acct427 ch. 7 internal control frameworks

foreign corrupt practices act (fcpa)

- first piece of regulation that required US companies to maintain good systems of internal control (1970s)

- did not require audits of control

SOX

new rules for mgmt of publicly traded companies

- mgmt responsible for establishing/maintaining adequate control system over financial reporting

- auditors are told about all material internal control weaknesses and fraud

SOX created new external auditing rules

- audit partners must rotate periodically

- prohibited from performing certain non-audit services

SOX new rules for audit committees

- still part of board of directors with new independence rules

- one member must be financial expert

- oversees external auditors

SOX created the PCAOB

entity that oversees the external auditing profession

- process, review, and approve the the registration of public accounting firms that audit public co.'s

- inspect/review selected audit engagements of registered accounting firms

- establish auditing, quality control, and independence standards for audit issuers

board of directors

- elected; can be internal employees

- determines corporate structure, strategy, high-level goals

- supports control environment COSO

audit committee

- members are external to co.

- oversees external/internal auditors

- subcommittee of BoD

- supports monitoring and control environment COSO

external auditors

- external firm to perform audit of financials; must be independent

- for public companies, the audit will include an opinion on internal controls

- reports findings to audit committee & issues opinion to requested parties

- supports monitoring COSO

internal auditors

- department staffed with the co.'s employees

- variety of audits are performed, may include internal controls

- reports findings to audit committee

- supports monitoring COSO

board of directors has a subcommittee of:

audit committee

board of directors signs off on

find stmts and effective controls

external auditors issues opinion on:

- find stmt accuracy

- effectiveness of internal controls

audit committee hires:

external auditors

external and internal auditors report to:

audit committee

COSO

Committee of Sponsoring Organizations

- represents volunteers from other professional organizations like the AICPA

SOX requires that co.'s structure their controls using either one of the frameworks drafted by COSO:

1. enterprise risk management (ERM)

2. internal control integrated framework (IC)

ERM framework

BROADER focus on strategic planning, setting the level of risk the co. is willing to accept overall

- recently revamped in 2017

- majority of public companies report that they follow IC while many likely reference/adopt ERM too (don't report in 10-k)

IC framework

MORE NARROW view of internal controls (focused primarily on SOX compliance)

- most public co.'s follow IC

- model follows a 5-part cube structure

- if 5 components aren't addressed, co.'s CAN'T put in 10-k that they have strong internal controls

control environment

how does mgmt show proper "tone at the top"

*this can be demonstrated by:

- establishing BoD & independent audit comittee

- communications from upper mgmt to employees emphasizing integrity, ethical values, and competence

- contemplating an organizational structure, assigning authority & responsibility, and communicating structure to employees

- HR activities

what evidence could auditors gather to confirm proper tone at the top?

core values messaging, written code of conduct, existence of an ethics/whistleblower hotline

risk assessment

"what-if" scenario

- event identification

- risk assessment

- risk response

event identification

annually identify good and bad events that will impact company goals

risk assessment

'bad' events are known as risks; co.'s should categorize these as high/medium/low risk

- impact

- likelihood

risk assessment: impact

how much damage would this cost

risk assessment: likelihood

how often might this happen

risk response

cost/benefit analysis should be performed to determine the extent of controls needed to address risks

- inherent risk

- residual risk

- cost of control

inherent risk

cost potential if the risk is not controlled

residual risk

remaining risk after controls are put in place

cost of control

payroll/time, IT/technology, documentation, etc. costs that go along with implementing a control

controls should be added when cost to implement is

less than inherent risk

how coulda. co. prove that they have assessed risks each year?

risk assessment matrix

strategic risks

External

change in laws/regulations

- competition

- change in market dynamics

- industry

- technology

Internal

- reputation

- strategic focus

- customer satisfaction

- governance

compliance risks

External

-contractual

-regulatory

-litigation

-permits

Internal

-ethics

-policies

-fraud & illegal acts

reporting risks

External

- accounting and financial reporting

- taxation.

Internal

- budgeting

- performance measures

- internal control and regulatory reporting

Information Resources

- access

- availability

- data integrity

- infrastructure

- privacy

operations risks

- process

- people

- financial

control activities

when determined to be appropriate and cost effective in the risk assessment, internal controls are established and communicated to risk owners

- automated or manual

- preventative or detective

- multiple controls for each risk (higher risks = more controls)

information and communication

mgmt should use a system that gathers/processes/stores information accurately and communicates it on command

- AIS

monitoring

- the 4 above components should be monitored by the company to ensure they are in place

- deficiencies found in any component are communicated by auditors to the audit committee

top of the cube

1. operations

- day to day decisions

- efficiency

2. reporting

- sox

3. compliance (any laws not SOX)

- OSHA

- IRS

- HIPAA

- PCI

control environment: how do organizations ensure a strong control environment?

hiring executives with integrity

risk assessment: how do organizations know their risks and prioritize their risks?

risk assessment

control activities: brainstorm and operational, reporting, and compliance related control?

look at residual risk

info & comm: how do organizations track information and communicate it?

co. uses AIS

monitoring: how do organizations monitor that the above 4 boxes are being done?

internal audit