Please enable JavaScript.

Coggle requires JavaScript to display documents.

INTERNAL CONTROL, COSO AND COBIT - Coggle Diagram

- - - - principles?
        
        demonstrates a commitment to integrity and ethical values
        
        findings?
        
        Absence of an effective Ethics Policy
        
        Absence of an effective Code of Conduct
        
        Absence of effective behavioral monitoring processes
        
        demonstrates independence from management and exercises oversight of the development
        
        findings?
        
        Lack of established IC oversight assignments
        
        Lack of qualified, trained oversight personnel
        
        Undue influence by management
        
        establishes structures, appropriate authorities and responsibilities
        
        findings?
        
        Absence of controls over subsidiaries/divisions
        
        Lack of defined authority/responsibility
        
        demonstrates a commitment to competent
        
        findings?
        
        Lack of adequate performance evaluation system
        
        Lack of succession planning
        
        enforce accountability
        
        findings?
        
        Lack of performance measures, incentives and rewards pertaining to internal control responsibilities
        
        Failure to evaluate performance with respect to achieving internal control objectives
    - - principles?
        
        specifies objectives
        
        findings?
        
        Operational objectives are not clearly defined
        
        Inadequate financial & non-financial reporting objectives
        
        identifies & analyze risks
        
        findings?
        
        The significance of risks are not estimated
        
        Risk identification does not include entity, division, operating unit & functional levels
        
        assessing fraud risks
        
        findings?
        
        Fraud risk assessment process is absent
        
        Fails to assess incentives and pressures
        
        identifies and assesses changes
        
        findings?
        
        Organization does not assess all types of changes that could impact the internal controls
    - - principles?
        
        selects and develops control activities
        
        findings?
        
        Control activities do not relate to business processes
        
        Controls do not address segregation of duties
        
        selects and develops general control activities over technology
        
        findings?
        
        Management does not establish relevant security management control activities
        
        Management does not establish relevant technology acquisition, development and maintenance process control activities
        
        deploys control activities through policies and procedures
        
        findings?
        
        Missing or inadequate policies and procedures
        
        Failure to take corrective action on a timely basis
      - type
        
        Preventive
        
        purpose
        
        designed to discourage errors or irregularities
        from occurring.
        
        example
        
        Segregation of duties
        
        Authorization
        
        Detective
        
        purpose
        
        designed to search for and identify errors after they have occurred.
        
        example
        
        Periodic Inventory
        
        Analysis
        
        Corrective
        
        purpose
        
        designed to restore a system to an approved/last known good state
        
        example
        
        Anti Virus software.
        
        Root cause analysis
    - - principles?
        
        uses relevant, quality information
        
        findings?
        
        Organization has failed to identify the information requirements to support functioning of internal controls
        
        Organization does not capture internal and external sources of data, and does not process data into relevant information
        
        internally communicates
        
        findings?
        
        Organization fails to communicate internal control information to employees
        
        Organization fails to communicate internal control information with management or Board
        
        communicates with external parties
        
        findings?
        
        Does not communicate accurate information to external parties
        
        Does not utilize relevant method of communication
    - - principles?
        
        performs on-going and/or separate evaluations
        
        findings?
        
        Management does not integrate internal controls with business processes
        
        Management fails to evaluate effectiveness of internal control on a regular basis
        
        evaluates and communicates internal control deficiencies
        
        findings?
        
        Management fails to advise those responsible for correcting internal control deficiencies
        
        Organization fails to require and monitor corrective action