Internal Control and COSO Framework- Chapter 11

Definition of System of Internal Control

A system of internal control consists of policies and procedures designed to provide management with reasonable assurance that the company achieves its objectives and goals.

Internal Control Objectives

? Management typically has three broad objectives in designing an

effective internal control system:

Efficiency and Compliance effectiveness with laws and of operations regulations Reliability of reporting Components Principles No. of Points of Focus 1. Commitment to integrity and ethical values 2. Independent board of directors oversight 3. Structures, reporting lines, authorities, responsibilities 4. Attract, develop and retain competent people UI A W 5. People held accountable for internal control 6. Clear objectives specified 7. Risks identified to achievement of objectives WAVU Control Environment 8. Potential for fraud considered 9. Significant changes identified and assessed Risk Assessment Control Activities 10. Control activities selected and developed 11. General IT controls selected and developed ata Information & Communication 12. Controls deployed through policies and procedures Monitoring Activities 13. Quality information obtained, generated and used 14. Internal control information internally communicated UI A UT 15. Internal control information externally communicated 16. Ongoing and /or separate evaluations conducted W V 17. Internal control deficiencies evaluated and communicatedAre controls designed to address risks related to assertions (complete, exist, accurate etc) for accounts, transactions, and disclosures Evaluate the design of internal control over financial reporting Test the operating effectiveness of those controls Are controls operating as designed? Does control operator possess authority and qualifications to perform the control? Consists of the actions, policies, and procedures that reflect the overall Control environment attitudes of top management, directors, and owners of an entity about internal control and its importance to the entity Involves a process for identifying and analyzing risks that may prevent the organization from achieving its objectives Control activities Policies and procedures that help ensure that necessary actions are taken to address risks to the achievement of the entity's objectives Risk assessment Information and To initiate, record, process, and report the entity's transactions and to communication maintain accountability for the related assets Deal with ongoing or periodic assessment of the quality of internal control by management to determine that controls are operating as intended and that they are modified as appropriate for changes in conditions PREVENTIVE CONTROLS AVOIDS AN INCIDENT FROM OCCURRING DETECTIVE CONTROLS IDENTIHE'S DETAILS AND DATA ASSOCIATED WITH AN INCIDENT'S ACTIVITIES CORRECTIVE FIXES COMPONENTS CONTROLS OR SYSTEMS AFTER AN INCIDENT HAS OCCURRED DETERRENT CONTROL TO DISCOURAGE CONTROLS A POTENTIAL BAD ACTOR FROM COMMITTING AN INCIDENT RECOVERY CONTROL TO QUICKLY BAIING THE CONTROLS ENVIRONMENT BACK TO REGULAR OPERATIONS AFTER AN INCIDENT CONTROLS THAT PROVIDE COMPENSATING CONTROLS AN ALTERNATIVE MEASURE OF CONTROLFinancial statements are likely not correct if internal controls are not adequate. Controls over the reliability ofnancial reporting Controls over classes of transactions Accuracy of transactions (inputs and processing) leads to accuracy in outputs (account balances) \"More bang for our buck**