COSO Flashcards
(22 cards)
Control Activities
Policies and Procedures that ensure that actions are taken to address the risks related to the achievement of management’s objectives
Monitoring
It is necessary to monitor and test the system and its data in order to ensure the ongoing reliability of information.
Information & Communication
The information and communication systems that enable an organization’s people to identify, process and exchange the information needed to manage and control operations.
Risk Assessment
Process of identifying, analyzing and managing the risks involved in achieving the organization’s objectives.
Control Environment
Management’s philosophy toward controls, organizational structure, system of authority and responsibility, personnel practices, policies and procedures.
3 Objectives of Internal Control
- Operations
- Reporting
- Compliance
5 Components of Internal Control
- Control Environment
- Risk Assessment
- Information &
Communication - Monitoring
- Control Activities
Control Environment Principles
- Integrity and Ethical Values
- Board of Directors
- Management
- Competence
- Accountability
Risk Assessment Principles
- Objectives
- Assessment
- Fraud
- Change Management
Control Activities Principles
- Risk Reduction
- Technology Controls
- Policies
Information & Communication Principles
- Quality
- Internal
- External
Monitoring
- Ongoing & Periodic
2. Address Deficiencies
The Control Monitoring Process
- Establish a Foundation
- Design and Execute
- Assess and Report
Control Monitoring Process Step 1: Establish a Foundation
- Tone at the Top
- Organizational Structure
- Baseline Understanding of IC
Effectiveness
Control Monitoring Process Step 2: Design and Execute
- Prioritize Risks
- Identify Controls
- Identify Persuasive
Information About Key
Controls - Implement Monitoring
Procedures
Control Monitoring Process Step 3: Assess and Report
- Prioritize Findings
- Report Results to Appropriate
Level - Follow Up on Corrective
Action
Control Monitoring Process Methods
- Reviewing Process
- Benchmarking Process
- Questionnaires
- Focus Groups & Interviews
4 Stages of Monitoring for Change Continuum
- Establish Control Baseline
- Change Identification
- Control Revalidation
- Change Management
Monitoring for Change Continuum Stage 1: Establish a Control Baseline
*begin where controls are well
understood
*gaining an initial
understanding
Monitoring for Change Continuum Stage 2: Change Identification
*risk assessment related to
changes in controls
*ID changes in control
operations, design or risks
Monitoring for Change Continuum Stage 3: Control Revalidation
- reevaluate control
effectiveness - maintain a continuous control
baseline
Monitoring for Change Continuum Stage 4: Change Management
- establishes a new control
baseline for the modified
controls
