BEC Flashcards
(252 cards)
What is internal control?
(ORC - 3 objectives of COSO framework)
Process designed and implemented by an organization’s management, Board and employees to provide reasonable assurance that the organization will achieve its operating, reporting and compliance objectives.
How does COSO framework assist management and the board?
- Effective application of internal controls
- Determine requirements of an effective system of internal control
- Allows for judgment + flexibility in design and implementation within all operational and functional areas
- Identify + analyze risks to develop acceptable actions to mitigate or minimize risks to an acceptable level
- Eliminate redundant, ineffective, or inefficient controls
- Extend internal control application beyond financial reporting. Main focus: Efficient & effective: Operations + Compliance with laws/ regulations
What does the COSO cube illustrate?
COSO cube links all 5 (five) components with all three (3) objectives categories and ALL levels of the organizational structure, everything is interrelated, which is illustrated by the cube itself.
What is the COSO cube?
COSO cube depicts relationship between entity objectives, integrated internal control components and organizational structure.
Includes three (3) objectives “ORC”:
* Operations
* Reporting
* Compliance
Includes five (5) internal control components “CRIME”:
* Control environment
* Risk assessment
* Information & Communication
* Monitoring activities
* Existing control activities
Includes four (4) levels of organizational structure:
* Entity level
* Division
* Operating unit
* Function
How can COSO framework provide value to stakeholders?
COSO framework enables external stakeholders to gain greater understanding and/or confidence on:
- What constitutes as an “effective” system of internal controls
- Management will be able to eliminate ineffective, redundant or inefficient controls
- Board has effective oversight of organization’s internal controls
- Organization will achieve its stated objectives and is capable of identifying, analyzing and responding to risks
What are the three (3) categories of objectives in the COSO framework?
(ORC numenoic)
- Operations - relates to effectiveness and efficiency and ensuring that organization assets are adequately safeguarded.
- Reporting (focus of COSO) - pertain to reliability, timeliness, and transparency of entity’s external + internal financial and non-financial reporting established by regulators.
- Compliance - ensures entity is adhering to laws + regulations.
What are the components of Internal Control?
(CRIME nemonic)
CRIME applies to all three (3) “ORC” categories. It represents the five (5) integrated components of internal control.
CRIME + seventeen (17) related fundamental principles are needed to achieve the three (3) objectives of internal control.
- Control environment - tone at the top (ethics)
- Risk assessment- FS misstated, not efficient, breaking the law
- Information and communication - fair, accurate, complete, and timely “FACT nemonic”
- Monitoring - effectiveness of controls & report deficiencies
- Existing Control Activities - Policies/procedures to mitigate risks
What is control environment?
- Component of internal controls
- EBOCA nemonic
Control environment includes processes, structures and standards that provide the foundation for entity to establish a system of internal control through “tone at the top” approach. It includes the following:
- Ethics - establish standards of conduct
- Board independence - oversight responsibilities
- Organizational structure - establish reporting lines and ensure authority and responsibility are appropriate
- Commitment to competence - hire, develop, retain competent EE’s
- Accountability - establish performance measures, incentives and rewards
What is risk assessment?
- Component of internal controls
- SAFR nemonic
Risk assessment makes entity “SAFR”
Risk assessment is an entity’s identification and analysis of risks to achievement of objectives. Four (4) principles related to risk assessment are:
- Specify objectives - identification and assessment of risks
- Analyze risks - how risks should be managed
- Potential for Fraud - assessing incentives, pressures, opportunities, attitudes and rationalizations
- Assess changes - in external environment, business model and leadership
What is information and communication?
- Component of internal controls
- OIE and FACT nemonic
Information and communication is between internal and external parties. Three (3) principles “OIE” relate to this internal control component:
- Obtain or generates and uses relevant high quality information that is fair, accurate, complete and timely “FACT”
- Internally communicate information to internal audit, audit committee and management. Information flows up, down and across organization
- Communication with external parties such as CPA firm and consultants. Management has two-way external communication channels using various methods and channels.
What are monitoring activities?
- Component of internal controls
- SO D nemonic
Monitoring is process of assessing quality of internal control performance by assessing design + operating effectiveness of controls.
Monitor “SOD” or grass wont grow. Two (2) principles related to monitoring activities are:
- Ongoing + separate evaluations performed to determine whether the components of internal control are present + functioning. Frequency of testing dictated by risk.
- Communication (reporting) of internal control deficiencies in timely manner for corrective action.
What are control activities?
- Component of internal controls
- CA TP nemonic
Control activities are established in entity’s P&P’s to mitigate risks. These may be detective or preventative + includes segregation of duties. Three (3) principles related to control activities are:
- Select + develop control activities to mitigate risks.
- Select + develop technology controls to support achievement of objectives.
- Deploy and put P&P’s into action
What are the seventeen (17) principles within each of the five (5) components of internal controls that are associated with the COSO objectives (operations, reporting and compliance)?
Five (5) components of internal control = CRIME
- Control Environment “EBOCA”
* Commitment to ethical values + integrity
* Board independence + oversight
* Organizational structure
* Commitment to competence
* Accountability - Risk assessment “SAFR”
* Specify objectives
* Identify + assess changes
* Consider potential for fraud
* Identify + analyze risks - Information and communication “OIE”
* Obtain and use info
* Internally communicate information
* Communicate w/external parties - Monitoring activities “SO D”
* Ongoing and/or separate evaluations
* Communication of deficiencies - (Existing) Control activities “CA T P”
* Select + develop control activities
* Select + develop technology controls
* Deploy through P&P’s
The five (5) components of internal controls and seventeen (17) principles within the components are said to be relevant (flexible) as well as present and functioning.
What does present and functioning mean?
Present (Design) - components and relevant principles are included in the design and implementation of the internal control system.
Functioning (Operating Effectively) - demonstrates that the components and relevant principles are operating as designed in the internal control system.
What is COSO definition of risk?
Risk is the possibility that events will occur and affect the achievement of strategy and business objectives.
What is the underlying premise of ERM?
Entities exist to provide value for stakeholders and face risk in the pursuit of value. Management decisions affect the development of value including its creation, preservation, erosion, and realization.
How is value defined within ERM?
Value is defined by entity type:
For-profit commercial entities - shaped by strategies that balance market opportunities against risks pursuing those opportunities.
NFP/ Governmental entities - shaped by delivering goods/services that balance opportunity to serve broader community against associated risks.
What are the components of value creation within ERM?
(CPER nemonic)
Develop value to make it “CPER”
- Value created when benefits > costs of resources used.
- Value erosion - costs > benefits, stock price decrease, ROIC < cost, -NPV. Erosion created due to faulty strategy + inefficient/ ineffective operations.
- Value realization - realized from benefits created by organization received by stakeholders [dividends/ SP > cost “capital gain”] that are monetary or nonmonetary (customer satisfaction, brand and leadership) form.
What does mission, vision and core values mean within ERM?
These define what an entity strives to be (successful) and how it wants to conduct business (ethically)
- Mission (objectives) - core purpose + why entity exists
- Vision (strategy) - what entity hopes to achieve
- Core values - “How” to achieve goals with ethics, culture and core values. Represents beliefs and ideas about what is good/ bad
What is Enterprise Risk Management?
(CCPIS nemonic)
ERM is the culture, capabilities, and practices with strategy-setting and performance that organizations rely on to manage risk in creating, preserving and realizing value.
CCPIS - to manage risk and create value
Culture - core values, collective thinking and shaping decisions.
Capabilities- competitive advantage and exploitation.
Practices - continually applied at all levels of the entity.
Integration w/strategy-setting and performance that aligns with mission and vision:
* Why do you exist - mission
* What’s your strategy/mission
Mission and values correlate w/strategy and business objectives.
What is risk appetite?
Risk appetite is an entity willingness to assume risk. It is expressed as a range and provides guidance on whether an entity should pursue or not pursue:
- Mission aligns with an entity “why” which is impacted by industry
- Vision aligns with “how” (an entity strategy - aggressive/ conservative)
- Risk appetite varies and is flexible
What is the relationship between value and risk appetite?
Both are directly related:
* Risk assumed
* Expected return
What are the components of ERM?
(GO PRO nemonic)
ERM has five (5) components and twenty (20) risk management principles. They are similar to the COSO cube for internal control but address broader issues of risks.
- Governance and culture
* Tone at the top, core values, EBOCA
* Control environment from CRIME nemonic - Strategy and Objective-setting
* Mission/vision - defines risk appetite
* Risk assessment and control activities from CRIME nemonic
* SAFR nemonic - Performance
* Evaluate, ID and respond to risk using ARTS nemonic
* Risk assessment and control activities from CRIME nemonic
* SAFR nemonic - Review and revision - assess substantial changes and pursue improvements
* Monitoring from CRIME nemonic - Information (IT), Communication (risk info) and Reporting Ongoing (performance)
* Information and communication from CRIME nemonic
* OIE nemonic
* CATP and SOD nemonic blended in: obtain info (FACT), internal and external communications
What are the twenty (20) principles within each of the five (5) components ERM?
Five (5) components of ERM = GO PRO
- Governance and Culture “DOVES”
* Defines desired culture
* Exercises board oversight
* Demonstrates commitment to core values - tone at the top
* Attracts, develops, and retains EE’s
* Establishes operating structure - Strategy and Objective setting “SOAR”
* Evaluates alternative strategies - what is the vision?
* Formulates business objectives - why do we exist (mission)?
* Analyzes business context
* Defines risk appetite - Performance “VAPIR”
* Develops portfolio view - Parent level
* Assesses severity of risk
* Prioritizes risk
* Identifies risks (events)
* Implements risk responses - using “ARTS” nemonic - Review and Revision “SIR”
* Assesses substantial change
* Pursue improvement in ERM
* Reviews risk and performance - How did we do with managing risk? Did we use the right hedge? - Information, Communication, and Reporting Ongoing “TIP”
* Leverages information and technology
* Communicates risk information
* Reports on risk, culture and performance