WIXLIB

Internal Control–Integrated FrameworkAn IAASB OverviewSeptember 20160

Table of Contents COSO & Project Overview Internal Control-Integrated Framework Illustrative Documents– Illustrative Tools for Assessing Effectiveness of a System of Internal Control– Internal Control over External Financial Reporting: A Compendium ofApproaches and examples Transition & Impact Recommended Actions Questions1

COSO & Project Overview2

Originally formed in 1985, COSO is a joint initiative of five privatesector organizations and is dedicated to providing thought leadershipthrough the development of frameworks and guidance on enterpriserisk management (ERM) internal control and fraud deterrence.9,300386,00015,000 600,00067,000180,0003

COSO Overview – Internal Control Publications19922006200920134

Why update what works – The Framework has become themost widely adopted control framework �s Internal Control–Integrated Framework (1992 Edition)Reflect changes inExpand operations andArticulate principles tobusiness & operatingreporting objectivesfacilitate pdatesContextinternal controlBroadens ApplicationClarifies RequirementsCOSO’s Internal Control–Integrated Framework (2013 Edition)5

Project timetableAssess & SurveyStakeholdersDesign & Build20102011Public Exposure,Assess & Refine2012Finalize20136

Project participantsCOSOBoard of DirectorsPwCAuthor &Project LeaderCOSO Advisory CouncilStakeholders Over 700 stakeholders in Frameworkresponded to global survey during 2011AICPAAAAFEIIIAIMAPublic Accounting FirmsRegulatory observers (SEC, GAO, FDIC,PCAOB) Others (IFAC, ISACA, others) Over 200 stakeholders publically commentedon proposed updates to Framework duringfirst quarter of 2012 Over 50 stakeholders publically commented onproposed updates in last quarter of 20127

Project deliverable #1 – Internal Control-IntegratedFramework (2013 Edition) Consists of three volumes: Executive Summary Framework and Appendices Illustrative Tools forAssessing Effectiveness of aSystem of Internal Control Sets out: Definition of internal control Categories of objectives Components of internalcontrol Requirements foreffectiveness8

Project deliverable #2 – Internal Control over ExternalFinancial Reporting: A Compendium. Approaches and Examplesillustrate how principles areapplied in preparing financialstatements Considers changes inbusiness and operatingenvironments during past twodecades Relevant for variety of entities– public, private, not-for-profit,and government Consistent with updatedFramework9

Internal Control–Integrated Framework10

Update expected to ease use and applicationWhat is not changing.What is changing. Core definition of internal control Changes in business and operatingenvironments considered Three categories of objectives andfive components of internal control Each of the five components ofinternal control are required foreffective internal control Important role of judgment indesigning, implementing andconducting internal control, and inassessing its effectiveness Operations and reporting objectivesexpanded Fundamental concepts underlyingfive components articulated asprinciples Additional approaches andexamples relevant to operations,compliance, and non-financialreporting objectives added11

Update considers changes in business and operatingenvironmentsEnvironments changes. have driven Framework updatesExpectations for governance oversightGlobalization of markets and operationsChanges and greater complexity in businessDemands and complexities in laws, rules,regulations, and standardsExpectations for competencies andaccountabilitiesUse of, and reliance on, evolving technologiesExpectations relating to preventing anddetecting fraudCOSO Cube (2013Edition)12

Update articulates principles of effective internal controlControl EnvironmentRisk AssessmentControl ActivitiesInformation &CommunicationMonitoring Activities1.2.3.4.5.Demonstrates commitment to integrity and ethical valuesExercises oversight responsibilityEstablishes structure, authority and responsibilityDemonstrates commitment to competenceEnforces accountability6.7.8.9.Specifies suitable objectivesIdentifies and analyzes riskAssesses fraud riskIdentifies and analyzes significant change10. Selects and develops control activities11. Selects and develops general controls over technology12. Deploys through policies and procedures13. Uses relevant information14. Communicates internally15. Communicates externally16. Conducts ongoing and/or separate evaluations17. Evaluates and communicates deficiencies13

Update articulates principles of effective internal control(continued)Control Environment1. The organization demonstrates a commitment tointegrity and ethical values.2. The board of directors demonstrates independencefrom management and exercises oversight of thedevelopment and performance of internal control.3. Management establishes, with board oversight,structures, reporting lines, and appropriateauthorities and responsibilities in the pursuit ofobjectives.4. The organization demonstrates a commitment toattract, develop, and retain competent individualsin alignment with objectives.5. The organization holds individuals accountable fortheir internal control responsibilities in the pursuitof objectives.14

Update articulates principles of effective internal control(continued)Risk Assessment6. The organization specifies objectives withsufficient clarity to enable the identification andassessment of risks relating to objectives.7. The organization identifies risks to theachievement of its objectives across the entityand analyzes risks as a basis for determininghow the risks should be managed.8. The organization considers the potential forfraud in assessing risks to the achievement ofobjectives.9. The organization identifies and assesseschanges that could significantly impact thesystem of internal control.15

Update articulates principles of effective internal control(continued)Control Activities10. The organization selects and develops controlactivities that contribute to the mitigation of risksto the achievement of objectives to acceptablelevels.11. The organization selects and develops generalcontrol activities over technology to support theachievement of objectives.12. The organization deploys control activitiesthrough policies that establish what is expectedand procedures that put policies into place.16

Update articulates principles of effective internal control(continued)Information &Communication13. The organization obtains or generates and usesrelevant, quality information to support thefunctioning of other components of internalcontrol.14. The organization internally communicatesinformation, including objectives andresponsibilities for internal control, necessary tosupport the functioning of other components ofinternal control.15. The organization communicates with externalparties regarding matters affecting thefunctioning of other components of internalcontrol.17

Update articulates principles of effective internal control(continued)Monitoring Activities16. The organization selects, develops, andperforms ongoing and/or separate evaluationsto ascertain whether the components of internalcontrol are present and functioning.17. The organization evaluates and communicatesinternal control deficiencies in a timely mannerto those parties responsible for taking correctiveaction, including senior management and theboard of directors, as appropriate.18

Update clarifies requirements for effective internal control Effective internal control provides reasonable assurance regarding theachievement of objectives and requires that:– Each component and each relevant principle is present and functioning– The five components are operating together in an integrated manner Each principle is suitable to all entities; all principles are presumed relevantexcept in rare situations where management determines that a principle isnot relevant to a component (e.g., governance, technology) Components operate together when all components are present andfunctioning and internal control deficiencies aggregated across componentsdo not result in one or more major deficiencies A major deficiency represents an internal control deficiency or combinationthereof that severely reduces the likelihood that an entity can achieve itsobjectives19

Update describes important characteristics of principles, forinstance.Control Environment1. The organization demonstrates a commitment tointegrity and ethical values.Points of Focus: Sets the Tone at the Top Establishes Standards of Conduct Evaluates Adherence to Standards of Conduct Addresses Deviations in a Timely Manner Points of focus may not be suitable or relevant, and others may be identified Points of focus may facilitate designing, implementing, and conducting internalcontrol There is no requirement to separately assess whether points of focus are inplace20

Update describes the role of controls to effect principles Embedded within the internal control process are controls, which consist ofpolicies and procedures. Policies reflect management or board statements ofwhat should be done to effect control. Procedures are actions that implementpolicies. Organizations select and develop controls within each component toeffect relevant principles. The Framework does not prescribe controls to be selected, developed, anddeployed for effective internal control An organization’s selection of controls to effect relevant principles andassociated components is a function of management judgment based on factorsunique to the entity A major deficiency in a component or principle cannot be mitigated to anacceptable level by the presence and functioning of other components andprinciples However, understanding and considering how controls effect multiple principlescan provide persuasive evidence supporting management’s assessment ofwhether components and relevant principles are present and functioning21

Update describes the role of controls to effect principlesComponentPrincipleControls effectmultipleprinciplesControl Environment1. The organization demonstrates a commitment to integrity andethical values.Human Resourcesreviews allemployees’ annualconfirmations toassess whetherstandards ofconduct areunderstood andadhered to(Principle 1)Managementreviews potentialdeviations capturedthrough thewhistleblower hotline and theunderlying data andinformation(Principle 13)Internal Auditseparately evaluatesthe controlenvironment,consideringemployee behaviorsand whistleblowerhotline results andreports thereon(Principles 16 & 17)22

Summary of public exposure of proposed update Interest across geographic regions – approximately 50% of respondentsfrom North America and 50% from international regions Proposed updates to Framework released for public comments:– December 20, 2011 to March 31, 2012– September 18, 2012 to December 4, 2012 COSO sought comments from the general public on proposed updates,including whether the:– Requirements of effective internal control are clearly set forth– Roles of components, principles, and points of focus are clearly set forth– Framework remains sound, logical, and useful to management of entities ofall types and sizes Public comment letters available at www.ic.coso.org until Dec. 31, 201323