COSO Framework Components:
Using
the COSO framework, every organization may guarantee that its internal controls
are adequate. The framework's five components may be used to assess a company's
internal control systems. The components of the system are mentioned below:
1. Control Environment:
In
terms of internal control systems, COSO highlights the relevance of the
company's control environment. Culture and ethics provide the basis for
successful work in the control environment of a corporation. Management's
behavior is more important than the company's overall control environment. There
are several factors that contribute to a company's control environment,
including management style, how power is allocated, the organization of its
employees, and compliance with internal control standards. Internal controls
and procedures are more likely to be adopted by lower-level employees if
management lays more attention on this issue. It doesn't matter how well
planned your strategy may be if it isn't executed in a controlled environment.
As
an example, internal controls are in place for a company's bank transactions.
Various banking processes, such as bank reconciliations, may be used to
guarantee that the financial process runs smoothly. The company's senior
management doesn't do any bank reconciliations at all. This sets a bad
precedent for other workers, which discourages them from using the strategy in
the future.
2. Risk Assessment:
Understanding
the company's goals helps it identify and mitigate the dangers that it
confronts. Because of this, these risks may be identified and managed. The
type, purpose, and industry of a corporation are critical in establishing its
risk profile. As a result, it is vital to consider these aspects while
evaluating a company's risk. When it comes to doing a risk assessment, it's
important to look at both internal and external dangers that a firm confronts.
Internal and external elements must be considered while assessing risk. Further
investigation may be required due to the firm's limited control over external
problems. The effectiveness with which a threat can be managed has a
significant impact on the company's choice to deal with it.
For
example, a company may do a risk assessment of its operations. Inventory
management companies face a wide range of hazards, including physical damage,
obsolescence, theft, and a decrease in value.
3. Control Activities:
Control
activities are the many methods a company uses to manage its risks. Depending
on the nature of the risk, organizations may employ a variety of control
measures. Control operations include: authorizations; approvals; reviews;
security measures; verifications; reconciliations; role division; and
management. Additionally, proactive actions must be taken to ensure that
control activities align with the organization's goals and vision. It's easier
for a corporation to manage its operations if it has more effective policies in
place.
Accounts
receivable and account payable balances, as well as the division of work, are
heavily dependent on how tasks are assigned. Keeping track of inventory may be
more important than separating responsibilities. Sales and purchases in which
money is transferred for products and services are both examples of
transactions. As a result of this, each object has its own unique set of
safeguards in place.
4. Information and Communication:
Following
on from information and communication are two more COSO components. In this
context, it refers to the distribution of information about control operations
to the proper authorities or persons so that they may be executed. Employee
communication is essential to control activities, such as the control
environment. Communication breakdowns make it impossible to keep control.
Information systems quality plays an important part in this aspect of the
equation.
Management
and staff should be able to communicate with each other. In order to take advantage
of new features as soon as they become available, managers should get frequent
system updates. Including both external and internal data in this report is
essential. At different levels of management, the information accessible to
executives will differ. Channels are needed in order to make this function.
5. Monitoring:
However,
the four components listed above are not the whole list of internal controls.
So that management may set up a mechanism to assess the effectiveness of their
efforts, efforts must be put in place and reported to them. Consequently, a
thorough approach to analyzing and monitoring a company's actions is essential.
In addition, firms may use monitoring to discover and fix control flaws. Processes
must be evaluated and analyzed on a frequent basis to keep up with the rapid
pace of change. The best way to get people excited about coming to work is to
create a positive work environment. To uncover problems and inefficiencies that
might otherwise go unreported, organizations need to continually monitor their
operations. They may benefit from this.
Physical
inventory controls must be routinely inspected by management to ensure that
they are working properly. The earliest feasible time must be given to the
correction of any inefficiencies discovered. Management must ensure that all
internal control systems are aligned with the company's goals in the same way.
Role
of an IT Auditor:
Information
technology (IT) auditors are responsible for safeguarding a company's internal
controls and data. It is their job to find and fix security holes in a network
and devise new ways to keep attackers out. IT auditor remediation strategies
should be put in place for the IT controls that are being analyzed for their
design and operational effectiveness. To keep the network safe and secure, fix
any issues. There must be a quick fix for any security weaknesses in systems
and networks. IT auditor use appropriate security measures to protect data,
systems, and networks. IT auditor involves as much as can in the change
management process. Prepare countermeasures for a variety of network and system
attacks. Ensure that IT audit methods are efficient and effective. In order for
employees to understand complex technological challenges, they must be
communicated in a way that is understandable to them. Maintain a regular
auditing program and provide suggestions for improvement. Take a look at the
program's controls and play about with them.
Concerns about security and control need to be addressed. IT auditor Begin
to familiarize with business and information technology processes.
An
IT auditor is responsible for ensuring that the IT infrastructure is secure and
compliant. Compliance with the company's auditing criteria is critical for
auditors working on IT projects. Every service that depends on an
organization's IT infrastructure is subject to an audit. Because of the
potential for wide-ranging ramifications, a good approach for managing
technology risk is essential. Internal and external IT audits are critical to a
company's data and system security. An information security audit may also be
used to evaluate a company's practices and risk management (IS audit). When
assessing the integrity and security of IT systems, an IT audit is often utilized.
Suggestions
for COSO Framework:
After
going through the COSO framework, senior management and key decision-makers
should utilize it to analyze their present internal control system and make
improvements. As a matter of course, the system must function as designed.
Using the COSO framework, if it doesn't already, design a plan to improve it
The COSO framework should be familiar to employees at all levels of the organization.
Based on the information in the paper, make suggestions to the company's upper
management. By bringing together personnel from all levels of the organization,
an internal control system may be reinforced. Employees must also assume
responsibility in order to prevent fraud. COSO is a good guideline for all of
endeavors. There must be a strict adherence to anti-fraud procedures and
frequent reporting.
References:
D'Aquila. (2017). COSO's Internal Control--Integrated
Framework: updating the original concepts for today's environment. The
CPA Journal (1975), 83(10), 22.
Jill M D'Aquila, & Robert Houmes. (2019). COSO's Updated Internal Control and Enterprise Risk Management
Frameworks. The CPA Journal (1975), 84(5), 54.
Lindgreen. (2016). From IT Auditor to Data Scientist. EDPACS, 53(3),
1–4. https://doi.org/10.1080/07366981.2016.1148965
Moeller, Robert R. (2017).
COSO Internal Control Components: Control Environment. In Executive's
Guide to COSO Internal Controls (pp. 41–57). John Wiley & Sons,
Inc. https://doi.org/10.1002/9781118691656.ch4
No comments:
Post a Comment