Week 4: THE INTERNAL CONTROL STRUCTURE OF ORGANIZATIONS

 examines policies and procedures; how security is

I. Enterprise Risk Management (ERM)
 a process, effected by an entity’s board of directors,
management and other personnel, applied in strategy
setting and across the enterprise, designed to identify
potential events that may affect the entity, and
manage risk to be within its risk appetite
Internal Environment
 encompasses the tone of an organization that sets the
basis for how risk is viewed and addressed by an
entity’s people
Objective Setting
 a must exist before management can identify
potential events affecting their achievement.
Event Identification
 internal and external events affecting achievement of
an entity’s objectives must be identified, with
distinction made between risks and opportunities
Risk Assessment
 risks are analyzed by likelihood and impact, as a
basis for determining how they should be managed
 risks are assessed on both an inherent and a residual
basis, meaning that the likelihood of errors is
considered both before and after the application of
controls
Risk Response
 management selects risk responses— avoiding,
accepting, reducing, or sharing risk—by developing
a set of actions to align risks with the entity’s risk
tolerances and risk appetite
Control Activities
 policies and procedures are established and
implemented to help ensure that the risk responses
are effectively carried out
Information and Communication
 relevant information is identified, captured, and
communicated in a form and a time frame that enable
people to carry out their responsibilities; effective
communication also occurs in a broader sense,
flowing down, across, and up the entity
Monitoring
 is accomplished through ongoing management
activities (including internal auditing), separate
evaluations (such as those performed by external
auditors), or both
II. Code of Ethics
 should reduce opportunities for managers or
employees to conduct fraud. This will only be true,
however, if top management emphasizes this code of
ethics and disciplines or discharges those who violate
it
implemented and even the plans organization have in
place to manage continuity
4. Outsourcing
 evaluating how well management are communicating
and how well needs are being met ensures money is
being spent wisely and that the organization gets the
best possible ROI for its outsourcing investments
5. Monitoring
 establishing the conditions organizations want to
work in and the policies that the team needs to use is
an ideal start, but unless the management monitors
and evaluate processes, they won’t be able to keep up
with the changes
IV. IT Controls
 an organization must institute controls to limit these
risks in IT systems
Categories of IT Controls
General Controls
 a apply overall to the IT accounting system; they are
not restricted to any particular accounting application
Application Controls
 are used specifically in accounting applications to
control inputs, processing, and output
V. Corporate Governance
 an elaborate system of checks and balances whereby
a company’s leadership is held accountable for
building shareholder value and creating confidence in
the financial reporting processes
VI. IT Governance
 the leadership, organizational structure, and processes
that ensure that the enterprise achieve(s) its goals by
adding value while balancing risk versus return over
IT and its processes
To fulfill the management obligations that are inherent in
IT governance, management must focus on the following
aspects:
1. Aligning IT strategy with the business
strategy
2. Cascading strategy and goals down into the
enterprise
3. Providing organizational structures that
facilitate the implementation of strategies
and goals
4. Insisting that an IT control framework be
adopted and implemented

III. COSO Accounting Internal Control Structure

 Committee of Sponsoring Organizations of the

Treadway Commission (COSO)
 is a voluntary, private‐sector organization that was
originally formed in 1985 to sponsor the National
Commission on Fraudulent Financial Reporting
 it sponsors and disseminates frameworks and
guidance based on in‐depth research, analysis, and
best practices in the areas of enterprise risk
management, internal controls, and fraud deterrence

5 Components of the COSO Framework

1. The Control Environment

 this component encompasses leadership, mission,
goals and desired outcomes
2. Risk Assessment and Management
 this directly targets threats and weaknesses and
allows management to fully understand risks
3. Control Activities