Lecture 20 - Risk Assessment and Internal Control PDF

Lecture – 20
Chapter – 3
“Risk Assessment and Internal Control”
(iv) Frameworks of Internal Control:
(i) COSO Framework:
- COSO (Committee of Sponsoring Organizations of the Treadway Commission)
Framework is designed to be used by organizations to assess effectiveness
of the system of internal control to achieve objectives as determined by
management.
- The Framework lists 3 categories of objectives as below:
(i) Operation Objectives:
Operation objectives are related to
- the effectiveness and efficiency of the entity’s operations,
- including operational and financial performance goals, and
- safeguarding of assets.
(ii) Reporting Objectives:
Reporting objectives are related to
- internal and external financial and non-financial reporting to
stakeholders, which would encompass
- reliability, timeliness, transparency, or other terms as
established by regulators, standard setters, or the entity’s
policies.
(iii) Compliance objectives:
Compliance objective are related to the entity’s compliance with
applicable laws and regulations.
20.1
Risk Assessment and Internal Control Chapter 3
(ii) CoCo (Criteria of Control):
- The CoCo framework was first published by the Canadian Institute of
Chartered Accountants in 1995. This model builds on COSO and is thought by
some to be more concrete and user-friendly.
- CoCo describes internal control as actions that foster the best result for an
organization. These actions, which contribute to the achievement of the
organization’s objectives, focus on:
(a) effectiveness and efficiency of operations;
(b) reliability of internal and external reporting;
(c) compliance with applicable laws and regulations and internal policies.
- CoCo indicates that control comprises those elements of an organization
(including its resources, systems, processes, culture, structure, and tasks)
that, taken together, support people in the achievement of the organization’s
objectives.”
- The CoCo framework outlines criteria for effective control in the following
four areas:
(a) Purpose
(b) Commitment
(c) Capability
(d) Monitoring and Learning
In order to assess whether controls exist and are operating effectively, each
criterion would be examined to identify the controls that are in place to
address them.
(iii) COBIT (Control Objectives for Information and Related Technology):
(a) COBIT framework is created by the ISACA (Information Systems Audit and
Control Association) for IT governance and management.
It is meant to be a supportive tool for managers and allows bridging the
crucial gap between technical issues, business risks and control requirements.
(b) Business managers are equipped with a model to deliver value to the
organization and practice better risk management practices associated with
the IT processes.
20.2
Chapter 3 Risk Assessment and Internal Control
(c) It is a control model that guarantees the integrity of the information
system. Today, COBIT is used globally by all managers who are responsible
for the IT business processes. It is a thoroughly recognized guideline that
can be applied to any organization across industries.
(d) Overall, COBIT ensures quality, control and reliability of information systems
in organization, which is also the most important aspect of every modern
business.
(iv) SOX (Sarbanes Oxley Act) - Section 404):
- SOX Section 404 mandates that all publicly-traded companies must establish
internal controls and procedures for financial reporting and must document,
test and maintain those controls and procedures to ensure their
effectiveness.
- The purpose of SOX is to reduce the possibilities of corporate fraud by
increasing the stringency of procedures and requirements for financial
reporting.
- The SEC rules and PCAOB standard require that:
(a) Management perform a formal assessment of its controls over
financial reporting including tests that confirm the design and
operating effectiveness of the controls.
(b) Management include in its annual report an assessment of Internal
Controls over Financial Reporting.
- The external auditors provide two opinions as part of a single integrated
audit of the company:
(a) An independent opinion on the effectiveness of the system of Internal
Controls over Financial Reporting.
(b) The traditional opinion on the financial statements.
20.3
Risk Assessment and Internal Control Chapter 3
(v) INTERNAL CHECK:
(a) Meaning:
Checks on day to day transactions, which operate continuously as a part of routine
system, whereby work of one person is proved independently to work of another, the
object being prevention and earlier detection of error or fraud.
(b) Objectives:
(i) To detect fraud and error with ease.
(ii) Avoid & minimize possibility of occurrence of fraud & error.
(iii) Increase efficiency of staff.
(iv) Protect integrity of business.
(v) Prevent misappropriation of cash & falsification of accounts.
(c) Considerations:
(a) No single person should have an Independent Control.
(b) Duties of staff members should be changed from time to time.
(c) Every member should be encouraged to go on leave atleast once.
(d) Persons having physical custody of assets must not be allowed access to books
of accounts.
(e) Implement Budgetary control procedures.
(f) Judicious distribution of financial and administrative powers.
(g) Procedures should be laid down for physical verification.
(h) Accounting procedures should be reviewed periodically.
DO Practice – Questions on Audit Risk, Internal Control and Internal Check
20.4

Lecture 20 - Risk Assessment and Internal Control PDF

Uploaded by

Copyright:

Available Formats

Lecture 20 - Risk Assessment and Internal Control PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lecture 20 - Risk Assessment and Internal Control PDF

Uploaded by

Copyright:

Available Formats

Lecture – 20

(i) COSO Framework:

- COSO (Committee of Sponsoring Organizations of the Treadway Commission)

Framework is designed to be used by organizations to assess effectiveness

of the system of internal control to achieve objectives as determined by

- The Framework lists 3 categories of objectives as below:

(i) Operation Objectives:

Operation objectives are related to

- the effectiveness and efficiency of the entity’s operations,

- including operational and financial performance goals, and

(ii) Reporting Objectives:

Reporting objectives are related to

- internal and external financial and non-financial reporting to

stakeholders, which would encompass

- reliability, timeliness, transparency, or other terms as

established by regulators, standard setters, or the entity’s

(iii) Compliance objectives:

Compliance objective are related to the entity’s compliance with

applicable laws and regulations.

- The CoCo framework was first published by the Canadian Institute of

Chartered Accountants in 1995. This model builds on COSO and is thought by

some to be more concrete and user-friendly.

organization. These actions, which contribute to the achievement of the

organization’s objectives, focus on:

(a) effectiveness and efficiency of operations;

(b) reliability of internal and external reporting;

- CoCo indicates that control comprises those elements of an organization

(including its resources, systems, processes, culture, structure, and tasks)

that, taken together, support people in the achievement of the organization’s

(d) Monitoring and Learning

criterion would be examined to identify the controls that are in place to

(iii) COBIT (Control Objectives for Information and Related Technology):

Control Association) for IT governance and management.

It is meant to be a supportive tool for managers and allows bridging the

organization and practice better risk management practices associated with

for the IT business processes. It is a thoroughly recognized guideline that

can be applied to any organization across industries.

in organization, which is also the most important aspect of every modern

(iv) SOX (Sarbanes Oxley Act) - Section 404):

test and maintain those controls and procedures to ensure their

- The purpose of SOX is to reduce the possibilities of corporate fraud by

increasing the stringency of procedures and requirements for financial

- The SEC rules and PCAOB standard require that:

(a) Management perform a formal assessment of its controls over

financial reporting including tests that confirm the design and

operating effectiveness of the controls.

(b) Management include in its annual report an assessment of Internal

Controls over Financial Reporting.

- The external auditors provide two opinions as part of a single integrated

audit of the company:

(a) An independent opinion on the effectiveness of the system of Internal

Controls over Financial Reporting.

(b) The traditional opinion on the financial statements.

Checks on day to day transactions, which operate continuously as a part of routine

object being prevention and earlier detection of error or fraud.

(i) To detect fraud and error with ease.

(ii) Avoid & minimize possibility of occurrence of fraud & error.

(iii) Increase efficiency of staff.

(iv) Protect integrity of business.