COSO Framework Flashcards

1
Q

COSO Internal Control

A

Internal Controls are Processes, designed, and implemented by an entity’s management, BOD, and other employees to provide reasonable assurance about the achievement of entity objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

T/F COSO Internal Controls are rule based?

A

F - principals, tailored to the particular company in a particular industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Reporting Objectives

A

Timeliness, reliability, transparency of an entity’s external and internal financial and non-financial reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Operational Objectives

A

Effectiveness and efficiency of an entity’s operations and ensuring assets of the organization are properly safeguarded

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Compliance Objectives

A

Reasonable assurance the entity will comply with applicable laws and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Control Environment

A

Tone at the top; includes processes, structures and standards that provide the foundation for an entity to establish a system of internal control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are principles related to Control Environment?

A

Competence
Accountability
Board Independence
Lines of Authority
Ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Competence

A

Organization demonstrates commitment to attract, develop, and retain competent individuals as well as prepare for turnover and succession planning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Accountability

A

Organizations need to hold employees accountable for their internal control responsibilities, need to measure performance, possible incentives and rewards as appropriate, disciplinary actions as necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Board Independence

A

Board oversees internal control from initial development of controls to performance oversight

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Lines of Organizational Structure

A

Organizational structure is tailored to the entity and reporting relationships do no undermine the commitment to effective financial reporting and internal control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Ethics

A

Commitment to ethics from top down through behavior, code of conduct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Risk Assessment

A

Relates to objective setting, assessing risks, fraud, and change management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the principles of Risk Assessment?

A

Objective Setting
Assessment of Risk
Fraud
Change Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Objective Setting

A

Understanding the organization’s mission, vision, and core values to ensure the objectives are aligned with the overall goals and direction of the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Assessment of Risk

A

Assessment of operational, reporting, and compliance risks and determining how to respond

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Fraud Risk

A

Considers incentives and pressures to commit fraud and ability to rationalize it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Fraud triangle

A

Incentives & pressure, opportunity, ability to rationalize

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Change Management

A

Assessing changes that could significantly impact the system of internal control such as changes in industry trends or key employees leaving the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Control Activities

A

Methods used to implement the response to risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the principles of control activities

A

Risk reduction
Technology controls
Policies

22
Q

Information and Communication

A

Enables internal control functions and emphasizes that a company must capture and exchange information needed to conduct, manage, and control operations; everyone also must understand their role

23
Q

Internal communication

A

communication within the entity to enable all personnel understand and execute their internal control responsibilities

24
Q

External communication

A

Board of directors have relevant information, IT security people provide information about networks, external auditors can provide information about accounting controls

25
Q

Monitoring

A

Process used to assess the quality of internal control performance over time through ongoing evaluations, separate evaluations, or a combination; essential for the effectiveness of internal control providing assurance that errors or deviations will be detected and corrected

26
Q

Ongoing evaluations

A

built into the business processes at different levels of the entity

27
Q

Separate evaluations

A

occur periodically, often by the internal audit department, vary in scope

28
Q

What does effective monitoring align with?

A

Risk profile

29
Q

What are the principles of monitoring

A

Ongoing/separate evaluations
Evaluate and communicate control deficiencies

30
Q

Evaluate and communicate control deficiencies

A

Evaluation and communication should happen quickly enough to parties responsible for taking corrective action

31
Q

Monitoring for change continuum

A

assess changes in internal control effectiveness

32
Q

What are the 4 steps for monitoring for change continuum

A

Establish a control baseline
Change identification
Control revalidation
Establish a new baseline

33
Q

Establish a control baseline

A

understanding the baseline condition before the change

34
Q

Change identification

A

Through risk assessment, finding what has changes and then respond to those changes by asking what controls we can put in place to minimze theft

35
Q

Control revalidation

A

monitor changes to make sure controls are effective

36
Q

Change management

A

Verify controls remain effectiveness by establishing a new baseline

37
Q

Enterprise Risk Management

A

Assists organizations in developing a comprehensive response to risk management; effectively deal with uncertainty, evaluate risk acceptance, and build value

38
Q

What are the components of ERM

A

Governance and culture
Strategy and objective setting
Performance
Review and revision
Information, communication, reporting

39
Q

What are the components of COSO

A

Control Enviornment
Risk Assessment
Information and Communication
Monitoring
Existing control activities

40
Q

What is the main objective of ERM?

A

Creating, preserving, and realizing value

41
Q

Governance and culture

A

Sets the organization’s tone, reinforcing the importance of and establishing oversight responsibilities for

42
Q

Principles of governance and culture

A

Board oversight
Establishing operating structues
Attract develop and retain capable individuals
Define desired culture
Demonstrate commitment to core values

43
Q

Principles of Strategy and objective setting

A

Evaluates alternative strategies
Formulates business objectives
Analyze business context
Define risk appetite

44
Q

Principles of Performance

A

Develops portfolio view
assesses severity of risk
prioritize risk
identifies risk events
implements risk response

45
Q

Principles of Review and revision

A

assess substantial change
pursue improvement
reviews risk and performance

46
Q

Principles of Information, communication, and reporting

A

leverage information and technology
communicate risk information
reports on risk culture and performance

47
Q

Strategy and objective setting

A

Evaluating alternative strategies and formulating business objectives based on vision of the organization and its mission

48
Q

Performance

A

identifies and select risk responses as result of prioritizing risk

49
Q

Review and revision

A

reviews performance and considers risk after the fact to determine whether the actions taken were effective in mitigating risk; re-visiting and improving efficiency

50
Q
A