The system established by the BOD and Management for the accomplishment of the corporation’s
objectives, the efficient operation of its business, the reliability of its financial reporting, and
faithful compliance with applicable laws, regulations and internal rules.
Internal Control
The framework under which internal controls are developed and implemented (alone or in concert with other policies or procedures) to manage and control a particular risk or business activity, or combination or risks or business activities, to which the corporation is exposed.
Internal Control System
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal
Control-Integrated Framework, originally issued in 1992 and refreshed in 2013 (ICIF-2013 or
Framework), was developed as guidance to help improve confidence in all types of data and
information.
COSO Cube
COSO Cube
The Committee of Sponsoring Organizations of the Treadway Commission
▪︎ This evolution is not revolutionary of the 1992 Framework.
▪︎ The 2013 Framework retains the definition of internal control and the COSO Cube, including the five components of internal control: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.
COSO’S 2013 Internal Control - Integrated Framework
as defined in the 2013 Framework, “a process effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.”
Internal Control
CATEGORIES OF OBJECTIVES
- Operations Objectives
- Reporting Objectives
- Compliance Objectives
CATEGORIES OF OBJECTIVES
related to the effectiveness and efficiency of the entity’s operations,
including operational and financial performance goals, and safeguarding assets against loss.
Operations Objectives
CATEGORIES OF OBJECTIVES
related to Internal and External financial and non-financial reporting to stakeholders, which would encompass reliability, timeliness, transparency, or other terms as established by regulators, standard setters, or the entity’s policies.
Reporting Objectives
CATEGORIES OF OBJECTIVES
- related to adhering to laws and regulations that the entity must follow
Compliance Objectives
are the actions established by the policies and procedures to help ensure that
management directives to mitigate risks to the achievement of objectives are carried out. Control
activities are performed at all levels of the entity, at various stages within business processes, and
over the technology environment.
Control activities
Types of Control Activities
- Preventive Controls
- Detection controls
- Hard controls
- Soft controls
- Manual controls
- Automated controls
- Key controls
- Secondary controls
Types of Control Activities
attempt to deter or stop an unwanted outcome before it occurs. Examples
include passwords, approval, policies, and procedures.
Preventive Controls
Types of Control Activities
attempt to uncover errors or irregularities that may already have occurred.
Examples include reconciliations, monitoring of actual expenses vs. budget, prior periods and
forecasts.
Detection controls
Types of Control Activities
are formal and tangible. Examples include organizational structure, policies,
procedures and segregation of duties.
Hard controls
Types of Control Activities
are manually performed, either solely manual or IT-dependent, where a system generated report is used to test a particular control.
Manual controls
Types of Control Activities
are informal and intangible. Examples include tone at the top, ethical climate
integrity, trust and competence.
Soft controls
Types of Control Activities
are performed entirely by the computer system
Automated controls
Types of Control Activities
must operate effectively to reduce the risk to an acceptable level.
Key controls
Types of Control Activities
are those that help the process run smoothly but are not essential.
Secondary controls
The seven factors relating to an effective control environment are
- integrity and ethical values;
- commitment to competence;
- board of directors or audit committee;
- management’s philosophy and
operating style; - organizational structure;
- assignment of authority and responsibility;
- human resource policies.
Components of Internal Controls
- Control Environment
- Risk Assessment
- Control Activities
- Information and Communication
- Monitoring
Level of Organizational Structure
- Function
- Operating Unit
- Division
- Entity
It is consists of infrastructure (physical and hardware components), software, people, procedures,
and data.
Information and Communication System
