COSO 2 Flashcards
Points of focus are in the updated COSO to help mgt do DIM of IC and see whether 17 principles are present and functioning (you can remember that they are the principles by thinking how overstuffed the schools are with administrators.)
What does present and functioning mean?
Present means that the components and relevant principles exist in the design and implementation of the systems of internal control.
Functioning means that the components continue to exist in the system of internal control.
what are the points of focus
Example characteristics for each of the 17 principles to determine whether it is present and functioning
Requirements of a System Effective Internal Control. What does management need to conclude to say it’s system of IC is effective.
It needs to be able to say that all 5 components of internal control are present and functioning.
Effective means that all five components operated together in an integrated manner.
Aggregation of internal control deficiencies across the components doesn’t result in one or more major deficiencies.
What is a major internal control deficiency.
A major deficiency exists if an internal control deficiency or combination thereof severely reduces the likelihood of an entity achieving it’s objectives.
How do you define a major deficiency?
One or more objectives aren’t being met because a relevant principle or associated component isn’t present or functioning.
Or they aren’t operating together.
Use this and other external standards for defining the severity of, evaluating and reporting deficiency.
Do you have to have all the points of focus.
No they are just examples, or enablers, aren’t required to have an effective system.
COSO Points of Focus
Updated framework describes points of focus to assist management in designing, implementing and maintaining internal control and assessing whether 17 principals are present and functioning. What does present and functioning mean. (see another card)
Which of the following control activities should be taken to reduce the risk of incorrect processing in a newly installed computer system.
Ensure proper authorization of transactions.
Safeguard assets.
