What is internal control?
(ORC - 3 objectives of COSO framework)
Process designed and implemented by an organization’s management, Board and employees to provide reasonable assurance that the organization will achieve its operating, reporting and compliance objectives.
How does COSO framework assist management and the board?
What does the COSO cube illustrate?
COSO cube links all 5 (five) components with all three (3) objectives categories and ALL levels of the organizational structure, everything is interrelated, which is illustrated by the cube itself.
What is the COSO cube?
COSO cube depicts relationship between entity objectives, integrated internal control components and organizational structure.
Includes three (3) objectives “ORC”:
* Operations
* Reporting
* Compliance
Includes five (5) internal control components “CRIME”:
* Control environment
* Risk assessment
* Information & Communication
* Monitoring activities
* Existing control activities
Includes four (4) levels of organizational structure:
* Entity level
* Division
* Operating unit
* Function
How can COSO framework provide value to stakeholders?
COSO framework enables external stakeholders to gain greater understanding and/or confidence on:
What are the three (3) categories of objectives in the COSO framework?
(ORC numenoic)
What are the components of Internal Control?
(CRIME nemonic)
CRIME applies to all three (3) “ORC” categories. It represents the five (5) integrated components of internal control.
CRIME + seventeen (17) related fundamental principles are needed to achieve the three (3) objectives of internal control.
What is control environment?
Control environment includes processes, structures and standards that provide the foundation for entity to establish a system of internal control through “tone at the top” approach. It includes the following:
What is risk assessment?
Risk assessment makes entity “SAFR”
Risk assessment is an entity’s identification and analysis of risks to achievement of objectives. Four (4) principles related to risk assessment are:
What is information and communication?
Information and communication is between internal and external parties. Three (3) principles “OIE” relate to this internal control component:
What are monitoring activities?
Monitoring is process of assessing quality of internal control performance by assessing design + operating effectiveness of controls.
Monitor “SOD” or grass wont grow. Two (2) principles related to monitoring activities are:
What are control activities?
Control activities are established in entity’s P&P’s to mitigate risks. These may be detective or preventative + includes segregation of duties. Three (3) principles related to control activities are:
What are the seventeen (17) principles within each of the five (5) components of internal controls that are associated with the COSO objectives (operations, reporting and compliance)?
Five (5) components of internal control = CRIME
The five (5) components of internal controls and seventeen (17) principles within the components are said to be relevant (flexible) as well as present and functioning.
What does present and functioning mean?
Present (Design) - components and relevant principles are included in the design and implementation of the internal control system.
Functioning (Operating Effectively) - demonstrates that the components and relevant principles are operating as designed in the internal control system.
What is COSO definition of risk?
Risk is the possibility that events will occur and affect the achievement of strategy and business objectives.
What is the underlying premise of ERM?
Entities exist to provide value for stakeholders and face risk in the pursuit of value. Management decisions affect the development of value including its creation, preservation, erosion, and realization.
How is value defined within ERM?
Value is defined by entity type:
For-profit commercial entities - shaped by strategies that balance market opportunities against risks pursuing those opportunities.
NFP/ Governmental entities - shaped by delivering goods/services that balance opportunity to serve broader community against associated risks.
What are the components of value creation within ERM?
(CPER nemonic)
Develop value to make it “CPER”
What does mission, vision and core values mean within ERM?
These define what an entity strives to be (successful) and how it wants to conduct business (ethically)
What is Enterprise Risk Management?
(CCPIS nemonic)
ERM is the culture, capabilities, and practices with strategy-setting and performance that organizations rely on to manage risk in creating, preserving and realizing value.
CCPIS - to manage risk and create value
Culture - core values, collective thinking and shaping decisions.
Capabilities- competitive advantage and exploitation.
Practices - continually applied at all levels of the entity.
Integration w/strategy-setting and performance that aligns with mission and vision:
* Why do you exist - mission
* What’s your strategy/mission
Mission and values correlate w/strategy and business objectives.
What is risk appetite?
Risk appetite is an entity willingness to assume risk. It is expressed as a range and provides guidance on whether an entity should pursue or not pursue:
What is the relationship between value and risk appetite?
Both are directly related:
* Risk assumed
* Expected return
What are the components of ERM?
(GO PRO nemonic)
ERM has five (5) components and twenty (20) risk management principles. They are similar to the COSO cube for internal control but address broader issues of risks.
What are the twenty (20) principles within each of the five (5) components ERM?
Five (5) components of ERM = GO PRO