COSO Internal Controls Framework

Question 1

COSO stands for…

Answer 1

Committee of Sposoring Organizations by the Treadway Commission

Provides frameworks for Internal Controls and Enterprise Risk Management respectively

Question 2

COSO - Internal Control Framework’s objectivs

Answer 2

Provide a framework for an organization in establishing and maintaining sound internal controls over:

1) Financial reporting,
2) Effectiveness and efficiency of operations;
and 3) Compliance with regulations and laws

Question 3

Which SOX section makes CEO or CFO responsible for reviewing the company’s internal control process?

Answer 3

Section 302. Have to perform a Top Down Risk Assessment as well (TDRA), which is a high-level review starting at the entity level then working all the way down to the transaction level of detail

Question 4

Components of COSO’s Internal Control Framework

Answer 4

CRIME

Control Environment (VIR COSO A)
Risk Assessment (done in-house)
Information and Communication (at all levels of the organization)
Control Activities  (policies and procedures)
Monitoring (through audit committee, internal audit, and external audits)

Question 5

Elements that make up the Control Environment aka Internal Environment

Answer 5

VIR COSO A

Committment to Integrity and Ethical Values (VIR)

Committment to Compentency and having HR policies, processes, and procedures for hiring and training the right people

Organizational Structure - to help clearly identify lines of authority

Committment to Oversight by those charged with corporate governance - BoD establishes an audit committee and is active in the oversight process, e.g. address concerns identified by Internal Auditor and External Auditors

Accountability is enforced

Question 6

What happens to CEO or CFO that misrepresents the company’s financials?

Answer 6

They get penalized and imprisonment. It is up to the Board of Directors to remove the CEO or CFO (which they usually do anyway).

Question 7

How is the COSO’s framework for internal control different from enterprise risk management?

Answer 7

Framework for enterprise risk management has more components and brings internal control system to a risk management focus.