Module 2 - Unit 5 - Risk Assurance and Reporting

Question 1

What meanings does ‘control’ have in an organisation?

Answer 1

In organisations, ‘control’ has different meanings:
• control as part of the management process (plan, organise, lead, control)
• control as a measure to modify risk (risk treatment)
• control as an assurance framework (control environment).

Question 2

What makes up an internal control system?

Answer 2

An internal control system encompasses the policies, processes, tasks, behaviours and other aspects of a company.

Question 3

What does an internal control system aim to achieve?

Answer 3

An internal control system encompasses the policies, processes, tasks, behaviours and other aspects of a company that, taken together:

• Facilitate its effective and efficient operation by enabling it to respond appropriately to significant business, operational, financial, compliance and other risks to achieving the company’s objectives. This includes the safeguarding of assets from inappropriate use or from loss and fraud and ensuring that liabilities are identified and managed.
• Help ensure the quality of internal and external reporting.
• Help ensure compliance with applicable laws and regulations, and also with internal policies with respect to the conduct of business.

Question 4

How do ISO31000 and COSO risk management standards refer to the control environment?

Answer 4

The phrase ‘control environment’ is preferred by internal auditors.

ISO 31000 refers to the ‘risk management context’.
The COSO ERM cube refers to the ‘internal environment’.

Question 5

How can an organisation best design effective internal controls?

Answer 5

When designing effective internal controls, the organization should look at the arrangements in place to achieve the following:
• Maintenance of reliable systems;
• Timely preparation of reliable information;
• Safeguarding of assets;
• Optimum use of resources;
• Preventing and detecting fraud and error

Question 6

What four components are measured by the CoCo framework when considering the quality of the control environment?

Answer 6

• Purpose - What are we here for?
• Commitment - Do we want to do a good job?
• Capability - What action do we need to take?
• Monitoring and learning - What progress? What next?

Question 7

What does CoCo define as the three major objectives of controls?

Answer 7

CoCo defines three major objectives of controls:
• Effectiveness and efficiency of operations;
• Reliability of internal and external reporting;
• Compliance with applicable laws and regulations and internal policies.

Question 8

What are the main responsibilities of the audit committee?

Answer 8

1. External audit
2. Internal audit
3. Financial reporting
4. Regulatory reports