs in jail
- Willling to sign off for smt wrong, USD5M fine and/or 20 yrs in jail
Definition of Internal control?
a process which is designed, implemented by Mgnt/ Board/ employee to provide reasonable assurance that it will achieve its Operating, reporting and Compliance objectives. (OCR)
<!--StartFragment-->
What is COSO? <!--EndFragment-->
<!--StartFragment-->
COSO: Committee on Sponsoring Organization - independent Private sector Initiative
In 1992, COSO issed IC- Integrated Framework - to assist corp in developing comprehensive assessment of IC effectiveness.
IC concepts: – 17 principles in 5 major IC components <!--EndFragment-->
<!--StartFragment-->
What are 5 IC integrated components needed to achieve ORC? <!--EndFragment-->
<!--StartFragment-->
CRIME
- C - Control Environment - Tone at the top: Ethics & Integrity
- R - Risk Assessment - FS misstated/ Fraud - EAR: Event identify, Assess risk, Respond to risk
- I - Information and Communication - FACT: fair, accurate, complete, timely
- M - Monitoring - IC: efficient, must report deficiencies
- E - (Existing) Control Activities - Policy/ Procedure to mitigate risk to acceptable level, tech control <!--EndFragment-->
<!--StartFragment-->
What is Effective IC? <!--EndFragment-->
- All CRIME and 17 principles are relevant to both Present & Functioning - meant that they are included in current IC sys, operated as designed.
- CRIME operated as an integrated sys to reduce risk to acceptable level
- If major deficiency is identified, the entity may not conclude Effective IC under COSO
<!--StartFragment-->
What is Enterprise Risk Management - ERM? <!--EndFragment-->
In 2004, COSO issued ERM - Integrated Framework to assist org in developing a comprehensive response to risk management: Identify risk, determine how much uncertainty to accept and how to deal with, strategy to balance risk and returns.
- ERM’s Objectives: - 4 cate: S- ORC (Strategy for S)
- ERM’s components - Broader in scope of COSO IC framework
<!--StartFragment-->
What is ERM’s components? SI EAR AIM or S-CRIME <!--EndFragment-->
SI : Setting Objectives, Internal Environment: S -C of CRIME
EAR: Event Indentification, Assess risk, Risk response : R of CRIME
AIM: Activities control, Info and Communication and Monitoring - IME of CRIME
<!--StartFragment-->
What is Internal Environment of ERM’s components? <!--EndFragment-->
Same as C in CRIME, plus:
- HR : hire, train qualified people
- Risk Mgnt philosophy shared (Aggressive or Conservative)
- Risk level Appetite (accepted)
<!--StartFragment-->
What is the difference between Inherent risk and Residual Risk? <!--EndFragment-->
Inherent risk = risk if no action is taken to change
Residual risk = risk after action is taken
<!--StartFragment-->
What is assessment risk? <!--EndFragment-->
- Identify if inherent vs residual risk
- Establish likelihood (probability to occur) and Impact (consequence of an events occurrence, refered as severity or seriousness)
- Data sources: – from past experience with similar events
- Assessment technique: (i) Benchmarking (look at industry standards) (ii) Probability model (statistic data) and non-probablility model (assumpt: outcome of lawsuit)
- Event relationship
<!--StartFragment-->
What is effectiveness of ERM? <!--EndFragment-->
a. Each component must be present and functioning
b. No material weakness is considerred effective
c. Sig effective Erm - Mgnt/ BOD have reasonable assurance
<!--StartFragment-->
What is limitation fo ERM? <!--EndFragment-->
- Subject to human judgement
- Evaluate could be in error and managers could override controls