BEC - 1 Flashcards
COSO is the framework for assessment of
of internal controls over financial reporting.
COSO is used by management and the BOD for
understanding and obtaining confidence.
Definition of internal control is
the process designed and implemented by an entity to provide reasonable assurance that the company will accomplish its reporting objectives.
Five components within COSO - “CRIME” equal:
Control Environment, Risk Assessment, Information and Communication, Monitoring, and Existing Control Activities
Three major objectives within COSO - “ORC”:
Operating Objective, Reporting Objective, and Compliance Objective
Control environment is the tone
at the top.
Control Environment - EBOCA
Ethical value and integrity, Board Independence and oversight, Organizational Structure, Commitment to Competence, and Accountability
Risk Assessment - EAR
Event identification, assessment of risk and respond to risk.
Information and Communication - FACT
Fair, Accurate, Complete, and Timely information
Information and Communication occurs between
internal and external parties.
Monitoring is the effectiveness of
internal controls.
Monitoring’s frequency depends on
the assessment of risk.
Monitoring should report
deficiencies and correct them.
COSO cube - organizational structure includes:
Entity level - board, division, operating unit, and function.
Effective system should be both present and
functioning. Integrated system.
Present =
included in the design of internal control.
Functioning =
operating as designed.
Effective system will reduce
the risk of not accomplishing objectives.
Limitations on internal controls equal
no guarantees - reasonable assurance to meet objectives. There are human errors, collusion, and management override.
ERM stands for
enterprise risk management.
ERM is the company’s strategy to
balance the risk and return.
ERM has four category objectives (SORC)
Strategy, Operations, Reporting, and Compliance.
ERM components =
IS EAR AIM.
IS =
Internal Environment (EBOCA HR), and setting objectives (SORC).
EAR =
Event identification, assessment of risk, response to risk.
AIM =
Control Activities (existing controls), information and communication, and monitoring.
Internal environment (EBOCA HR) = (part of IS of ERM).
HR = Risk Management Philosophy (Aggressive or Conservative), Human Resource Standards (hire, train, evaluate, compensate, promote), Risk Appetite (balance).
Financial performance measures include:
1) profit, 2) return on investment, 3) variance analysis, 4) balanced scorecard.
Nonfinancial performance measures include:
External and internal benchmarks.
External benchmarks are productivity
measures.
Examples of external benchmarks include:
1) ratio of output relative to the input, 2) total factor productivity ratios, and 3) partial productivity ratio.
Total factor productivity ratio is all inputs, including
material AND labor costs. Output over total cost.
Partial productivity ratio is
materials OR labor costs - focusing on quantity. Output over specific quantity.
Internal benchmarks are
techniques to find and analyze problems.
Internal benchmarks include:
1) control chart, 2) Pareto Diagram, and 3) Cause and effect.
Control chart determines
zero defects.
Goalpost conformance, part of control chart, keeps
deviations within an acceptable range.
The Pareto diagram is a histogram that determines
quality control issues from most frequent to least frequent.
The Pareto diagram is also known as the
frequency diagram.
Cause and effect is the
fishbone diagram.
When using a cause and effect diagram, one
works backwards.
Managers use this diagram to identify sources of problems.
Cause and effect or fishbone diagram.
The characteristics of an effective performance measure include:
promoting the achievement of goals, which motivate employees, and also are objective and easy to measure.
Marketing practices must
consider the objectives of management.
Purpose of marketing is to:
establish value of a product or service.
Transaction marketing is for
the promote the lowest price, for a single sale.
Interactive-Based Relationship marketing is for
repeat business or a loyalty discount. It promotes customer satisfaction.
Database Marketing is for
focusing in on a segment of customers - which provides more effective selling to target groups.
E-marketing is performed via
the internet.
Network Marketing is from
relationships and referrals.
Incentive compensation is to
motivate, compensate and retain its employees.
Perks are
non-salaried benefits, but when they are not related to performance of manager’s business activities may also need to be included in the taxable income.
Cash bonus can be either
fixed, which is objective, or variable, which is subjective.
Stock options promote
current and future performance. Assist in the retention of employees.
Local vs. company-wide performance incentives
Division performance may erode company-wide performance.
Cooperative incentive plans promote
one goal and an example would be stock options.
Competitive incentive plans are promoted by
tiered sales commissions.
ERM stands for
enterprise risk management.
ERM has four objectives - SORC -
Strategic, Operations, Reporting, Compliance.
The Components of ERM as acronyms are:
IS EAR AIM
IS stands for:
internal environment and setting objectives.
EAR stands for
event identification, assessment of risk, and response to risk.
AIM stands for
control Activities (existing controls), information and communication, and monitoring.
Internal environment defines
the tone of the organization.
Internal environment is supported by eight key elements:
EBOCA HR.
EBOCA HR stands for:
Ethical Values and Integrity, Board Oversight, Organizational Structure, Commitment to Competence, Accountability. Risk Management Philosophy, Human Resources Standards, and Risk Appetite.
Setting Objectives is supporting by the following key elements:
Strategic Objectives, Operations Objectives, Reporting Objectives, and Compliance objectives. “SORC”
Risk appetite is set with the oversight
of the Board of Directors. It is the benchmark for strategy setting. Willingness to accept risk to achieve return.
Event identification – the E in EAR –
considers internal (technology choices, personnel, etc) and external risks (recessions, storms, changes in society), and both negative (risks) and positive (opportunities) should be identified.
Assessment of Risk – the A in EAR – is the
likelihood and severity - probability. There is inherent risk - if management does nothing - and residual risk - the risk after management takes action.
The assessment of risk has several techniques such as:
benchmarking, or modeling (probabilistic = statistical and non-probabilistic = opinion).
Response to risk – the R in EAR – should align
with the organizations overall risk appetite. Organizations should look at risk from a portfolio view or entity-wide view.