Corporate Governance, Internal Control & Enterprise Risk Management

Question 1

Duties of the Board of Directors

Answer 1

Duties of the Board of Directors– Fiduciary Duty
Act loyally – in the best interests of the Corporation and shareholders (not putting their interests above the companies)
Act with a duty of care – act with care and diligence when making company decisions
Act with due diligence – which means using reasonable care when entering into agreements and transactions with another party
– Determining or revising mission statements and amending bylaws
– strategic planning and development of board objectives and policies
– selection and oversight of CEO
– securing the availability of financial resources
– budget approval and approval of Maj. operating and financial goals
– accounting to stakeholders
providing advice to management in determining its compensation
– establishing dividend policies
– reacquiring treasury stock

Question 2

Board of Directors – Committees

Answer 2

Board of Directors – Committees
– Nominating committee – responsible for overall corporate governance
– Audit committee – under Sarbanes-Oxley (SOX) independent directors at least one financial expert
– Compensation committee – independent directors establish compensation policies for directors and executives

Question 3

Compensation Committee

Answer 3

Compensation Committee – Responsibilities
Developing a compensation approach or philosophy
Establishing compensation for CEO and other executives
Use outside experts as appropriate
Receive and evaluate proposals regarding executive compensation

Question 4

Compensation Committee (Dodd-Frank Act)

Answer 4

Say on Pay-stockholders are required to be allowed to determine

• Independence - members are required adhere to a higher standard in determining their independence
• Disclosure - requires enhanced disclosure relating to executive compensation
• Clawbacks - requires an entity that is required to restate its financial statements to establish policies for recoupment of compensation (SOX Title III)

Question 5

The Institute of Internal Auditors (IIA) – International Professional Practice Framework (IPPF)

Answer 5

The Institute of Internal Auditors (IIA) – International Professional Practice Framework (IPPF)

1. ) The definition of internal auditing
2. ) The code of ethics
3. ) International standards for the professional practice of internal auditing (ISPPIA).

Question 6

Internal Auditing (definition)

Answer 6

Internal Auditing (definition)
"Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and government processes."

Question 7

Code of Ethics (IIA)

Answer 7

Code of Ethics (IIA) – Principles
Integrity– honesty diligence and responsibility
Objectivity– not participating in activities that may impair objectivity
Confidentiality– exercising prudence in use and protection of information
Competency– engaging only in services for which they are qualified
Rules

Question 8

Attributes Standards (4 categories)

Answer 8

Attributes Standards ( 4 categories)
–purpose, authority and responsibility
– independence and objectivity
– proficiency and due professional care
– quality assurance and improvement program

Question 9

Performance Standards (7 categories)

Answer 9

performance standards (7 categories)
– managing the internal audit activity
– nature of work
– engagement planning
– performing the engagement
– communicating results
– monitoring progress
– communicating the acceptance of risk

Question 10

Independent auditors are required to communicate with the auditing committee regarding:

Answer 10

– critical accounting policies and practices being used
– alternative treatment, acceptable under GAAP, that have been discussed with management, including implications of such treatment and the public accounting firm’s performance.
– any additional written communication with management, including engagement letter or schedule of unadjusted differences.

Question 11

Generally Accepted AuditingSstandards (GAAS) require the external auditor to communicate with those in charge of governance regarding certain matters:

Answer 11

– auditor’s responsibility to form and express an opinion on the financial statements
– the planned scope and timing of the audit
– the qualitative aspects of the entities accounting practices
– significant difficulties, disagreements with management, and other findings or issues
– uncorrected mistakes, accumulated by the auditor as well as the effect of uncorrected mistakes from prior periods
– material corrected mistakes brought to management’s attention
– significant findings or issues discussed management
– auditors view on matters that were the subject of management’s consultation with other accountants
– written representations requested by the auditor

Question 12

Public Company Accounting Oversight Board PCAOB

Answer 12

Public Company Accounting Oversight Board PCAOB– Audit Standard 5 Integrated Audit (AS5)
requires the auditor to examine the design and operating effectiveness of internal controls over financial reporting in order to provide sufficient basis for an opinion on its effectiveness in preventing or detecting material misstatements of the financial statements. The results may be expressed in a separate report or one combined report.

Question 13

Internal Controls Integrated Framework (COSO)

Answer 13

Internal Controls Integrated Framework (COSO)
COSO describes internal controls as: a process, affected by the entity’s Board of Directors, management, and other personnel designed to provide reasonable assurance regarding the achievement of objectives and categories of
(1) Accurate and reliable financial reporting,
(2) Compliance with applicable laws and regulations, and
(3) Effectiveness and efficiency of operations (ACE)

Question 14

5 Internal Control Principles (CRIME)

Answer 14

C – Control Activities
R – Risk Assessment
I – Information & Communication
M – Monitoring
E – Controlled Environment – (tone at the top)

Question 15

Factors of Control Environment (CHOPPER)

Answer 15

Factors of Control Environment
C – commitment to competence
H – human resource policies and procedures
O – organizational structure
P – philosophy and operating style of management
P – participation of the Board of Directors or audit committee
E – ethical and integrity values
R – responsibility and authority assignment

Question 16

Limitations of Internal Control (inherent – COCO)

Answer 16

Internal controls may not be affected because:
Collusion
Override by management
Competence – errors or mistakes, or human judgment
Cost/benefit constraints
Obsolescence – changing companies operations or size

Question 17

Segregation of Duties (ARCC)

Answer 17

Segregation of Duties (ARCC)
A – Authorization of transactions
R – Recording of the transactions
C – Custody of resources associated with those transactions
C – comparison and reconciliation of physical resources to the recorded information

Question 18

Controlling Changes to Processes

Answer 18

Controlling Changes to Processes
Change Requests – identify when change is needed or desired
Change Analysis – evaluating change
Change decisions – deciding on the change
Planning and Implementing the Change – developing a plan that not only includes the new process or components but also indicates all aspects of the existing process
Monitoring and Tracking the Change – once changes made, it will be monitored with two objectives in mind first, management will want to make certain that the change is improperly executed. Second management will want to determine if changes having the intended effect

Question 19

Enterprise Risk Management (ERM)

Answer 19

Enterprise Risk Management (ERM)
enterprise risk management is a process, affected by an entity’s Board of Directors, management and other personnel, applied in eight strategy setting and across the entire enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

Question 20

Capabilities that are Inherent in ERM

Answer 20

Capabilities that are Inherent in ERM
– aligning risk appetite and strategy
– enhancing risk response decisions
– reducing operational surprises and losses
– identifying and managing multiple and cross-enterprise risks
– seizing opportunities
– improving deployment of capital

Question 21

COSO – Achieving the Objectives (4 areas)

Answer 21

COSO – Achieving the Objectives (4 areas)
–strategic objective – high-level goals designed to enable entity to focus on its mission
– operations objectives – the use of human and other resources with a focus on productivity and efficiency
– reporting objectives – designed to ensure that internal and external reporting is reliable
– compliance objective – provide assurance that the entity is in compliance with applicable laws and regulations

Question 22

8 Components Of Enterprise Risk Management

Answer 22

8 Components Of Enterprise Risk Management

1. Internal Environment – the tone of management (integrity and ethical values)
2. Objective Setting – Translates the mission statement into goals and objectives that support the mission statement
   a. Operational Objective – (efficiency and effectiveness of operations)
   b. Reporting Objectives – reliable reporting of internal and external finance and non-financial information
   c. Compliance objectives make certain that the division operates within appropriate guidelines and is in compliance with applicable laws and regulations and internal company politics
3. Event identification – determining what those events are and how to distinguish between those representing opportunities and those representing threats.
4. Risk assessment – management must evaluate the extent of potential effects of identified events on the ability of the entity to achieve its objectives
5. Risk Response – when management has identified a risk that may affect the entity’s ability to achieve its objectives it will be signed if it does damage to the what response would be most appropriate
6. Control Activities – management establishes policies and procedures to make certain that its decisions as to how to respond to risks are carried out.
7. Information and Communication– relevant information must be captured, processed,and communicated those who can benefit from it
8. Monitoring – control activities should be monitored on a regular basis to determine if they were implemented properly, if they are operating as intended and if they are effective at causing or preventing the behavior they were designed to cause or prevent

Question 23

Three (3) Committees that are required by a publicly held company

Answer 23

Nominating Committee – is responsible for overall corporate governance of the organization. The primary duty of the nominating committee is to determine who is suitable for services on the Board of Directors.
The Audit Committee – has a variety of responsibilities. Under Sarbanes-Oxley Act (SOX), the audit committee is required to be made up of independent directors and at least one member is required to be a financial expert.
Compensation Committee – is made up of independent directors, and is responsible for establishing compensation policies for directors and executives of the corporation.

Question 24

Financial Expert

Answer 24

Financial Expert has:
– an understanding of GAAP and financial statements
– experience in preparing or auditing comparable financial statements and experience in applying financial statements or audit knowledge to the accounting for estimates, accruals, and reserves
– experience with internal accounting controls
– an understanding of the functions of the audit committee

Question 25

Attribute Standards (4)

Answer 25

Attribute Standards fall into 4 categories:
– purpose, authority, and responsibility
– independence and objectivity
– proficiency and due professional care
– quality assurance and improvement program

Question 26

Performance Standards (7)

Answer 26

Performance Standards fall into 7 categories:
– managing the internal audit activity
– nature of work
– engagement planning
– performing the engagement
– communicating results
– monitoring progress
– communicating the acceptance of risks