COSO Frameworks��

1

Webinar Learning Objectives

By the end of this course, participants will be able to:

•Understand the new requirements of the COSO Internal Control Frameworks and assessing their impact on the business, systems and the financial statements

•Learn how to formulate and assess operational controls, compliance responsibilities and processes, financial reporting directives and the actions to take to fortify possible vulnerabilities in existing controls

•Describe the roles of main parties and supporting parties to an ICR report.

•Design, implement and operate internal controls in single process or whole Organization

•Align controls with actual risks

•Prepare internal control documentation at required level and format

•Know where and when to consider automation of monitoring

2

Introduction to COSO Internal Control Framework 2013

3

Introduction to the COSO 2013 Framework

• Updated Internal Control – Integrated Framework (2013 Framework) issued on May 14, 2013
• Companion documents:
• Internal Control – Integrated Framework: Executive Summary
• Illustrative Tools for Assessing Effectiveness of a System of Internal Control
• Internal Control over External Financial Reporting: A Compendium of Approaches and Examples

COSO 1992 Framework will be available �until December 15, 2014, then superseded

4

Internal Control – Integrated Framework (2013 Framework) issued on May 14, 2013

• This Framework was commissioned by Committee Of Sponsoring Organizations COSO, which is dedicated to providing thought leadership through the development of comprehensive frameworks and guidance on internal control, enterprise risk management, and fraud deterrence designed to improve organizational performance and oversight and to reduce the extent of fraud in organizations.

COSO is a private sector initiative, jointly sponsored and funded by:�• American Accounting Association (AAA)�• American Institute of Certified Public Accountants (AICPA)�• Financial Executives International (FEI)�• Institute of Management Accountants (IMA)�• The Institute of Internal Auditors (IIA)

There are other internal control frameworks but not commonly used as COSO ( i.e. CoCo “ the Criteria of Control” consists of 20 criteria grouped into 4 components: Purpose, Commitment, Capability, and Monitoring & Learning.

Also COBIT “Control Objectives for Information and Related Technology “ is used for governance of enterprise IT implementations.

Introduction to COSO 2013 Internal Control Framework

5

Definition of Internal Control Over Financial Reporting

COSO defines Internal control as:

​

​

​

​

​

Thus, internal control is

a) Intended to achieve three classes of objectives

b) An ongoing process

c) Effected by people at all organizational levels, e.g., the board, � management, and all other employees

d) Able to provide reasonable, but not absolute, assurance

e) Adaptable to Bank’s structure

Internal control is a process, effected by Bank’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance

6

Categories of Objectives

• Relate to the effectiveness and efficiency of the entity’s operations, including:
• Operational and financial performance goals
• Safeguarding of assets against loss

• Relate to internal and external, and financial and non-financial reporting, including:
• Reliability, timeliness, transparency, or other terms as set forth by regulators, standard setters, or the entity’s policies

• Relate to adherence to laws and regulations and standards �to which the entity is subject

Operations

Reporting

Compliance

Objectives

2013 COSO Framework

7

COSO Components and Principles

For effective internal control:

• Each of the five components and 17 relevant principles must be present and functioning
• Points of focus are characteristics supporting achievement of control objectives
• The five components must operate together in an integrated manner.

1. Demonstrates commitment to integrity and ethical values
2. Exercises oversight responsibility
3. Establishes structure, authority, and responsibility
4. Demonstrates commitment to competence
5. Enforces accountability

Control Environment

6. Specifies suitable objectives
7. Identifies and analyzes risk
8. Assesses fraud risk
9. Identifies and analyzes significant change

Risk Assessment

10. Selects and develops control activities
11. Selects and develops general controls over technology
12. Deploys through policies and procedures

Control Activities

13. Uses relevant information
14. Communicates internally
15. Communicates externally

Information and Communication

Monitoring Activities

16. Conducts ongoing and/or separate evaluations
17. Evaluates and communicates deficiencies

8

COSO Internal Control Framework 2013 vs COSO ERM 2017

9

SEC’s Definition of Internal Control Over Financial Reporting

Regulation 13(a)-15(f) defines Internal control over financial reporting as:

“A process . . . to provide reasonable assurance regarding �the reliability of financial reporting and the preparation �of financial statements for external purposes in �accordance with generally accepted �accounting principles . . .”

Includes policies and procedures that:

• Maintain records in reasonable detail that accurately �and fairly reflect the transactions and dispositions �of the assets of the issuer [accurate books and records]
• Ensure receipts and expenditures of the issuer are made only in accordance with authorizations of management and directors [authorized cash receipts and expenditures]
• Provide reasonable assurance regarding prevention or timely detection of the unauthorized acquisition, use, or disposition of the issuer's assets that could have a material effect on the financial statements [safeguarding of assets]

10

Interaction among COSO Components

Controls related to the COSO components can be found at the entity and process level

​

​

Entity Level Controls (ELCs)

Higher Level Controls (HLCs)

Process Level Controls (PLCs)

GITCs

11

Continual and Iterative Re-Assessment of ELCs

1. Evaluate the design and operating effectiveness of ELCs related to:

• Control Environment
• Risk Assessment
• Information & Communication
• Monitoring

​

4. Revise ELC effectiveness conclusions if root cause of HLC, PLC, or GITC deficiency results in a deficient ELC

5. Consider the impact of deficiencies on the nature, timing, and extent of audit approach

Evaluate�the results�and reassess

2. Consider the impact of ELCs on the audit approach (testing of other ELCs, HLCs, PLCs, GITCs, and substantive procedures)

ELCs

ELCs

ELCs

We continually re-assess conclusions on the design and effectiveness of ELCs

based on evidence obtained throughout the audit

Evaluate

the results

and reassess

ICOFR Audit

3. Document any ELC deficiencies in SICD

12

Impact of Entity Level Controls

• Test ELCs early in the audit
• Determine the impact of ELCs on the nature, timing and extent of our control and substantive test work

Effective

ELCs

Less Effective ELCs

ICOFR Audit

13

Control Environment�

14

Control Environment

© All rights reserved to the Open Compliance and Ethics Group (OCEG).

15

Control Environment

© All rights reserved to the Open Compliance and Ethics Group (OCEG).

16

Control Environment

The control environment is the foundation on which an effective system of internal control is built and

operated in an organization that strives to:

CARES

© All rights reserved to the Institute of Internal Auditors (IIA).

17

C

Control Environment

• Compliance with laws, regulations, policy, and procedures;

18

Control Environment

A

• Accomplishment of goals and objectives;

19

R

Control Environment

• Reliability of all information;

20

E

Control Environment

• Efficient and effective use of resources

21

S

Control Environment

• Safeguarding of assets.

22

Control Environment

CARES

• Compliance with laws, regulations, policy, and procedures;
• Accomplishment of goals and objectives;
• Reliability of all information;
• Efficient and effective use of resources; and
• Safeguarding of assets.

23

Control Environment

The control environment is the foundation on which an effective system

of internal control is built and operated in an organization that strives to:

© All rights reserved to the Institute of Internal Auditors (IIA).

CARES

• Compliance with laws, regulations, policy, and procedures;
• Accomplishment of goals and objectives;
• Reliability of all information;
• Efficient and effective use of resources; and

• Safeguarding of assets.

24

Control Environment

25

Control Environment

Control Environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The Board of Directors and senior management establish the tone at the top regarding the importance of internal control, including expected standards of conduct. Management reinforces expectations at the various levels of the organization. The control environment comprises the integrity and ethical values of the organization; the parameters enabling the board of directors to carry out its governance oversight responsibilities; the organizational structure and assignment of authority and responsibility; the process for attracting, developing, and retaining competent individuals; and the rigor around performance measures, incentives, and rewards to drive accountability for performance. The resulting control environment has a pervasive impact on the overall system of internal control.

Control Environment – 2013 Framework Changes

• Captures seven (7) factors in 1992 Framework into five (5) principles
• Explains that Control Environment is the foundation for a sound system of internal control
• Addresses changes in business models – the globalization of the business and its operations
• Expands and clarifies guidance on:
• Governance roles in an organization, recognizing differences in structures, types of entities, etc.
• The need to consider internal control across the expanded organization, including outsourced service providers and other external partners
• Expectations of competence and accountability with respect to internal control

26

Control Environment: Principle #1 and Points of Focus

Points of Focus

• Sets the Tone at the Top
• Board of Directors (the Board) and management at all levels demonstrate through directives, actions, and behavior the importance of integrity and ethical values to support a functioning system of internal control
• Establishes Standards of Conduct
• The expectations of the Board and senior management concerning integrity and ethical values are defined in Standards of Conduct and understood throughout the organization and by outsourced service providers and business partners
• Evaluates adherence to Standards of Conduct
• Processes are in place to evaluate the performance of individuals and teams against the Standards of Conduct
• Addresses deviations in a timely manner
• Deviations from the Standards of Conduct are identified and remedied in a timely, consistent manner

1. The organization demonstrates a commitment to integrity and ethical values.

27

Principle #1: Internal Control at All Levels of the Entity

Tone at the Top and throughout the organization is key to an effective system of internal control

Effective Internal Control

Tone at the Top

28

Principle #1: Tone at the Top – Demonstrating Compliance

Mission and value statements by management and the board of directors

Published standards or codes of conduct

Written policies and procedures

Communications, including those routine and informal ones, made by leaders at all levels of the entity

Evidence of actions taken and decisions made by management and the board of directors, including in response to violations of the standards of conduct

Setting the Tone

​

Determine whether any of the various forms of audit evidence are conflicting

ICOFR Audit

29

Control Environment: Principle #2 and Points of Focus

2. The Board of Directors demonstrates independence from management and exercises oversight of the development and performance of internal control.

Points of Focus

• Establishes oversight responsibilities
• The Board identifies and accepts its oversight responsibilities in relation to the established requirements and expectations
• Applies relevant expertise
• The Board defines, maintains, and periodically evaluates the skills and expertise needed to enable them to ask probing questions of senior management and take commensurate actions
• Operates independently
• The Board has sufficient independent members and is objective in evaluations and decision making
• Provides oversight for the system of internal control
• The Board retains oversight responsibilities for management’s design, implementation, and conduct of internal control

30

Principle #2: Board Oversight (Continued)

Establishing integrity and ethical values, oversight structures, authority and responsibility, expectations of competence, and accountability to the Board

Control Environment

Overseeing management’s assessment of risks to the achievement of objectives, including the potential impact of significant changes, fraud, and management override of internal control

Risk Assessment

Providing oversight to senior management in the development and performance of control activities

Control Activities

Analyzing and discussing information relating to the entity’s achievement of objectives

Information and Communication

Monitoring Activities

Assessing and overseeing the nature and scope of monitoring activities and management’s evaluation and remediation of deficiencies

ICOFR Audit

Look for audit evidence of Board oversight activities (see pages 42 & 43 of the Framework)

• detailed meeting agendas
• comprehensive minutes of the Board meetings
• inquiries of Board members

31

Control Environment: Principle #3 and Points of Focus

3. Management establishes, with Board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.

Points of Focus

• Considers all structures of the entity
• Management and the Board consider multiple structures (including operating units, legal entities, geographic distribution, and outsourced service providers) to support the achievement of objectives
• Establishes reporting lines
• Management designs and evaluates lines of reporting for each entity structure to enable execution of authorities and responsibilities, and the flow of information to manage the activities of the entity
• Defines, assigns, and limits authorities and responsibilities
• Management and the Board delegate authority, define responsibilities, and use appropriate processes and technology to assign responsibility and segregate duties at various levels of the organization (e.g., the Board; senior executives; management; personnel; outsourced service providers)

32

Principle #3: Lines of Reporting, Authority, and Responsibility

• Segregation of duties should be considered at all levels of the organization
• Reporting lines and communication channels must be clear to enable accountability over operating units and functional areas
• The Board should oversee the assignment and limitation of the authorities and responsibilities of senior management
• Assessment needs to extend beyond verifying existence of organization charts

ICOFR Audit

33

Control Environment: Principle #4 and Points of Focus

4. The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

Points of Focus

• Establishes policies and practices
• Policies and practices reflect expectations of competence necessary to support the objectives
• Evaluates competence and addresses shortcomings
• The Board and management evaluate competence across the organization and at outsourced service providers in relation to established policies and practices and act as necessary to address shortcomings
• Attracts, develops, and retains individuals
• The organization mentors and trains to attract, develop, and retain sufficient and competent personnel and outsourced service providers to support the achievement of objectives
• Plans and prepares for succession
• Senior management and the Board develop contingency plans for assignment of responsibility important for internal control

34

Principle #4: Competence and Effective Controls

• Subject-matter experts
• Relevant experience
• Proper succession planning

• GAAP
• SEC rules and regulations
• Tax laws
• Others laws and regulations

• At all levels
• At third-party service providers

​

Principle # 4

Principle # 10

• Board of Directors’ assessment of competence requirements for senior management
• Job descriptions developed for employees

Needs Assessment

Right people

Appropriate skills and knowledge

In the right place

Effective Control Activities

​

• Understand whether management’s hiring policies and practices support commitment to competence
• Assess whether management supplements knowledge gaps with external experts and service providers as necessary

ICOFR Audit

35

Control Environment: Principle #5 and Points of Focus

5. The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

Points of Focus

• Enforces accountability through structures, authorities, and responsibilities
• Establishes the mechanisms to communicate and holds individuals accountable for internal control responsibilities across the organization and implements corrective action
• Establishes performance measures, incentives, and rewards
• . . . . appropriate for responsibilities at all levels of the entity, reflecting performance and Standards of Conduct, considering achievement of ST and LT objectives
• Evaluates performance measures, incentives, and rewards for ongoing performance
• Aligns incentives and rewards with the fulfillment of internal control responsibilities in the achievement of objectives
• Considers excessive pressures
• Evaluates and adjusts pressures associated with the achievement of objectives as they assign responsibilities, develop performance measures, and evaluate performance
• Evaluates performance and rewards or disciplines individuals
• Evaluates performance of internal control responsibilities, including adherence to Standard of Conduct and expected competence; provides rewards or disciplinary action as appropriate

36

Principle #5: Accountability, Incentives, Pressures

​

​

​

​

​

​

​

​

• How does the organization encourage effective execution of ICOFR responsibilities by employees?
• How does the incentive compensation program consider employees’ responsibilities for internal control?
• Does the organization’s incentive program consider a mix of financial and non-financial measures such as an employee’s compliance with his or her ICOFR responsibilities?
• Does the incentive program include a balance of short-term and long-term objectives?
• Does the incentive program consider excessive pressure and how it might drive fraudulent behavior?

Too much pressure can cause people to circumvent processes and override controls or to engage in fraudulent activity

Lack of pressure may lead to underperformance

ICOFR Audit

37

Risk Assessment

38

Risk Assessment

Risk assessment involves a dynamic and iterative process for identifying and assessing risks to the achievement of objectives. Thus, risk assessment forms the basis for determining how risks will be managed.

Management specifies objectives relating to operations, reporting, and compliance with sufficient clarity to be able to identify and analyze risks to those objectives. Risk assessment requires management to consider the impact of possible changes in the external environment and within its own business model that may render internal control ineffective.

Risk Assessment – 2013 Framework changes

• Recognizes that many organizations take a risk-based approach to internal control
• Introduces the concept of “risk tolerance” (acceptable risk levels)
• Clarifies that risk assessment includes processes for risk identification, risk analysis, and risk response
• Expands the discussion on:
• Assessment of significance of risks
• The need to understand significant changes in internal and external factors and the impact of these changes on the system of internal control
• Includes specific assessment of fraud risk relating to material misstatement of reporting, inadequate safeguarding of assets, and corruption as part of the risk assessment process

39

Risk Assessment: Principle #6 and Points of Focus

6. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

Points of Focus

• Separately set out points of focus related to Operations; External Financial Reporting; External Non-Financial Reporting; Internal Reporting; Compliance objectives

External Financial Reporting Objectives

• Complies with applicable accounting standards
• Financial reporting objectives are consistent with accounting principles suitable and available for the entity
• Accounting principles selected are appropriate in the circumstances
• Considers Materiality
• Management considers materiality in financial statement presentation
• Reflects entity activities
• External reporting reflects the underlying transactions and events to show qualitative characteristics and assertions

40

Principle #6: Objectives and Sub-Objectives of ICOFR

Financial Statement Assertions: CEAVOP

Ensure that management has considered all objectives related to Operations, Reporting, and Compliance with Laws and Regulations, which may affect the financial statements

CBE Objective: Reliable Financial Statements

• Consider appropriate GAAP at each reporting date
• Financial reporting objectives should be responsive to changes in entity’s activities

ICOFR Audit

41

Principle #6: Materiality and Risk Tolerance

Risk Tolerance

Management should establish Risk Tolerance as precondition for determining Risk Response and design of Control Activities

Materiality

​

• Obtain evidence of management’s materiality assessment
• Consider the appropriateness of established materiality
• Materiality should consider both qualitative and quantitative factors

ICOFR Audit

42

Risk Assessment: Principle #7 and Points of Focus

7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

Points of Focus

• Includes entity, subsidiary, division, operating unit, and functional levels
• The organization identifies and assesses risks at the entity, subsidiary, division, operating unit, and functional levels relevant to the achievement of objectives
• Analyzes internal and external factors
• Risk identification considers both internal and external factors and their impact on the achievement of objectives
• Involves appropriate levels of management
• The organization puts into place effective risk assessment mechanisms that involve appropriate levels of management
• Estimates significance of risks identified
• Identified risks are analyzed through a process that includes estimating the potential significance of the risk
• Determines how to respond to risks
• Risk assessment includes considering how the risk should be managed and whether to accept, avoid, reduce, or share the risk

43

Principle #7: Risk Assessment Process

Risk identification, analysis & response

Control Activities

Comprehensive risk assessment is critical to the identification

and appropriate design of relevant control activities

WCGWs

44

Principle #7: Evidence of Compliance

Organizations should demonstrate that their risk assessment process:

• Has been conducted at the entity level and throughout the organization on an at least annual basis
• Has involved appropriate levels of management
• Has considered all risks related to the business operations, financial reporting, and compliance with laws and regulations that may materially affect the financial statements
• Has considered changes in external and internal factors impacting the entity
• Has linked the identified risks to relevant assertions over significant accounts (risk – control matrices may be used).

We should understand management’s risk assessment process, test relevant controls within the process, and consider the appropriateness of the identified risks

ICOFR Audit

45

Principle #7: Significance of Risk and Risk Response

Risk Tolerance

Risk Response (Control Activities)

Persistence/duration

Possibility that a risk will materialize

Likelihood

The effect of a risk

Impact

Impact

Likelihood

46

Risk Assessment: Principle #8 and Points of Focus

8. The organization considers the potential for fraud in assessing risks to the achievement of objectives.

Points of Focus

• Considers various types of fraud
• The assessment of fraud considers fraudulent reporting, possible loss of assets, and corruption [and management override of controls] resulting from the various ways that fraud and misconduct can occur
• Assesses incentives and pressures
• The assessment of fraud risk considers incentives and pressures
• Assesses opportunities
• The assessment of fraud risk considers opportunities for unauthorized acquisition, use, or disposal of assets, altering of the entity’s reporting records, or committing other inappropriate acts
• Assesses attitudes and rationalizations
• The assessment of fraud risk considers how management and other personnel might engage in or justify inappropriate actions

47

Principle #8: The Fraud Risk Triangle

Incentives

and Pressures

Types of fraud:

• Fraudulent financial reporting
• Misappropriation of assets
• Corruption and other illegal acts
• Management override of controls

​

Attitudes and Rationalizations

(for justifying inappropriate actions)

Opportunities

(for committing inappropriate acts)

Effective ICOFR would prevent or detect a misstatement in the financial statements due to error or fraud in a timely manner

48

Principle #8: Demonstrating Compliance

Management should link fraud risks to relevant financial statement assertions

Transaction-level Fraud Risk Assessment

Example # 1: Annual entity-wide fraud risk assessment by Chief Compliance Officer working with Business Unit Leaders; report submitted to Audit Committee for review and oversight.

Example # 2: Quarterly assessment of the risk of management override of controls performed by Internal Audit and reported to Audit Committee for review and oversight.

Example # 3: Division Controllers work with Business Unit Leaders to identify and assess potential fraud risks; fraud risks reviewed by Internal Audit, and report submitted to Audit Committee.

Entity-level Fraud Risk Assessment

Consider the interaction between fraud risk assessment and other components of internal control

ICOFR Audit

49

Risk Assessment: Principle #9 and Points of Focus

9. The organization identifies and assesses changes that could significantly impact the system of internal control.

Points of Focus

• Assesses changes in the external environment
• The risk identification process considers changes in the regulatory, economic, and physical environment in which the entity operates
• Assesses changes in the business model
• The organization considers the potential impact on the system of internal control of new business lines, dramatically altered compositions of existing lines, acquired or divested business operations, rapid growth, changing reliance on foreign geographies, and new technologies
• Assesses changes in leadership
• The organization considers changes in the management and respective attitudes and philosophies on the system of internal control

50

Principle #9: Assessing Impact of Internal and External Changes

• New executive leadership
• Turnover in key financial reporting positions

​

• New environmental laws
• New stock exchange regulations

​

• Business combinations
• Restructuring

​

• New product or service lines
• Geographical expansion

​

Identify and test controls that support the entity’s “Early Warning Systems”

Principle #9 requires proactive, not reactive, approach to changes

ICOFR Audit

51

Control Activities

52

Control Activities

Control activities are the actions established through policies and procedures to mitigate risks to the achievement of objectives. Control activities are performed at all levels of the entity, at various stages within business processes, and over the technology environment. They may be preventive or detective in nature and may encompass a range of manual and automated activities such as authorizations and approvals, verifications, reconciliations, and business performance reviews.

Segregation of duties is typically built into the selection and development of control activities. Where segregation of duties is not practical, management selects and develops alternative control activities.

Control Activities – 2013 Framework changes

• Updated for the evolution in technology since 1992 (e.g., replacing data center concepts with a more general discussion on the technology infrastructure)
• Addresses the linkage between business processes, automated control activities, and GITCs
• Contrasts process-level controls from controls at other levels of the organization
• Updated for GITC applicability (IT infrastructure; security management; technology acquisition, development, and maintenance) across all technology platforms
• Clarifies that control activities are actions established by policies and procedures rather than being the policies and procedures themselves

53

Control Activities: Principle #10 and Points of Focus

Points of Focus

• Integrates with Risk Assessment
• Control activities help ensure that the organization’s responses to risks are addressed and risks are mitigated
• Considers entity-specific factors
• Management considers how the environment, complexity, nature, and scope of its operations affect the selection and development of control activities
• Determines relevant business processes
• Management determines which relevant business processes require control activities
• Evaluates a mix of control types
• Control activities include a range and variety of controls; considering both manual and automated controls, and preventive and detective controls
• Considers at what level controls are applied
• Management considers control activities at various levels of the organization
• Addresses segregation of duties
• Management segregates incompatible duties and where not practical, selects and develops alternative control activities

10. The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

54

Principle #10: Understanding the Process and Identifying What Could Go Wrong (WCGW)

Understand how transactions are initiated, authorized, processed, and recorded, including:

• How data enters the IT system
• How data is stored within the IT system, and how it may be accessed
• When data is summarized, accumulated, or calculated
• What manual processes affect the data

​

Every time the data moves, there may be a risk (WCGW) related to the CEA of data

ICOFR Audit

55

Control Activities: Principle #11 and Points of Focus

11. The organization selects and develops general control activities over technology to support the achievement of objectives.

Points of Focus

• Determines dependency between the use of technology in business processes and GITCs
• Management understands and determines dependency and linkage between business processes, automated control activities, and GITCs
• Establishes relevant Technology Infrastructure Control Activities
• . . . which are designed and implemented to help the completeness, accuracy, and availability of technology processing
• Establishes relevant Security Management Process Control Activities
• . . . which are designed and implemented to restrict technology access rights to authorized users commensurate with their job responsibilities and to protect the entity’s assets from external threats
• Establishes relevant Technology Acquisition, Development, and Maintenance Process Control Activities
• Management selects and develops control activities over the acquisition, development, and maintenance of technology and its infrastructure to achieve objectives

56

Principle #11 – General IT Controls (GITCs)

Program Maintenance Control Activities

• Program Change Controls

Program Acquisition and Development Control Activities

• Program Development Controls

Technology Infrastructure Control Activities

• Computer Operations Controls

Security Management Process Control Activities

• Access to Programs & Data Controls

Link supporting GITCs to automated controls

ICOFR Audit

57

Principle #11: Dependency and Linkage among Processes and Controls - System Overview Diagram

Financial Statements

​

Treasury

ECL Calculation

Operating Expenses

Applications

Databases

Operating Systems

ICOFR Audit

58

Control Activities: Principle #12 and Points of Focus

12. The organization deploys control activities through policies that establish what is expected and in procedures that put policies into action.

Points of Focus

• Establishes policies and procedures to support deployment of management’s directives
• Controls are built into business processes through specific policies and procedures
• Establishes responsibility and accountability for executing policies and procedures
• Management assigns responsibility and accountability for the controls in the business unit or function where the risk resides
• Performs in a timely manner
• Responsible personnel perform controls in a timely manner
• Takes corrective action
• Responsible personnel investigate and act on matters identified as a result of executing the control
• Performs using competent personnel
• Competent personnel with sufficient authority perform controls with diligence and continuing focus
• Reassesses policies and procedures
• Management periodically reviews controls to determine their continued relevance and refreshes them when necessary

59

Principle #12: Policies and Procedures to Deploy Control Activities

Policies and Procedures:

• Assign responsibility and accountability to competent personnel
• Establish the frequency and timing for individual controls
• Support investigation and corrective actions by the responsible parties
• Provide knowledge and tools to implement control activities
• Should be reviewed and updated periodically for continued relevance

ICOFR Audit

60

Control Activities: Management Review Controls in a Business Process

Management review controls

• Rarely address all risks (WCGWs) within a process
• Should supplement (not substitute) other process-level controls

Other controls need to be identified to address remaining WCGWs, including controls over the completeness and accuracy of each data element used in the execution of the MRC

Understand the business process and identify financial reporting risks (WCGWs)

ICOFR Audit

61

Control Activities: Understanding the Design of an MRC

• What risk does the control address? What is its objective?
• How is the control performed?
• What information is used in the performance of the control?

10. Selects and Develops Control Activities

Considers Entity-Specific Factors

• What metrics or criteria are used in execution of the control?
• What is the risk tolerance? What would constitute an outlier?
• How are outliers followed up on and resolved?

10. Selects and Develops Control Activities

Integrates with Risk Assessment

• Does the control operator have the skills and knowledge

necessary to effectively execute the control?

• Is there a need for any specialized knowledge?

4. Demonstrates Commitment to Competence

Evaluates Competence

• Is the control designed to consider relevant external and

internal factors which may impact its design and operation?

• Is there a separate control to consider such factors?

7. Identifies and Analyzes Risk

Analyzes Internal and External Factors

• Is there an appropriate segregation of duties related to the

control?

• Does the control address potential management bias?

8. Assesses Fraud Risk

Consider Various Types of Fraud

Is there sufficient and appropriate evidence of the operation of the control, including consistent application of the metrics, thresholds or other criteria?

Overarching Consideration:

ICOFR Audit

62

Information & Communication

63

Information & Communication

Information is necessary for the entity to carry out internal control responsibilities to support the achievement of its objectives. Management obtains or generates and uses relevant and quality information from both internal and external sources to support the functioning of other components of internal control. Communication is the continual, iterative process of providing, sharing, and obtaining necessary information. Internal communication is the means by which information is disseminated throughout the organization, flowing up, down, and across the entity. It enables personnel to receive a clear message from senior management that control responsibilities must be taken seriously. External communication is twofold: it enables inbound communication of relevant external information, and it provides information to external parties in response to requirements and expectations.

Information & Communication – 2013 Framework Changes

• Emphasizes importance of quality of information
• Including how the entity manages information from and communicates with third-party service providers and those that operate outside its legal and operational boundaries
• Expands the discussion on
• The impact of regulatory requirements on reliability and protection of information
• The volume and sources of information in light of increased complexity of business processes, greater interaction with external parties, and technology advances
• Reflects the impact of technology and other communication mechanisms on the speed, means, and quality of the flow of information

64

Information & Communication: Principle #13 and Points of Focus

13. The organization obtains or generates and uses relevant, quality information to support the functioning of other components of internal control.

Points of Focus

• Identifies information requirements
• A process is in place to identify the information required and expected to support the functioning of the other components and achievement of the entity’s objectives
• Captures internal and external sources of data
• Information systems capture internal and external sources of data
• Processes relevant data into information
• Information systems process and transform relevant data into information
• Maintains quality throughout processing
• Information systems produce information that is timely, current, accurate, complete, accessible, protected, verifiable, and retained. Information is reviewed to assess its relevance in supporting the components
• Considers costs and benefits
• The nature, quantity, and precision of information communicated are commensurate with and support the achievement of objectives

65

Principle #13: Relevant Information to the Right Person at the Right Time

Control Activity: Review of Tax Provision by Tax Director

New related party�supplier in India

Employees working�out-of-state

New tax laws in�Japan

New business in�Canada

Example approaches for indentifying information needs:

​

• Meetings between accounting personnel and management personnel in other areas of business
• Interviews of operational and other management by the Corporate Controller
• Information repositories updated by process owners
• Cross-functional internal control committee

Entity Level

66

Information & Communication: Principle #14 and Points of Focus

14. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of other components of internal control.

Points of Focus

• Communicates internal control information
• A process is in place to communicate required information to enable all personnel to understand and carry out their internal control responsibilities
• Communicates with the Board of Directors
• Communication exists between management and BoD so that both have information needed to fulfill their roles
• Provides separate communication lines
• Separate communication channels, such as whistle blower hotlines, are in place and serve as �fail-safe mechanisms to enable anonymous or confidential communication
• Selects relevant method of communication
• The method of communication considers the timing, audience, and nature of the information

67

Principle #14: Relevant Method of Communication to Support Internal Control

Also consider whistle blower hotlines

The selection of the method of communication should consider the timing, audience and nature of the information

68

Information & Communication: Principle #15 and Points of Focus

15. The organization communicates with external parties regarding matters affecting the functioning of other components of internal control.

Points of Focus

• Communicates to external parties
• Processes are in place to communicate relevant and timely information to shareholders, partners, regulators, customers, financial analysts, and other parties
• Enables inbound communications
• Open communication channels allow management and BoD to receive relevant input from customers, consumers, suppliers, external auditors, regulators, financial analysts, and others
• Communicates with the Board of Directors
• Relevant information from assessments conducted by external parties is communicated to the BoD
• Provides separate communication lines
• Separate communication channels, such as whistle blower hotlines, are in place and serve as �fail-safe mechanisms to enable anonymous or confidential communication
• Selects relevant method of communication
• The method of communication considers the timing, audience and nature of the communication and legal, regulatory, and fiduciary requirements, and expectations

69

Principle #15: External Communications

Reporting Entity

Stock Exchange

Banks/Lenders

70

Monitoring Activities�

71

Monitoring Activities

Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning.

Ongoing evaluations, built into business processes at different levels of the entity, provide timely information. Separate evaluations, conducted periodically, will vary in scope and frequency depending on assessment of risks, effectiveness of ongoing evaluations, and other management considerations.

Findings are evaluated against criteria established by regulators, recognized standard-setting bodies, or management and the board of directors, and deficiencies are communicated to management and the board of directors as appropriate.

Monitoring Activities – 2013 Framework changes

• Refines the terminology, where the two main categories of monitoring activities are now referred to as ongoing evaluations and separate evaluations
• Added the need for a baseline understanding in establishing and evaluating ongoing and separate evaluations
• Expanded discussion of the use of technology and external service providers

72

Distinction between Monitoring Activities and MRC Control Activities

Monitoring Activities are NOT a substitute for Control Activities

BOTH are important

ICOFR Audit

73

Monitoring Activities: Principle #16 and Points of Focus

Points of Focus

• Considers a mix of ongoing and separate evaluations
• Considers rate of change
• Management considers the rate of change in business and business processes when selecting and developing ongoing and separate evaluations
• Establishes baseline understanding
• The design and current state of an internal control system are used to establish a baseline for ongoing and separate evaluations
• Uses knowledgeable personnel
• Evaluators performing ongoing and separate evaluations have sufficient knowledge to understand what is being evaluated
• Integrates with business processes
• Ongoing evaluations are built into the business process and adjust to changing conditions
• Adjusts scope and frequency
• Management varies the scope and frequency of separate evaluations depending on risk
• Objectively evaluates
• Separate evaluations are performed periodically to provide objective feedback

16. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

74

Principle #16: Ongoing and Separate Evaluations

75

Principle #16: Audit Considerations

ICOFR Audit

76

Monitoring Activities: Principle #17 and Points of Focus

17. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

Points of Focus

• Assesses results
• Management and the BoD assess the results of ongoing and separate evaluations
• Communicates deficiencies
• Deficiencies are communicated to the parties responsible for taking corrective action and to senior management and BoDs, as appropriate
• Monitors corrective actions
• Management tracks whether deficiencies are remediated on a timely basis

77

Evaluation of Control Deficiencies

Six Steps in Evaluating Control Deficiencies

​

​

​

​

​

• The error is NOT the deficiency – describe the control deficiency that failed to detect or prevent the error
• Root cause analysis is critical to properly evaluating the deficiency
• Determining the severity of a deficiency is a forward-looking evaluation as it deals with potential magnitude

​

1. Determine whether a control deficiency exists

2. Identify and describe the control deficiency

3. Determine whether the control deficiency is indicative of other deficiencies

4. Evaluate the severity of the deficiency by considering magnitude and likelihood of the potential misstatement

5. Identify relevant compensating controls and conclude on the severity

6. Aggregate similar deficiencies and evaluate the aggregated deficiencies for severity

​

​

• There should be a process in place for communication of deficiencies to appropriate individuals
• Entities should have mechanisms in place to follow-up and remediate deficiencies

​

ICOFR Audit

78

COSO 2013 – Case Study

Internal Controls Over

Financial Reporting (ICOFR)

79

Case Study 1- ELC

80

ELC – contd.

81

ELC – contd.

82

ELC – contd.

83

Case Study 1- PLC

Identification of significant accounts

74% of total expenses

Accounts affecting payroll

84

PLC– contd.

Processes Impacting Payroll accounting

Employee Master Register

• Entry in Payroll master after completion of Probation Period.
• Other Benefits to employee as per eligibility

Appointment letter

• Process of recruitment
• Issue of appointment letter
• Maker-Checker

methodology

Resignation of employee

• Process of relieving employee
• Serving of notice period
• Settlement of account

Statutory Deduction

• Checking of Process of Calculation of Tax of employee after considering Investment declaration/ Proofs.
• Deduction of PT, PF, ESIC etc.

Increment/ Bonus

• Process of Increments i.e. performance appraisal, Self appraisal.

85

PLC– contd.

86

PLC– contd.

87

PLC– contd.

88

PLC– contd.

89

What Questions Do You Have?

90