BEC Flashcards
Components of COSO Framework
C- Control environment - tone at the top
R- Risk Assessment - F/S Misstated or fraud
I- Information and Communication -Fair, Accurate, Complete and Timely(FACT)
M- Monitoring - Effectiveness of internal controls, report deficiencies
E-(Existing) Control Activities- Policies/procedures to mitigate risk
Control Environment
EBOCA
E- Ethics - commitment to ethical values
B- Board Independence
O- Organizational structure that facilitates ethics
C- Commitment to Competence- Properly trained employees
A- Accountability
Risk Assessment
E- Event identification - identify possible risks
A - Assess the risk
R- Respond to the risk
Information and Communication
Between both internal(management and board/audit committee) and external parties(to investors, customers and external auditors)
- must be fair, accurate, complete and timely(FACT)
Monitoring
Test on a timely basis internal controls for effectiveness, monitor the controls regularly to assess internal control quality
- frequency of testing dictated by risk
- assets at greatest risk tested most frequently
- must report and correct any deficiencies in a timely manner
Existing Control Activities `
- Control activities set forth by the entity to mitigate risk
- Policies and procedures to prevent and detect
- segregation of duties
- make sure existing controls are being followed and no one is overriding them
Objectives of an organization(COSO)
O - Operations
R - Reporting
C - Compliance
Effective internal control
- effective internal control provides “reasonable” assurance that the entity’s objectives will be achieved
- All components of CRIME must be PRESENT and FUNCTIONING
- PRESENT - components and relevant principles are included in the design of the internal control system
FUNCTIONING - components and relevant principles are currently operating as designed
How long to retain working papers and audit records for?
7 years
Statue of limitations for fraudulent reporting***
Earlier of 2 or 5
- 2 years since violation was found
- 5 years since violation occurred
Major deficiency identified in internal control
Organization cannot state or conclude that they have met the requirements for an effective internal control
Objectives of enterprise risk management(ERM)
S +ORC S - Strategic(high level goals to achieve the mission) O - Operational R - Reporting C- Compliance
Component of enterprise risk management(ERM)
Similar to components for internal control but BROADER in scope
IS EAR AIM
I-Internal Environment(EBOCA “HR”)
S-Setting objectives
E-Event identification
A-Assessment of risk
R-Risk response
A-control ACTIVITIES
I-Information and communication
M-Monitoring
Risk Assessment Techniques
- Benchmarking - Use of common data from similiar organizations
- Probabilistic models - Statistical data - more objective, historical data
- Non-Probabilistic Models- mere opinion, subjective assumptions
Portfolio View
When use analyze risk you look at it from an ENTITY-WIDE perspective and not specifically to an isolated department
Balanced Scorecard
A framework used for implementing strategy that converts a company’s strategic objectives into a set of performance measures(financial and non-financial measures)
Benchmarks
Industry “gold” standard
Total factor productivity ratio(TFP)
reflect the quantity of all output produced relative to the costs of all inputs used.
- Material & labor costs
- used to compare actual cost cost per unit production levels to budgeted(or prior years) production levels.
Output / Total Costs
Partial Productivity Ratios
-Material OR Labor quantity
Output / Specific quantity
Internal Benchmarks
- Find and analyze problems
- Why we’re not where we should be?
Control Charts
- Determine zero defects
- statistical analysis to determine output or usage of something is within an acceptable range