Internal Control Monitoring Flashcards
What does “competence” mean in relation to a control evaluator?
Refers to the evaluator’s knowledge of the controls and related processes, including how controls should operate and what constitutes a control deficiency
What is “accuracy”
The degree to which information can reasonably be expected to be free from error and/or to communicate results that reflect reality
Define “relevant information.”
Information is meaningful to assessing a risk, control, or control component
Define “self-review.”
Person responsible for a control (but not that person’s peer or supervisor) assesses control effectiveness. The least objective type is “self-assessment.”
Define “timely information.”
Information is produced and used in a time frame that makes it possible to prevent or detect control deficiencies before they become material
Define “suitable information.”
Must be relevant (i.e., fit for its intended purpose), reliable (i.e., accurate, verifiable and from an objective source), and timely (i.e., produced and used in an appropriate time frame)
Define “objective or objectivity.”
The measure of the extent of factors that might influence a person to report inaccurate or incomplete information about risks or controls
Define “compensating controls.
Controls that accomplish the same objective as another control and will “compensate” for deficiencies in the first control
Define “key controls.”
Controls that are most important to monitor in order to support a conclusion about the internal control system’s ability to manage or mitigate meaningful risks
Define “persuasiveness of information or persuasive information.”
The degree to which the information provides support for conclusions. Derived from its suitability (i.e., its relevance, reliability, and timeliness) and its sufficiency
Define “reliable information.”
Information must be accurate (see “Accuracy”), verifiable (see “Verifiable”) and from an objective source (see “Objective”)
Define “key risk indicators.”
Forward-looking metrics that identify critical potential problems, thus enabling an organization to take timely action, if necessary
Define “evaluator.”
An individual who monitors internal control. Must have skills, knowledge, and authority sufficient to understand risks and identify the controls needed to manage those risks. Two most important attributes are competence and objectivity
How does monitoring benefit corporate governance?
Monitoring is the core, underlying control component in the COSO ERM model. Controls degrade over time, technologies change, and people forget or get lazy. Because of this, monitoring is essential to maintaining strong internal control and effective risk management
Define “key performance indicators.”
Metrics that reflect critical success factors. They help organizations measure progress toward critical goals and objectives
