COSO Framework Flashcards
COSO Internal Control
Internal Controls are Processes, designed, and implemented by an entity’s management, BOD, and other employees to provide reasonable assurance about the achievement of entity objectives.
T/F COSO Internal Controls are rule based?
F - principals, tailored to the particular company in a particular industry
Reporting Objectives
Timeliness, reliability, transparency of an entity’s external and internal financial and non-financial reporting
Operational Objectives
Effectiveness and efficiency of an entity’s operations and ensuring assets of the organization are properly safeguarded
Compliance Objectives
Reasonable assurance the entity will comply with applicable laws and regulations
Control Environment
Tone at the top; includes processes, structures and standards that provide the foundation for an entity to establish a system of internal control
What are principles related to Control Environment?
Competence
Accountability
Board Independence
Lines of Authority
Ethics
Competence
Organization demonstrates commitment to attract, develop, and retain competent individuals as well as prepare for turnover and succession planning
Accountability
Organizations need to hold employees accountable for their internal control responsibilities, need to measure performance, possible incentives and rewards as appropriate, disciplinary actions as necessary
Board Independence
Board oversees internal control from initial development of controls to performance oversight
Lines of Organizational Structure
Organizational structure is tailored to the entity and reporting relationships do no undermine the commitment to effective financial reporting and internal control
Ethics
Commitment to ethics from top down through behavior, code of conduct
Risk Assessment
Relates to objective setting, assessing risks, fraud, and change management
What are the principles of Risk Assessment?
Objective Setting
Assessment of Risk
Fraud
Change Management
Objective Setting
Understanding the organization’s mission, vision, and core values to ensure the objectives are aligned with the overall goals and direction of the organization
Assessment of Risk
Assessment of operational, reporting, and compliance risks and determining how to respond
Fraud Risk
Considers incentives and pressures to commit fraud and ability to rationalize it
Fraud triangle
Incentives & pressure, opportunity, ability to rationalize
Change Management
Assessing changes that could significantly impact the system of internal control such as changes in industry trends or key employees leaving the company
Control Activities
Methods used to implement the response to risk
What are the principles of control activities
Risk reduction
Technology controls
Policies
Information and Communication
Enables internal control functions and emphasizes that a company must capture and exchange information needed to conduct, manage, and control operations; everyone also must understand their role
Internal communication
communication within the entity to enable all personnel understand and execute their internal control responsibilities
External communication
Board of directors have relevant information, IT security people provide information about networks, external auditors can provide information about accounting controls
Monitoring
Process used to assess the quality of internal control performance over time through ongoing evaluations, separate evaluations, or a combination; essential for the effectiveness of internal control providing assurance that errors or deviations will be detected and corrected
Ongoing evaluations
built into the business processes at different levels of the entity
Separate evaluations
occur periodically, often by the internal audit department, vary in scope
What does effective monitoring align with?
Risk profile
What are the principles of monitoring
Ongoing/separate evaluations
Evaluate and communicate control deficiencies
Evaluate and communicate control deficiencies
Evaluation and communication should happen quickly enough to parties responsible for taking corrective action
Monitoring for change continuum
assess changes in internal control effectiveness
What are the 4 steps for monitoring for change continuum
Establish a control baseline
Change identification
Control revalidation
Establish a new baseline
Establish a control baseline
understanding the baseline condition before the change
Change identification
Through risk assessment, finding what has changes and then respond to those changes by asking what controls we can put in place to minimze theft
Control revalidation
monitor changes to make sure controls are effective
Change management
Verify controls remain effectiveness by establishing a new baseline
Enterprise Risk Management
Assists organizations in developing a comprehensive response to risk management; effectively deal with uncertainty, evaluate risk acceptance, and build value
What are the components of ERM
Governance and culture
Strategy and objective setting
Performance
Review and revision
Information, communication, reporting
What are the components of COSO
Control Enviornment
Risk Assessment
Information and Communication
Monitoring
Existing control activities
What is the main objective of ERM?
Creating, preserving, and realizing value
Governance and culture
Sets the organization’s tone, reinforcing the importance of and establishing oversight responsibilities for
Principles of governance and culture
Board oversight
Establishing operating structues
Attract develop and retain capable individuals
Define desired culture
Demonstrate commitment to core values
Principles of Strategy and objective setting
Evaluates alternative strategies
Formulates business objectives
Analyze business context
Define risk appetite
Principles of Performance
Develops portfolio view
assesses severity of risk
prioritize risk
identifies risk events
implements risk response
Principles of Review and revision
assess substantial change
pursue improvement
reviews risk and performance
Principles of Information, communication, and reporting
leverage information and technology
communicate risk information
reports on risk culture and performance
Strategy and objective setting
Evaluating alternative strategies and formulating business objectives based on vision of the organization and its mission
Performance
identifies and select risk responses as result of prioritizing risk
Review and revision
reviews performance and considers risk after the fact to determine whether the actions taken were effective in mitigating risk; re-visiting and improving efficiency
