Coso Internal Control Framework
This document was uploaded by user and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this DMCA report form. Report DMCA
Overview
Download & View Coso Internal Control Framework as PDF for free.
More details
- Words: 1,541
- Pages: 38
Loading documents preview...
COSO Internal Control Framework
1
IA Definition
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps organization accomplish its objectives by bringing a systematic, diciplined approach to evaluate and improve the effectiveness of risk management, control, and governance process
2
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) The Institute of Management Accountants (IMA) The American Accounting Association (AAA) The American Institute of Certified Public Accountants (AICPA) The Institute of Internal Auditors (IIA) Financial Executives International (FEI)
3
Internal Control-Definition (COSO) Internal control is a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance
4
Benefits and Costs of Internal Control Benefits
added confidence regarding the achievement of objectives provides feedback on how a business is functioning helps to reduce surprises meet certain requirements to access capital markets reliable reporting for decision making consistent mechanisms for processing transactions increased efficiency within functions and processes a basis for decisions ability and confidence to accurately communicate business performance
Costs
5
Direct costs Indirect costs Opportunity costs
Roles and Responsibilites Responsible Parties
The Board of Directors and Its Committees Senior Management Business-Enabling Functions Other Personnel Internal Auditors
External Parties
6
Outsourced Service Providers Other Parties Interacting with the Entity Independent Auditor External Reviewers Legislators and Regulators Financial Analysts, Bond Rating Agencies, and the News Media
7
Limitations of Internal Control Preconditions of Internal Control Judgment Breakdowns Management Override Collusion
8
COSO Internal Control Framework
9
COSO Internal Control Framework
10
COSO IC Framework 2013
Components & Principles Control Environment
Risk Assessment
Control Activities Information & Communication Monitoring Activities 11
1. 2. 3. 4. 5. 6. 7. 8. 9.
Demonstrates commitment to integrity and ethical values Exercises oversight responsibility Establishes structure, authority and responsibility Demonstrates commitment to competence Enforces accountability Specifies suitable objectives Identifies and analyzes risk Assesses fraud risk Identifies and analyzes significant change
10. Selects and develops control activities 11. Selects and develops general controls over technology 12. Deploys through policies and procedures 13. Uses relevant information 14. Communicates internally 15. Communicates externally
16. Conducts ongoing and/or separate evaluations 17. Evaluates and communicates deficiencies
Control Environment The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control and expected standards of conduct
12
Control Environment
Demonstrates commitment to integrity and ethical values
Sets the Tone at the Top Establishes Standards of Conduct Evaluates Adherence to Standards of Conduct Addresses Deviations in a Timely Manner
13
Control Environment
Exercises oversight responsibility
Establishes Oversight Responsibilities Applies Relevant Expertise Operates Independently Provides Oversight for the System of Internal Control
14
Control Environment
Establishes structure, authority and responsibility
Considers All Structures of the Entity Establishes Reporting Lines Defines, Assigns, and Limits Authorities and Responsibilities
15
Control Environment
Demonstrates commitment to competence
Establishes Policies and Practices Evaluates Competence and Addresses Shortcomings Attracts, Develops, and Retains Individuals Plans and Prepares for Succession
16
Control Environment
Enforces accountability
Enforces Accountability through Structures, Authorities, and Responsibilities Establishes Performance Measures, Incentives, and Rewards Evaluates Performance Measures, Incentives, and Rewards for Ongoing Relevance Considers Excessive Pressures Evaluates Performance and Rewards or Disciplines Individuals
17
Risk Assessment Risk assessment involves a dynamic and iterative process for identifying and analyzing risks to achieving the entity’s objectives, forming a basis for determining how risks should be managed. Management considers possible changes in the external environment and within its own business model that may impede its ability to achieve its objectives
18
Risk Assessment 6. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. 8. The organization considers the potential for fraud in assessing risks to the achievement of objectives.
9. The organization identifies and assesses changes that could significantly impact the system of internal control.
19
Risk Assessment
Specifies suitable objectives
Reflects Management’s Choices Considers Tolerances for Risk Includes Operations and Financial Performance Goals Forms a Basis for Committing of Resources
20
Risk Assessment
Identifies and analyzes risk
Includes Entity, Subsidiary, Division, Operating Unit, and Functional Levels Analyzes Internal and External Factors Involves Appropriate Levels of Management Estimates Significance of Risks Identified Determines How to Respond to Risks
21
Risk Assessment
Assesses fraud risk
Considers Various Types of Fraud Assesses Incentive and Pressures Assesses Opportunities Assesses Attitudes and Rationalizations
22
Risk Assessment
Identifies and analyzes significant change
Assesses Changes in the External Environment Assesses Changes in the Business Model Assesses Changes in Leadership
23
Control Activities Control activities are the actions established by policies and procedures to help ensure that management directives to mitigate risks to the achievement of objectives are carried out. Control activities are performed at all levels of the entity and at various stages within business processes, and over the technology environment
24
Control Activities
10. The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
11. The organization selects and develops general control activities over technology to support the achievement of objectives.
12. The organization deploys control activities through policies that establish what is expected and procedures that put policies into place.
25
Control Activities
Selects and develops control activities
Integrates with Risk Assessment Considers Entity-Specific Factors Determines Relevant Business Processes Evaluates a Mix of Control Activity Types Considers at What Level Activities Are Applied Addresses Segregation of Duties
26
Control Activities
Selects and develops general controls over technology
Determines Dependency between the Use of Technology in Business Processes and Technology General Controls Establishes Relevant Technology Infrastructure Control Activities Establishes Relevant Security Management Process Control Activities Establishes Relevant Technology Acquisition, Development, and Maintenance Process Control Activities
27
Control Activities
Deploys through policies and procedures
Establishes Policies and Procedures to Support Deployment of Management’s Directives Establishes Responsibility and Accountability for Executing Policies and Procedures Performs in a Timely Manner Takes Corrective Action Performs Using Competent Personnel Reassesses Policies and Procedures
28
Information & Communication Information is necessary for the entity to carry out internal control responsibilities in support of achievement of its objectives. Communication occurs both internally and externally and provides the organization with the information needed to carry out day-to-day controls. Communication enables personnel to understand internal control responsibilities and their importance to the achievement of objectives
29
Information & Communication
13. The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. 14. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. 15. The organization communicates with external parties regarding matters affecting the functioning of internal control.
30
Information & Communication
Uses relevant information
Identifies Information Requirements Captures Internal and External Sources of Data Processes Relevant Data into Information Maintains Quality throughout Processing Considers Costs and Benefits
31
Information & Communication
Communicates internally
Communicates Internal Control Information Communicates with the Board of Directors Provides Separate Communication Lines Selects Relevant Method of Communication
32
Information & Communication
Communicates externally
Communicates to External Parties Enables Inbound Communications Communicates with the Board of Directors Provides Separate Communication Lines Selects Relevant Method of Communication
33
Monitoring Activities Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning. Findings are evaluated and deficiencies are communicated in a timely manner, with serious matters reported to senior management and to the board
34
Monitoring Activities
16. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
17. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
35
Monitoring Activities
Conducts ongoing and/or separate evaluations
Considers a Mix of Ongoing and Separate Evaluations Considers Rate of Change Establishes Baseline Understanding Uses Knowledgeable Personnel Integrates with Business Processes Adjusts Scope and Frequency Objectively Evaluates
36
Monitoring Activities
Evaluates and communicates deficiencies
Assesses Results Communicates Deficiencies Monitors Corrective Actions
37
COSO Internal Control Framework vs COSO ERM Framework
38
1
IA Definition
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps organization accomplish its objectives by bringing a systematic, diciplined approach to evaluate and improve the effectiveness of risk management, control, and governance process
2
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) The Institute of Management Accountants (IMA) The American Accounting Association (AAA) The American Institute of Certified Public Accountants (AICPA) The Institute of Internal Auditors (IIA) Financial Executives International (FEI)
3
Internal Control-Definition (COSO) Internal control is a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance
4
Benefits and Costs of Internal Control Benefits
added confidence regarding the achievement of objectives provides feedback on how a business is functioning helps to reduce surprises meet certain requirements to access capital markets reliable reporting for decision making consistent mechanisms for processing transactions increased efficiency within functions and processes a basis for decisions ability and confidence to accurately communicate business performance
Costs
5
Direct costs Indirect costs Opportunity costs
Roles and Responsibilites Responsible Parties
The Board of Directors and Its Committees Senior Management Business-Enabling Functions Other Personnel Internal Auditors
External Parties
6
Outsourced Service Providers Other Parties Interacting with the Entity Independent Auditor External Reviewers Legislators and Regulators Financial Analysts, Bond Rating Agencies, and the News Media
7
Limitations of Internal Control Preconditions of Internal Control Judgment Breakdowns Management Override Collusion
8
COSO Internal Control Framework
9
COSO Internal Control Framework
10
COSO IC Framework 2013
Components & Principles Control Environment
Risk Assessment
Control Activities Information & Communication Monitoring Activities 11
1. 2. 3. 4. 5. 6. 7. 8. 9.
Demonstrates commitment to integrity and ethical values Exercises oversight responsibility Establishes structure, authority and responsibility Demonstrates commitment to competence Enforces accountability Specifies suitable objectives Identifies and analyzes risk Assesses fraud risk Identifies and analyzes significant change
10. Selects and develops control activities 11. Selects and develops general controls over technology 12. Deploys through policies and procedures 13. Uses relevant information 14. Communicates internally 15. Communicates externally
16. Conducts ongoing and/or separate evaluations 17. Evaluates and communicates deficiencies
Control Environment The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control and expected standards of conduct
12
Control Environment
Demonstrates commitment to integrity and ethical values
Sets the Tone at the Top Establishes Standards of Conduct Evaluates Adherence to Standards of Conduct Addresses Deviations in a Timely Manner
13
Control Environment
Exercises oversight responsibility
Establishes Oversight Responsibilities Applies Relevant Expertise Operates Independently Provides Oversight for the System of Internal Control
14
Control Environment
Establishes structure, authority and responsibility
Considers All Structures of the Entity Establishes Reporting Lines Defines, Assigns, and Limits Authorities and Responsibilities
15
Control Environment
Demonstrates commitment to competence
Establishes Policies and Practices Evaluates Competence and Addresses Shortcomings Attracts, Develops, and Retains Individuals Plans and Prepares for Succession
16
Control Environment
Enforces accountability
Enforces Accountability through Structures, Authorities, and Responsibilities Establishes Performance Measures, Incentives, and Rewards Evaluates Performance Measures, Incentives, and Rewards for Ongoing Relevance Considers Excessive Pressures Evaluates Performance and Rewards or Disciplines Individuals
17
Risk Assessment Risk assessment involves a dynamic and iterative process for identifying and analyzing risks to achieving the entity’s objectives, forming a basis for determining how risks should be managed. Management considers possible changes in the external environment and within its own business model that may impede its ability to achieve its objectives
18
Risk Assessment 6. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. 8. The organization considers the potential for fraud in assessing risks to the achievement of objectives.
9. The organization identifies and assesses changes that could significantly impact the system of internal control.
19
Risk Assessment
Specifies suitable objectives
Reflects Management’s Choices Considers Tolerances for Risk Includes Operations and Financial Performance Goals Forms a Basis for Committing of Resources
20
Risk Assessment
Identifies and analyzes risk
Includes Entity, Subsidiary, Division, Operating Unit, and Functional Levels Analyzes Internal and External Factors Involves Appropriate Levels of Management Estimates Significance of Risks Identified Determines How to Respond to Risks
21
Risk Assessment
Assesses fraud risk
Considers Various Types of Fraud Assesses Incentive and Pressures Assesses Opportunities Assesses Attitudes and Rationalizations
22
Risk Assessment
Identifies and analyzes significant change
Assesses Changes in the External Environment Assesses Changes in the Business Model Assesses Changes in Leadership
23
Control Activities Control activities are the actions established by policies and procedures to help ensure that management directives to mitigate risks to the achievement of objectives are carried out. Control activities are performed at all levels of the entity and at various stages within business processes, and over the technology environment
24
Control Activities
10. The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
11. The organization selects and develops general control activities over technology to support the achievement of objectives.
12. The organization deploys control activities through policies that establish what is expected and procedures that put policies into place.
25
Control Activities
Selects and develops control activities
Integrates with Risk Assessment Considers Entity-Specific Factors Determines Relevant Business Processes Evaluates a Mix of Control Activity Types Considers at What Level Activities Are Applied Addresses Segregation of Duties
26
Control Activities
Selects and develops general controls over technology
Determines Dependency between the Use of Technology in Business Processes and Technology General Controls Establishes Relevant Technology Infrastructure Control Activities Establishes Relevant Security Management Process Control Activities Establishes Relevant Technology Acquisition, Development, and Maintenance Process Control Activities
27
Control Activities
Deploys through policies and procedures
Establishes Policies and Procedures to Support Deployment of Management’s Directives Establishes Responsibility and Accountability for Executing Policies and Procedures Performs in a Timely Manner Takes Corrective Action Performs Using Competent Personnel Reassesses Policies and Procedures
28
Information & Communication Information is necessary for the entity to carry out internal control responsibilities in support of achievement of its objectives. Communication occurs both internally and externally and provides the organization with the information needed to carry out day-to-day controls. Communication enables personnel to understand internal control responsibilities and their importance to the achievement of objectives
29
Information & Communication
13. The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. 14. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. 15. The organization communicates with external parties regarding matters affecting the functioning of internal control.
30
Information & Communication
Uses relevant information
Identifies Information Requirements Captures Internal and External Sources of Data Processes Relevant Data into Information Maintains Quality throughout Processing Considers Costs and Benefits
31
Information & Communication
Communicates internally
Communicates Internal Control Information Communicates with the Board of Directors Provides Separate Communication Lines Selects Relevant Method of Communication
32
Information & Communication
Communicates externally
Communicates to External Parties Enables Inbound Communications Communicates with the Board of Directors Provides Separate Communication Lines Selects Relevant Method of Communication
33
Monitoring Activities Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning. Findings are evaluated and deficiencies are communicated in a timely manner, with serious matters reported to senior management and to the board
34
Monitoring Activities
16. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
17. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
35
Monitoring Activities
Conducts ongoing and/or separate evaluations
Considers a Mix of Ongoing and Separate Evaluations Considers Rate of Change Establishes Baseline Understanding Uses Knowledgeable Personnel Integrates with Business Processes Adjusts Scope and Frequency Objectively Evaluates
36
Monitoring Activities
Evaluates and communicates deficiencies
Assesses Results Communicates Deficiencies Monitors Corrective Actions
37
COSO Internal Control Framework vs COSO ERM Framework
38
Related Documents
Coso Internal Control Framework
January 2021 1
Internal Control
January 2021 1
Internal Control Affecting Assets
February 2021 1
Cobit, Coso
January 2021 1
Chapter8&9-internal Control-wps Office.pptx
February 2021 1
Informe Coso 1
January 2021 1More Documents from "Pedro Torres"