Please enable JavaScript.

Coggle requires JavaScript to display documents.

discuss the assurance provided for systems and processes, such as…

- - - - Using COSO (2013) Internal Control—Integrated Framework
        
        DIAGRAM!!!!
        
        COSO’s internal control framework consists of five interrelated components
        
        control environment;
        
        Examples: management’s commitment to competence, how authority and responsibility for operating activities are assessed
        
        risk assessment;
        
        Examples: expanded foreign operation, corporate restructuring involving staff reductions
        
        control activities;
        
        Examples: separation of duties, gatekeeper at a factory
        
        information and communication;
        
        Examples: establishment of a compliance register for improprieties, communication channels with customers.
        
        monitoring activities.
        
        Examples: management’s questioning of reports that are different from their knowledge of operations, the role of the internal auditor
        
        COSO sets out 17 principles associated with the components.
        
        Because these principles are
        drawn directly from the components, an entity can achieve effective internal control by applying
        all 17 principles.
        
        All principles apply to operations, reporting, and compliance objectives.
        
        auditor assessment
        
        Auditors can assess the entity’s system of internal control in relation to the COSO framework,
        focusing on how it has selected, developed and deployed controls that affect the principles
        within the components of internal control.
        
        Principles
        
        Control activities RPT
        
        The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
        
        The organization selects and develops general control activities over technology to support the achievement of objectives.
        
        The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.
        
        Information and communication QEC
        
        The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.
        
        The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
        
        The organization communicates with external parties regarding matters affecting the functioning of internal control.
        
        Risk assessment IFOR
        
        The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
        
        The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.
        
        The organization considers the potential for fraud in assessing risks to the achievement of objectives.
        
        The organization identifies and assesses changes that could significantly impact the system of internal control.
        
        Monitoring activities ED
        
        The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
        
        The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
        
        Control environment EISIA
        
        The organization demonstrates a commitment to integrity and ethical values.
        
        The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
        
        Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
        
        The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.
        
        The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.
        
        definition
        
        The executive summary of the COSO (2013) framework defines internal control as:
        a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.
        
        responsibility for defining internal control
        
        The primary responsibility for defining internal control—and its related objectives in pursuing an entity’s strategic mission—rests with the chief executive officer, who is answerable to the board of directors.
        
        The audit committee of the board of directors, in turn, oversees the structure and functioning of the internal control system as part of its governance role.
        
        FiGURE 7.1!!!!
        
        Level 2
        
        five interrelated components and principles are represented by horizontal rows
        
        Level 3
        
        entity’s organisational structure is represented by the third dimension.
        
        Level 1
        
        the three categories of objectives—operations, reporting and compliance— are represented by the vertical column
        
        When judging whether an entity’s enterprise risk management is ‘effective’, it is necessary to determine if the five components are present and functioning effectively
        
        PDL diagram
        
        The COSO framework has developed and established standards against which all organisations can measure the effectiveness of their internal controls.
        
        It has clearly delineated the role and responsibilities of all individuals in an organisation in maintaining and evaluating internal control.
        
        caution
        
        internal control is not a cure-all for an entity’s problems. There are inherent limitations to internal control in that it is only as good as the people involved.
        
        It cannot overcome human error, faulty judgment or deliberate collusion and circumvention of controls. It cannot guarantee anything.
        
        An effective internal control system can only provide a reasonable assurance that the entity will achieve its operational, financial reporting and compliance objectives.
        
        been adopted by most US firms carrying out engagements under s. 404 of the Sarbanes–Oxley Act, which requires:
        • the annual report to include management’s assessment of the effectiveness of internal controls over financial reporting
        • the auditor to attest to and report on management’s internal control assessment.
      - General
        
        Reasons for internal control
        
        The investing public has a legitimate interest in the state of an entity’s internal controls.
        
        Also, a requirement for management to report on the adequacy of internal controls may cause them to be more effective in maintaining internal control systems.
        
        Sarbanes–Oxley Act 2002 (US),
        
        now requirements for management reports on internal controls, and subsequent requirements for these assessments to be audited.
        
        Australia
        
        ASAE 3150
        
        mandatory requirements for assurance practitioners to apply, in conjunction with the requirements in ASAE 3000, when accepting, planning, performing and reporting on controls
        
        (i) as at a specified date, the controls were suitably designed, to achieve the identified control objectives … or
        (ii) throughout the period, the controls were suitably designed to achieve the identified control objectives, and the controls operated effectively as designed (ASAE 3150, para. 15).
        
        Providing a report on internal controls enables management to discharge its accountability obligation to establish an effective internal control structure.
        
        Suitable criteria
        
        These criteria are a key aspect for engagement acceptance. The most widely used in practice is the Internal Control—Integrated Framework (COSO 2013).
        
        definition
        
        The executive summary of the COSO (2013) framework defines internal control as:
        a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.
- - - - benefits
        
        • Owners of small businesses and management of larger organisations will be more effective if they are aware of important risks and have an evaluation of the potential magnitude and likely impact on the organisation.
        • Directors will benefit in carrying out their fiduciary duties and oversight responsibilities.
        • Shareholders should benefit from knowledge that management is aware of the important risks and has implemented controls related to managing those risks.
        • Outsiders, including trading partners, creditors and regulators, should benefit indirectly from assurance services on risk management provided to management or directors.
        
        Risk management, control and governance processes
        (AS/NZS ISO 31000 Risk Management—Principles and Guidance)
        
        framework is promoted by the ISO, and AS/NZS ISO 31000 is widely used in Australia and New Zealand as an alternative to the COSO (2013) framework.
        
        The main elements of AS/NZS ISO 31000 are:
        • Establish the context: Establish the strategic, organisational and risk management context in which the rest of the process will take place.
        • Identify risks: Identify which risks can arise (and why and how) as the basis for further analysis.
        • Analyse risk: Determine the existing controls, and analyse risks in terms of consequence and likelihood in the context of those controls. The analysis should consider the range of potential consequences and the likelihood of those consequences occurring.
        • Evaluate risk: Compare estimated levels of risk against the established criteria. This enables risks to be ranked in order to identify management priorities.
        • Treat risk: Accept and monitor low-priority risks. For other risks, develop and implement a specific management plan.
        • Monitor and review: Monitor and review the performance of the risk-management system and any changes that might affect it.
        • Record: The risk management activities of the entity should be appropriately recorded so that they are traceable. For each stage of the process, adequate records should be kept, sufficient to satisfy independent audit.