Internal Control Frameworks _M1 Flashcards
What is the purpose of maintaining internal controls according to COSO?
3 bullets
- Promotion of compliance with laws and regulations
- Helping to achieve performance objectives
- Safeguarding resources.
An internal control system serves many purposes
What are the 5 organizations that make up the Comittee on Sponsoring Organizations (COSO)?
5 Industry Organizations
- Financial Executives Institute (FEI)
- American Accounting Association (AAA).
- Institute of Internal Auditors (IIA)
- Institute of Management Accountnts (IMA)
- American Institute of Certified public Accountats (AICPA)
What does Sarbanes-Oxley Act of 2002 require management to report on regarding internal controls?
Financial statement disclosures include:
- management’s assumption of responsibility for internal control
- management’s assessment of internal control effectiveness
- A statement that the auditor has reported on management’s evaluation.
What was COSO designed to do?
Help managers assess internal controls
What can management use Internal Control Framework for?
- The Integrated Framework is built on a principles-based (rather than rules-based) approach, which allows management to use judgment and flexibility
in applying internal controls. Which means mgmt wouldn’t use it to enforce rules that must be followed - The Integrated Framework is often used to eliminate inefficient and ineffective controls.
- The Integrated Framework can be used to identify/analyze risk and to establish risk mitigation strategies.
- Internal controls are ideally applied throughout all levels of the organization
What are the 3 sides of the COSO cube?
Top column: 3 Objectives of Internal Controls
- Operations
- Reporting
- Compliance
Front facing rows: The components of internal control.
- Control Environment
- Risk Assessment
- Information and Communication
- Monitoring
- Existing Control Activities
3rd Dimension: Entity Organizational Structure.
* Entity level “Tone at the top”
* Division Level
* Operating Unit
* Function
What are the 3 objectives of internal control on the COSO cube (top rows of the cube)?
-
Operations
Safeguarding an entity’s assets against potential losses -
Reporting
The transparency of financial reporting -
Compliance
Ensuring that all applicable laws and regulations are followed
What are the 5 components of internal control framework according to COSO?
2nd dimension of the coso cube
CRIME phemonic
-
Control Environment: component of the Internal Control framework represents the processes, structures, and standards that provide the foundation for the
establishment of an entity’s internal control system. - Risk Assessment: Specify objectives, identify and analyze risk, consider potential for fraud, identify and assess changes.
- Information and Communication component of the framework involves the identification, capture, and exchange of information.
- Monitoring: activities involve assessing internal control performance in a timely manner and taking corrective actions if necessary.
- Existing Control Activities: are established by an entity’s policies and procedures
Know the duties involved with each component
What is the 1st step in ongoing monitoring?
Step1: Establishing a control baseline needs to be the first monitoring step in evaluating the effectiveness of an internal control system.
Step 2: then compare against when the evaluation is performed.
What are some examples of on-going monitoring of internal controls?
- Include such functions as verification that major disbursements meet the criteria and formal authorization of all major disbursements.
- Include reviews of large or unusual transactions and high level reviews of disaggregated information.
- Include Reviews of changes in liability reserves in excess of a specified threshold.
What are the 17 principles of the internal control’s 5 components?
-
Control Environment = EBOCA
1. Committment to Ethics and intergrity
2. Board Independence and Oversight
3. Organizational Structure
4. Commitment to Competence
5. Accountability -
Risk Assessment = SAFR
1. The specification of financial reporting objectives
2. The identification and analysis of risks
3. Considering the potential for fraud
4. The identification and assessment of change/Risk -
Information and Communication= OIE
1. Obtain and use information
2. Internally communicate information
3. Communication with external auditors -
Monitoring= SO D
1. On-going/seperate evaluation
2. The identification, communication, and correction of deficiencies -
Existing Control Activity= CATPP
1. The selection and development of control activities
2. Select and develop technology controls
3. deploy through policies and procedures
What is the 3 fraud triangle factors?
3 main bullets
- Pressure/Motivation/Incentive: both internal and external, creates the incentive to commit fraud.
- Opportunity: stems from poor internal controls, lack of duty segregation, and a weak control environment.
- Rationalization: represents the justification of actions by fraud perpetrators.
leads to fraud in the workplace.
3 main bullets
What are the different categories of deficiencies?
- Control deficiency
- Significant deficiency
- Material weakness
What are some of the things that will help mitigate management override of controls?
There could be others just to be familiar with a few
- Management override of internal controls is an inherent limitation of even an effective internal control system. Spreading influence across many individuals and layers of management would help reduce this risk.
- Internal auditors will regularly evaluate the effectiveness and execution of internal controls.
- A whistle-blower program that provides protection and anonymity for employees.
- A culture of integrity and ethical values will make it less likely that management will be willing or able to override internal controls.
What is the board typically responsible for?
3 bullets
- Establishing strategies and objectives
- Ensuring that appropriate resources and
skills are in place - Maintaining awareness of current technology
Supervisory and monitoring tasks are for management only.
