Enterprise Risk Management, Internal Controls, & Business Processes (17-27%)

Question 1

What is ERM (Enterprise Risk Management)?

Answer 1

A process effected by an entity’s board of directors, management and other personnel, applied in strategy setting & across enterprise, designed to identify potential events that may affect entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding achievement of entity objectives

Question 2

What is the purpose of ERM (Enterprise Risk Management)?

Answer 2

To provide an all-encompassing framework for managing risk throughout all activities of entity

Question 3

What is COSO?

Answer 3

COSO = Committee of Sponsoring Organization

Joint initiative to combat fraud - is a framework for designing, implementing and evaluating internal control for organizations, providing enterprise risk management

Question 4

What are the 5 components of COSO ERM Model?

Answer 4

GRIPS 
1 - Governance & culture
2 - Strategy & objective-setting
3 - Performance
4 - Review & revision
5 - Information, communication, & reporting

Question 5

What are the 4 main objectives of COSO ERM Model?

Answer 5

ORCS
1 - STRATEGIC - high-level goals that align with and support the mission of entity
2 - OPERATIONS - effective and efficient use of entity’s resources
3 - REPORTING - reliable reporting
4 - COMPLIANCE - compliance with applicable laws and regulations

Question 6

What are the limitations of the COSO ERM Model?

Answer 6

SIMILAR to that of the INHERENT LIMITATIONS of an INTERNAL CONTROL system

• human judgement and human error
• cost vs. benefits
• simple errors can lead to big mistakes
• circumvention of controls or processes due to collusion
• management override

Question 7

What are the 5 Core Principles within the Governance & Culture Component in the COSO ERM Model? (G in GRIPS)

Answer 7

1 - EXERCISES BOARD RISK OVERSIGHT - of strategy and carries out governance responsibilities to support management in achieving strategy and business objectives
2 - ESTABLISHES OPERATING PROCEDURES - establishes operating structures in pursuit of strategy and business objectives
3 - DEFINES DESIRED CULTURE - defines the desired behaviors that characterize entity’s desired culture
4 - DEMONSTRATES COMMITMENT TO CORE VALUES - at all levels demonstrates a commitment to core values
5 - ATTRACTS, DEVELOPS and RETAINS CAPABLE INDIVIDUALS - committed to building human capital in alignment with strategy and business objectives

Question 8

What are the 4 Core Principles within the Strategy & Objective-Setting Component in the COSO ERM Model? (S in GRIPS)

Answer 8

1 - ANALYZES BUSINESS CONTEXT - considers potential effects of business context on risk profile
2 - DEFINES RISK APPETITE - in the context of creating, preserving, and realizing value
3 - EVALUATES ALTERNATIVE STRATEGIES - and potential impact on risk profile
4 - FORMULATES BUSINESS OBJECTIVES - considers risk while establishing business objectives at various levels that align and support strategy

Question 9

What are the 5 Core Principles within the Performance Component in the COSO ERM Model? (P in GRIPS)

Answer 9

1 - IDENTIFIES RISK - that impacts performance of strategy and business objectives
2 - ASSESSES SEVERITY OF RISK
3 - PRIORITIZES RISKS - for a basis for selecting responses to risk
4 - IMPLEMENTS RISK RESPONSES - identifies and selects
5 - DEVELOPS PORTFOLIO VIEW - develops and evaluates portfolio view of risk

Question 10

What are the 3 Core Principles within the Review & Revision Component in the COSO ERM Model? (R in GRIPS)

Answer 10

1 - ASSESSES SUBSTANTIAL CHANGES - that may substantially affect strategy and business objectives
2 - REVIEWS RISK and PERFORMANCE
3 - PURSUES IMPROVEMENT IN ENTERPRISE RISK MANAGMENT

Question 11

What are the 3 Core Principles within the Information, Communication, and Reporting Component in the COSO ERM Model? (I in GRIPS)

Answer 11

1 - LEVERAGES INFORMATION SYSTEMS and TECHNOLOGY
2 - COMMUNICATES RISK INFORMATION - through channels to support
3 - REPORTS ON RISK, CULTURE and PERFORMANCE - at multiple levels and across the entity

Question 12

What is Expected Value for the ERM (Enterprise Risk Model)?

Answer 12

Calculates the likelihood of losses and the amount of losses (most helpful metric)

Question 13

What is COSO’s definition of Internal Control?

Answer 13

A PROCESS that is affected by all members of an organization that is designed to provide REASONABLE ASSURANCE regarding the achievement of OBJECTIVES related to OPERATIONS, REPORTING and COMPLIANCE

Question 14

What are the 5 Components of Internal Control System?

Answer 14

CRIME -  
C - Control Activities (policies & procedures)
R - Risk Assessment
I - Information & Communication
M - Monitoring
E - Control Environment (tone at top)

Question 15

What are the 3 main objectives of COSO?

Answer 15

ORC (similar to 4 main objectives of COSO ERM Model - ORCS)
1 - OPERATIONS objectives - pertaining to effectiveness and efficiency, including operational and financial performance goals, and safeguarding assets against loss

2 - REPORTING objectives - pertaining to internal control and external financial and non-financial reporting which may encompass reliability, timeliness, transparency, or other terms set by regulators, standards, or entity’s policies

3 - COMPLIANCE objectives - pertaining to adherence to laws and regulations applicable to entity

Question 16

What are the 6 limitations of Internal Control identified by COSO?

Answer 16

Similar to limitations of COSO ERM Model (Similar to INHERENT LIMITATIONS of an INTERNAL CONTROL SYSTEM)

1 - human judgement can be faulty & subject to bias
2 - breakdowns & failures occur as long as humans involved, even from simple errors
3 - management override
4 - management or other personnel can get around controls through collusion
5 - external events simply beyond management’s control
6 - objectives for controls must be suitable as a precondition to internal controls - unrealistic or improbable objectives can be set that internal controls cant fully address

Question 17

What are the 3 Core Principles within the Control Activities (C) Component of the Internal Control System?

Answer 17

1 - SELECTS & DEVELOPS - RISK - ACCEPTABLE LEVELS - selects & develops control activities that contribute to mitigation of risks to the achievement of objectives to acceptable levels
2 - SELECTS & DEVELOPS - TECHNOLOGY - OBJECTIVES - selects & develops general control activities over technology to support the achievement of objectives
3 - DEPLOYS - POLICIES - deploys control activities through policies that establish what is expected and procedures that put policies into action

Question 18

What are the 4 Core Principles within the Risk Assessment (R) Component of the Internal Control System?

Answer 18

1 - SPECIFIES OBJECTIVES - ID & ASSESSMENT - specifies objectives with sufficient clarity to enable identification and assessment of risk relating to objectives
2 - IDENTIFIES RISKS - OBJECTIVES - ANALYZES - identifies risks to the achievement of its objectives across entity and analyzes risks as a basis for determining how risks should be managed
3 - CONSIDERS POTENTIAL FOR FRAUD - considers potential for fraud in assessing risks to the achievement of objectives
4 - IDENTIFIES & ASSESSES CHANGES - identifies and assesses changes that could significantly impact system of internal control

Question 19

What are the 3 Core Principles within the Information & Communication (I) Component of the Internal Control System?

Answer 19

1 - OBTAINS, GENERATES, USES - QUALITY INFO - obtains or generates and uses relevant, quality information to support the functioning of internal control
2 - COMMUNICATES WITH INTERNAL PARTIES - internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control
3 - COMMUNICATES WITH EXTERNAL PARTIES - communicates with external parties regarding matters affecting functioning of internal control

Question 20

What are the 2 Core Principles within the Monitoring (M) Component of the Internal Control System?

Answer 20

1 - SELECTS, DEVELOPS, PERFORMS EVALUATIONS - selects, develops, and performs ongoing and/or separate evaluations to ascertain whether components of internal control are present and functioning
2 - EVALUTE & COMMUNICATE DEFICIENCIES - evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate

Question 21

What are the 5 Core Principles within the Control Environment (E) Component of the Internal Control System?

Answer 21

1 - COMMITMENT - INTEGRITY & ETHICAL VALUES - demonstrates commitment to integrity and ethical values
2 - BOD - INDEPENDENCE - board of directors demonstrates independence from management and exercises oversight of development and performance of internal control
3 - ESTABLISHMENTS FOR PURSUIT OF OBJECTIVES - establishes structures, reporting lines, and appropriate authorities and responsibilities in pursuit of objectives
4 - RETAIN COMPETENT INDIVIDUALS - demonstrates commitment to attract, develop, and retain competent individuals in alignment with objectives
5 - HOLDS INDIVIDUALS ACCOUNTABLE - holds individuals accountable for their internal control responsibilities in pursuit of objectives

Question 22

What is SOX? Why was SOX passed?

Answer 22

Sarbanes-Oxley Act of 2002 - Implements regulations, many regarding responsibilities of corporate management and external auditors

Passed because of large financial scandals

Question 23

What are some of the main corporate governance provisions of SOX?

Answer 23

• public companies required to have audit committees
• must be a financial expert on audit committee
• at least 3 members on audit committee
• each member on audit committee must be independent member of BOD
• officer certifications (CEO/CFO) on all 10Q and 10K reports
• rules regarding auditors (kinds of NAS can provide-can provide tax services if approved by audit committee)
• PCAOB - created as result of SOX

Question 24

What is considered a Financial Expert for the Audit Committee requirement?

Answer 24

• understanding of GAAP and financial statements
• experience in preparing or auditing financial statements
• experience with internal auditing controls
• understanding of audit committee functions

if company does not have a ‘financial expert’, reason needs to be disclosed

Question 25

What are the functions of an accounting system?

Answer 25

- track income and expenses - provide managerial reports, financial statements, reports prepared for external users, and provide adequate information in order to file tax returns - should address specific needs of the business

Question 26

What are the functions of a financial reporting system?

Answer 26

- capture data about relevant transactions and events that occurred during the period - summarize and present this data in a format that's understandable and useful to its users, usually for external users

Question 27

What is the information flow of the financial reporting system?

Answer 27

- data is received about a transaction or event - transaction is recorded in a book of prime entry - summary totals from books of prime entry are posted to the general ledger accounts - ledger accounts summarized in a trial balance - trial balances are used to generate financial statements

Question 28

What are the categories of business process controls?

Answer 28

- PREVENTIVE controls (prevent errors before occurs) - DETECTIVE controls (detect error after occurred) - CORRECTIVE controls (reverse effects of error) - FEEDBACK controls (results evaluated and adjusted) - GENERAL controls (apply to all parts & general in nature) - APPLICATION controls (specific parts) - AUTOMATED vs. MANUAL controls (automated-built into system, manual-rely on human actions)

Question 29

What are the 3 main types of tasks that should be separated for segregation of duties?

Answer 29

CAR - 1 - Custody (Access) 2 - Authorization (Execution) 3 - Record Keeping (Accounting) or - AAA - 1 - Access (Custody) 2 - Authorization (Execution) 3 - Accounting (Record Keeping)

Question 30

What are some internal control objectives/procedures for receipt of cash?

Answer 30

- cash/checks received, posted to remittance log (listing of all cash receipts) - transaction is also posted to cash receipts journal (all months cash receipts will be posted to that months receipts in general ledger) - different EEs should open mail, do accounting, prepare deposit of checks and reconcile bank - each cash receipt should be listed immediately when mail is open (bank lockbox system is best control) - ERs will bond EEs that handle cash receipts - insures against loss from illegal acts by EEs & reduces risk of dishonesty - prevention of lapping (cash received is stolen & shortage hidden) - different EEs should be receiving cash, posting payments received to AR ledger

Question 31

What are some internal control objectives/procedures for expenses/disbursements?

Answer 31

- purchasing dept should make purchases using pre-numbered POs - receiving dept takes possession of deliveries - AP dept should handle accounting function & approve payments - only designated EEs should be able to make purchases for company - checks should require dual signatures - both receipts and disbursements bank recs should be prepared on a timely basis - all key documents should be pre-numbered and sequence should be accounted for as well - supporting documents should be stamped as cancelled as soon as they are paid

Question 32

What are some internal control objectives/procedures for payroll?

Answer 32

- process consists of EE timecards or time sheets and then payroll is prepared and record in payroll journal, then checks given to EEs & months payroll is posted to general ledger (approval of time by supervisor is best control) - HR keeps records that contain pay rates and personnel files - treasury issues/signs/distributes checks - payroll dept calculates and does the record-keeping each period

Question 33

What are the 5 Trust Service Principles under Service Organization Controls (SOC)?

Answer 33

``` SACPIP 1 - SECURITY - firewalls - intrusion detection - multi-factor authentication 2 - AVAILABILITY - performance monitoring - disaster recovery - incident handling 3 - CONFIDENTIALITY - encryption - access controls - firewalls 4 - PROCESSING INTEGRITY - quality assurance - process monitoring 5 - PRIVACY - access control - multi-factor authentication - encryption ```

Question 34

What are the 2 levels of SOC reports specified by SSAE #18?

Answer 34

Type 1 - describes systems and whether design of specified controls meet relevant trust principles Type 2 - also addresses operational effectiveness of specified controls over a period of time (usually 9-12 months)

Question 35

What are the 3 types of SOC reports?

Answer 35

SOC1 - Internal Control over Financial Reporting (ICFR) *for limited audience SOC2 - Trust Services Criteria *for limited audience SOC3 - Trust Services Criteria for General Use *for general public audience - less specific information There are also specialized SOC reports for cybersecurity and supply chain