Internal Control Audit and Compliance
Description
More details
Other editions
Additional editions
Person
Content
Preface xi
Acknowledgments xv
Chapter 1: What We All Share 1
Need for Control Criteria 1
Overview of the COSO Internal Control Integrated Framework 2
Holistic, Integrated View 3
Revised COSO Internal Controls Framework 6
What We Must Do 8
Basic Scoping and Strategies for Maintenance 11
Where We Depart 12
Triangle of Efficiency 13
Controls versus Processes 14
The Debate Continues 18
Organization of This Book 18
Appendix 1A: COSO 17 Principles 20
Chapter 2: Setting the Scope of Your Documentation Project: Identifying the Core 21
Start with Business Objectives 21
After the Initial Year 24
Mapping the Entity to the Financial Statements: Ins and Outs 25
Consider Risks, Not Just Quantitative Measures 27
Inherent and Control Risk 28
Overstatement and Understatement 28
Does "In Scope" Imply Extensive Testing? 37
A Consolation 39
Be Careful Out There! 40
Appendix 2A: Summary of Scoping Inquiries 42
Chapter 3: The Risk Assessment Component 45
Risk Assessment Principles in COSO 46
Cost Control 46
Basics 47
Likelihood, Magnitude, Velocity, and Persistence 48
Separate Assessments of Inherent and Control Risks 50
Role of Assertions 51
Assertions 52
Principles 6 and 7: Specify Suitable Objectives; Identify and Analyze Risk 56
Identifying Risks 59
External Sources of Risk Information 60
Internal and External Reporting Risks 61
Compliance Risks 61
Disclosed Material Weaknesses in Risk Assessment 62
Principle 8: Assess Fraud Risk 62
Auditor Responsibility to Detect Fraud 65
Antifraud Controls for Management to Consider 66
Ties to Other Principles and Components 66
Principle 9: Identify and Assess Significant Change 66
Gathering Information to Support the Risk Assessment and Consider Change 68
Appendix 3A: SAS No. 99 Exhibit: Management Antifraud Programs and Controls 72
Attachment 1: AICPA "CPA's Handbook of Fraud and Commercial Crime Prevention" Code of Conduct 87
Attachment 2: Financial Executives International Code of Ethics Statement 91
Appendix 3B: Understanding Fraud Risk Assessment 93
Chapter 4: Control Environment 99
Principle 1: Commitment to Integrity and Ethical Values 100
Principle 2: Board of Directors (Governance) Demonstrates Independence from Management and Exercises Oversight of the Development and Performance of Internal Control 104
Principle 3: Management Establishes, with Board Oversight, Structures, Reporting Lines, and Appropriate Authorities and Responsibilities in the Pursuit of Objectives 109
Principle 4: Commitment to Attract, Develop, and Retain Competent Individuals in Alignment with Objectives 110
Principle 5: The Organization Holds Individuals Accountable for Their Internal Control Responsibilities in the Pursuit of Objectives 113
Appendix 4A: Understanding and Awareness of Control Responsibilities 117
Chapter 5: Control Activities 120
Principle 10: Selects and Develops Control Activities to Mitigate Risk and Achieve Objectives 120
Principle 11: Selects and Develops General Controls over Technology 132
Principle 12: Deploys through Policies and Procedures 141
Summing Up 143
Appendix 5A: Linking Common Control Activities and Assertions 146
Appendix 5B: Linkage of Principles to Controls, Policies, and Procedures 158
Chapter 6: Information and Communication 165
Principle 13: Generates Relevant Information 166
Principle 14: Communicates Internally 168
Principle 15: Communicates Externally 170
Chapter 7: Monitoring 173
Principle 16: Select, Develop, and Perform Ongoing and/or Separate Evaluations 174
Principle 17: Evaluate and Communicate Deficiencies as Appropriate 176
Chapter 8: Evidence and Testing 179
Sufficient Evidence 179
Gathering Information 187
Testing and Sampling 194
Nonsampling Situations 202
Confusion of Sample Size Guidance in Practice Today 203
Information Technology General Controls 204
Testing Security and Access 205
Appendix 8A: Sample Size Tutorial 211
Chapter 9: Developing Questionnaires and Conducting Interviews 217
Surveys of Employees 219
Conducting Interviews 224
Management Inquiries: Sample Questions 234
Appendix 9A: Sample Practice Aids 239
Chapter 10: Assessing the Severity of Identified Controls Deficiencies 248
It's Inevitable 248
Alignment of Public and Private Company Standards for Assessing Deficiency Severity 251
Control Deficiencies and Definitions 252
Key Factors When Assessing the Severity of a Deficiency 263
Conditions Indicating Control Deficiencies 270
Examples of Evaluating the Severity of Deficiencies 277
Overall Assessment 281
Appendix 10A: A Framework for Evaluating Control Exceptions and Deficiencies 283
Appendix 10B: Assessing the Potential Magnitude of a Control Deficiency 299
Chapter 11: Reporting Requirements 302
Nonpublic Entity Reporting 302
Public Company Annual and Quarterly Reporting Requirements 304
Reporting on Management's Responsibilities for Internal Control 309
Required Company and Auditor Communications 312
Reporting the Remediation of Weaknesses 314
Coordinating with the Independent Auditors and Legal Counsel 315
Appendix 11A: Illustrative AICPA Report on Internal Controls 316
Chapter 12: Project Management and Tools Assessment Design 318
Project Management 318
Structuring the Project Team 319
Tools Assessment Design 325
Features of a Good Tools Solution 326
Value of a Pilot Project 331
Coordinating with the Independent Auditors 334
Chapter 13: Illustrative Forms and Templates 337
Historical Perspective 338
2013 Framework Examples 340
Appendix 13A: Information-Gathering Form-Principle Focused 348
Appendix 13B: Information Gathering Form-Revenue 350
Appendix 13C: Walk-through Documentation Form 353
Appendix 13D: Information Technology General Controls Assessment Form 355
Appendix 13E: Documentation of Financial Reporting Software and Spreadsheets 364
Appendix 13F: Sampling Form for Tests of Controls 368
Appendix 13G: Summary of Internal Control Deficiencies 371
Appendix 13H: Control Environment Component Evaluation Summary 372
Chapter 14: Summing Up 373
About the Author 375
Index 377
Chapter 1
What We All Share
Regardless of the type of entity, all Committee of Sponsoring Organizations of the Treadway Commission (COSO) Framework users and auditors in the public and nonpublic sectors share a great deal in common. We broadly outline those shared characteristics here before plunging into the details of application and documentation. This will also help readers to target the specific goals they have in studying this material. Later these concepts are developed in more detail. For now they serve to overview the subject matter.
Need for Control Criteria
Early auditing literature talked about controls, primarily in terms of controls over more routine transactions, such as cash receipts and disbursements. Based on the analysis of business and accounting failures over decades of experience, it became clear that a broader view of controls was necessary to address the various management, information processing, or oversight weaknesses that so often contributed to these events. However, there was no broader framework or set of criteria against which to evaluate the effectiveness of the entity in controlling its risk of filing materially false financial information and preventing other types of fraud. The COSO Framework has filled that void.
A set of criteria is a standard against which a judgment can be made. In the United States, the internal control integrated framework published by COSO is just about the only overall controls criteria to assess the effectiveness of internal controls over financial reporting (ICFR). Choosing an appropriate control criteria is a Securities and Exchange Commission (SEC) requirement for public companies when performing an assessment of the effectiveness of an entity's internal control. The American Institute of Certified Public Accountants (AICPA) auditing literature references COSO components in its guidance to auditors of nonpublic companies, so from a practical perspective, COSO is the only game in town. While there are other frameworks out there (e.g., the criteria of control (COCO) framework from Canada, the Turnbull Report in the United Kingdom, and SOX of Japan), these are not that dissimilar to COSO in overall concept and have not gained wide acceptance outside of their home countries.
Overview of the COSO Internal Control Integrated Framework
In 1985, COSO was formed to sponsor the National Commission on Fraudulent Financial Reporting, whose charge was to study and report on the factors that can lead to fraudulent financial reporting. It was motivated by yet another intense period of time when financial reporting fraud and alleged audit failures were prominent in the news. Since this initial undertaking, COSO has expanded its mission to improving the quality of financial reporting. A significant part of this mission is aimed at developing guidance on internal control. In 1992, COSO published Internal Control-Integrated Framework, which established a framework for internal control and provided evaluation tools that businesses and other entities could use to evaluate their control systems.1
The COSO internal control framework identifies five components of internal control:
- Control environment
- Risk assessment
- Control procedures
- Information and communication
- Monitoring
Today these remain unchanged from the 1992 Framework. That is a testament to the fundamental correctness of the COSO Framework. However, the level of detailed guidance over the years has increased due to the more recent widespread implementation of the Framework in our business environment and a desire to have more consistency in the application of COSO principles.
Holistic, Integrated View
The COSO Framework identifies five main components of internal control, and one of the keys of working with it is to understand how these components relate to and influence one another. COSO envisions these individual components as being tightly integrated in a nonlinear fashion. Each component has a relationship with and can influence the functioning of every other component, operating in an almost organic way.
The five interrelated components of the COSO Framework are, briefly:
- Control environment. Senior management must set an appropriate tone at the top that positively influences the control consciousness of entity personnel. The control environment is the foundation for all other components of internal controls and provides discipline and structure.
- Risk assessment. The entity must be aware of and deal with the financial reporting risks it faces. It must set objectives, integrated throughout its activities, so that the organization is operating in concert. Once these objectives are set, the entity is in a better position to identify the risks to achieving those objectives and to analyze and develop ways to manage them.
- Control activities. Control policies and procedures must be established and executed to help ensure transactions being processed on a day-to-day basis, such as sales and expense transactions, or on a periodic basis, such as accruals and consolidations, are resulting in complete and accurate accounting recognition.
- Information and communication. Surrounding the control activities are information and communication systems, including the accounting system. Whether manual or most likely today implemented using automated (computer) systems, they enable the entity's people to capture and exchange the information needed to conduct, manage, and control its operations. The information and communication component is comprised of both internal (e.g., management, governance) and external communications (e.g., shareholders, prospective investors, or creditors).
- Monitoring. The COSO Framework identifies monitoring as the responsibility of management. The auditor is not a part of the entity's system of internal control. The entire company control process should be monitored on a regular basis by management, and issues that arise should be communicated appropriately within the organization. In this way, the system should be in a position to react dynamically, as changing as conditions warrant, and not require that special procedures or independent audit procedures detect these problems. The company is expected to be proactive in identifying and correcting control deficiencies.
Figure 1.1 is from the 1992 COSO Integrated Framework report. It depicts these five elements of internal control and their interrelationships in a 3-sided pyramid, with the control environment as the base.
Figure 1.1 COSO Framework
Note that the information and communication component is positioned along the edge of the pyramid structure, indicating that this component has close linkages to the other components. It probably would be even more accurate if the component were depicted as affecting all other ones, including control environment and monitoring, as it is difficult to envision these components being effective without effective information and communication.
Historically, the auditing literature has pictorially described the COSO Framework in the shape of a cube (see Figure 1.2). This representation shows that controls can affect the entity either on an entity-wide basis or specifically on a divisional, regional or product line basis. The 2013 revision changed the "cube" and placed the control environment at the top of the cube. The strong hierarchical image of the pyramid and its strong base is somewhat lost in this representation, but for complex entities with multiple product lines or locations, the cube works well.
Figure 1.2 COSO Framework II
While both models have advantages, whatever the model used to communicate the Framework, it is helpful to have some physical representation of the Framework as a training tool and as a reminder of the components when initiating a project or bringing new personnel into an existing project. In the early days of Sarbanes-Oxley (SOX) implementation, some creative ways were developed to etch the components firmly in the auditor's mind. A unique product was a pen that revealed a new component each time the ballpoint pen point was retracted or extended.
A blessing of the COSO Framework is that together the five components seem to be satisfactory in describing the broad sources of internal control issues. The corresponding curse is that it is sometimes difficult to determine where specific facts and controls fall within the framework. While it would be nice if a one-to-one relationship existed between processes and controls and the Framework components, that is not the case. Entities can and did make their own decisions where controls belonged under the 1992 Framework. The focus and 17 Principles in the 2013 Framework will reduce the variability in classifying controls within the Framework going forward.
For example, the 1992 COSO Framework report contained only passing mention of information technology (IT). Can we cleanly assign IT to just one component? Clearly there is a linkage to the control activities component since automated accounting processes and controls depend on the IT being effective. In another sense, IT is important to information and communication, which relies on data in company databases being accurate and complete. And it is hard to imagine running a business or performing the governance function effectively without accurate and timely financial data, so failures of IT can also impact the control...
