3 objectives of Coso Framework
- Operations
- Reporting
- Compliance
Operations Objectives
effectiveness and efficiency of an entity’s operations. Includes financial and operational goals and ensuring assets of the org are safeguarded against potential losses
Reporting Objectives
reliability, timeliness and transparency of entities external internal financial and nonfinancial reporting established by regulators
Compliance Objectives
ensure the entity is adhering to all applicable laws and regulations
5 components of internal control and short summary what they are about
- Control Environment - tone at the top (ethics)
- Risk assessment - FS misstated, not efficient, breaking law
- Information and communications - Fair Accurate Complete Timely (FACT)
- Monitoring - effectiveness of controls and report deficiencies
- (existing) Control activities : polices / procedures to mitigate risk
Control Environment Components
provides process, structure, and standards and foundation for entity to establish a system of internal control (EBOCA)
- Commitment to Ethics and Integrity: POF establishing standards and conduct
- Board independence and Oversight: POF establishing oversight responsibilites
- Organizational Structure: POF establishing reporting lines, authorities and responsibilites that are appropriate to org objectives
- Commitment to Competence: POF hire, develop, retain competent employees
- Accountability: POF establishing performance measures, incentives, and rewards
Risk Assessment Components
Make entity “SAFR”
- Specific Objectives: identification and assessment of risk related to objectives created
- Identify and Analyze risk: how risk should be managed
- Consider potential Fraud. POF assessing incentives and pressures, opportunities and attitudes, and rationalizations
- Identify and Assess Changes: POF assessing changes in the external environment, business model, and leadership
Information and Communication components
“OIE”
- Obtain and use information: org obtains or generates and uses relevant high quality ind to support internal controls
- Internally communication info: POF flow of info up and down and across the org (internal audit, audit committee management)
- Communicate with External Parties: POF management having open two-way external communication channels
Monitoring Activities Components
SO D (monitor SOD or grass won’t grow)
- Ongoing / Separate evaluations: to ascertain whether the components of internal control are present and functioning
- Communications of Deficiencies: org evaluates and communicates internal control deficiencies in a timely manner
(existing) control activities compoents
Entities policies and procedures to mitigate risk (CATP)
- Select and develop Control Activities: to mitigate risk
- Select and develop Technology controls: to support achievement objectives
- Deployment of Policies and Procedures: put policies into action
