COSO (Committee of Sponsoring Organizations) Flashcards
(39 cards)
Define “control activities” (according to the COSO internal control and ERM frameworks).
One of five components of internal control. Relates to the policies and procedures that ensure that organizational actions address key risks related to the achievement of management’s objectives.
Define “monitoring” (according to the COSO internal control framework).
One of five components of internal control. This component ensures the ongoing reliability of information and control processes by monitoring and testing the control system.
Define “information and communications” (according to the COSO internal control framework).
One of five components of internal control. Enable an organization’s personnel to identify, process, and exchange the information needed to manage and control operations.
Define “risk assessment” (according to the COSO internal control framework).
One of five components of internal control. The process of identifying, analyzing and managing the risks related to achieving the organization’s objectives.
Define “control environment” (according to the COSO internal control framework).
One of five components of internal control. Encompasses management’s philosophy towards controls, organizational structure, system of authority and responsibility, personnel practices, and policies and procedures. The core or foundation of any system of internal control.
Define inbound communications.
Communications with outsiders to the organization, including customers, suppliers, external auditors, regulators, financial analysts and others.
Define organizational policies.
The organization’s control activities that establish stakeholder expectations regarding conduct and operations.
Define risk assessment materiality.
The determination of how large of a risk poses a threat to objectives.
Define risk assessment precision.
Whether, and the extent to which, risk can be quantified.
Define accountability in the context of designing internal control.
Holding individuals accountable for their internal control responsibilities.
Define competence in the context of designing internal control.
A commitment to attract, develop, and retain highly qualified individuals consistent with achieving organizational objectives. Includes establishing policies, assessing competencies, and planning for turnover and succession.
Define “risk response” (according to the COSO ERM model).
Management’s response to risk. Depends on management’s risk appetite. May include risk avoidance, reduction, sharing, or acceptance.
Define “event identification” (according to the COSO ERM model).
Identifying events that might affect—either positively or negatively—the organization’s ability to meet its objectives.
Define “objective setting” (according to the COSO ERM model)
A company must establish objectives at four levels (strategic, operational, reporting, and compliance).
Define “compliance objectives” (according to the COSO ERM model).
One of four organizational objectives. These are designed to ensure that the organization meets legal and regulatory requirements.
Define “reporting objectives” (according to the COSO ERM model).
One of four organizational objectives. Information system goals related to the accuracy, completeness, timeliness, and reliability of internal and external reporting.
Define “operations objectives” (according to the COSO ERM model).
One of four organizational objectives. Goals concerned with day-to-day operating activities (i.e. sales activities, warehousing, manufacturing, etc.).
Define “strategic objectives” (according to the COSO ERM model).
One of four organizational objectives. High-level goals that support the organization’s overall mission.
Define “enterprise risk management.”
According to COSO, the methods and processes used by organizations to identify and manage the events and circumstances that influence the organization’s ability of achieve its objectives.
What is meant by “the tone at the top?”
The extent to which top management is ethical and pro-active in establishing an ethical and moral tone and culture. Consider a counter-example: Kenneth Lay urged Enron employees to buy more Enron stock at the same time that he was selling millions of dollars in Enron stock options (called a “pump and dump” scheme).
According to COSO, what four critical accounting activities should be segregated?
- Authorizing, 2. recording, 3. safeguarding, 4. reconciling, oversight and auditing.
Define “risk appetite.”
According to COSO, the amount of risk exposure, or potential adverse impact from an event, that an organization chooses to accept or retain, as opposed to sharing, avoiding, reducing or eliminating the risk.
Define “cross-enterprise risk.”
A risk that occurs in multiple units in an organization. For example, a security breach that allowed unauthorized access to a system could occur at multiple sites or units within an organization. Hence, it is a “cross-enterprise” risk.
Define “key performance indicators.”
Metrics that reflect critical success factors. They help organizations measure progress towards critical goals and objectives.
