Corporate Governance, IC, ERM Flashcards
What is necessary to be an audit committee financial expert according to the criteria specified in the Sarbanes-Oxley Act of 2002
Experience with internal accounting controls
5 components of COSO’s ERM framework
Manages uncertainty/risk tolerance {ESPRI}:
- Governance and culture
- Strategy and Objective setting
- Performance
- Review and Revision
- Information, Communication, Reporting
The proper sequence for monitoring IC?
- ID, evaluate design effectiveness of company level controls
- Examine financial reporting elements, ID assertions relevant
- ID supporting process underlying the account
- Risk assessment and ID key control objectives, testing design and operating effectiveness of key controls
Which is the most useful risk when being prioritized?
Expected value (bc its compared with expected value of risks associated with alternative decisions)
Duties of BOD
Fiduciary duty to:
Act loyally
Act with a duty of care
Act with due diligence
How is a director NOT independent
- Recently employed/affiliate
- Former partner or EE of external auditor or family member was officer of entity (5 yrs for NYSE, 3 yrs for NASDAQ) or rec > 120,000 for any 12 month period within last 3 yrs
Name the various committees
Audit, Compensation/Benefits, Nominating, Finance, Regulatory, Science
What are the Institute of Internal Auditors (IIA) 3 components?
- Definition of internal auditing
- Code of ethics
- Int’l Standrads for the Professional Practice of Internal Auditing (ISPPIA)
Control Environment (COSO)
Foundation for all other components 5 Principles: 1. Integrity and ethical values 2. Independent BOD oversees IC 3. Org structure aligned with company values 4. Competent employees 5. Enforce IC accountability
Risk Assessment (COSO)
ID, evaluate, manage risk relevant to financial reporting
4 Principles:
1. Clear objectives that promote risk assessment and ID
2. Risks that are obstacles to objectives are analyzed and managed
3. Fraud considered in risk assessment
4. Assessment of potential changes that could affect IC
Control Activities (COSO)
May be preventative or detective; controls fall into General, Application, Physical
3 Principles:
1. Appropriate activities for risk mitigation
2. General controls objective achievement
3. Clear set of policies and procedures for activities
Information and Communication (COSO)
Communicate info in timely manner internal and external
- Relevant and quality info used to support IC
- Strong internal communication about objectives of IC
- Strong external communication about IC functions
Monitoring (COSO)
Evaluate whether 5 IC components are present and functioning
2 Principles:
1. Conducts ongoing evaluations of IC
2. Timely communication of deficiencies to TCWG
Risk Strategy
How entity responds to risk to align with its risk appetite.
Avoidance- don’t engage
Reduction- Implement control to offset risk (buy insurance)
Sharing- establish a joint venture
Acceptance- assume all risk
Corporate governance is defined as
the framework of rules and practices which ensures accountability, fairness, and appropriate disclosure in a corporation’s relationship with all its stakeholders. This framework consists of explicit and implicit contracts with owners, creditors, customers, employees, government, and the community
For willfully defective certifications, executives can be fined up to
$5 million or 20 years in prison, or both
Audit Committee typical functions
- Oversee financial reporting process
- Monitor choice of accounting policies/principles
- Monitor IC process
- Appoint, compensate oversee auditors
* * Meets with int/ext auditors without mngmt present to discuss fin reporting, IC, sig comments, etc
ERM Governance and Culture
- Exercises Board risk oversight
- Establishes operating structures
- Defines desired culture
- Demonstrates core values
- Attracts capable individuals
ERM Strategy and Objective Setting
- Analyzes business context
- Defines risk appetite
- Evaluates alternative strategies
- Formulates business objectives
ERM Performance
- Identifies risk
- Assesses severity of risk
- Prioritizes risk
- Implements risk response
- Develops portfolio view
ERM Review and Revision
- Assess substantial change
- Review risks and performance
- Pursues improvement in Enterprise Risk Management
ERM Information, Communication, Reporting
- Leverages information and technology
- Communicates risk information
- Reports on risk, culture, and performance
The four categories of entity objectives in the ERM framework are…
Strategic – High-level goals aligned with and support of the entity’s mission
Operations – Effective and efficient use of the entity’s resources
Reporting – Reliability of reporting
Compliance – Compliance with applicable laws and regulations
** IC implementation NOT part of this
Internal auditor who works in ERM performs each of the following activities…
- Giving assurance that the risks of the organization are correctly evaluated
- Evaluating the risk-management process
- Coordinating ERM activities
* does not set risk appetite or organization
What are the 3 categories of objectives of COSO - IC Integrated Framework
- Operations- efficiency, financial performance goals
- Reporting- internal/external and financial/nonfinancial (reliability, timeliness)
- Compliance- laws adhered to via strong IC
