Committee of Sponsoring Organizations of the Treadway Commission

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a joint initiative of five private sector organizations, established in the United States, dedicated to providing thought leadership to executive management and governance entities on critical aspects of organizational governance, business ethics, internal control, enterprise risk management, fraud, and financial reporting. COSO has established a common internal control model against which companies and organizations may assess their control systems. COSO is supported by five supporting organizations, including the Institute of Management Accountants (IMA), the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), the Institute of Internal Auditors (IIA), and Financial Executives International (FEI).

Organizational overview

COSO was formed in 1985 to sponsor the National Commission on Fraudulent Financial Reporting (the Treadway Commission). The Treadway Commission was originally jointly sponsored and funded by five main professional accounting associations and institutes headquartered in the United States: the American Institute of Certified Public Accountants (AICPA), American Accounting Association (AAA), Financial Executives International (FEI), Institute of Internal Auditors (IIA) and the Institute of Management Accountants (IMA). The Treadway Commission recommended that the organizations sponsoring the Commission work together to develop integrated guidance on internal control. These five organizations formed what is now called the Committee of Sponsoring Organizations of the Treadway Commission.

The original chairman of the Treadway Commission was James C. Treadway, Jr., Executive Vice President and General Counsel, Paine Webber and a former Commissioner of the U.S. Securities and Exchange Commission. Hence, the popular name "Treadway Commission". Robert B. Hirth, Jr. became the newest Chairman of COSO's board on June 1, 2013.

History

Due to questionable corporate political campaign finance practices and foreign corrupt practices in the mid -1970s, the U.S. Securities and Exchange Commission (SEC) and the U.S. Congress enacted campaign finance law reforms and the 1977 Foreign Corrupt Practices Act (FCPA) which criminalized transnational bribery and required companies to implement internal control programs. In response, the Treadway Commission, a private-sector initiative, was formed in 1985 to inspect, analyze, and make recommendations on fraudulent corporate financial reporting.

The Treadway Commission studied the financial information reporting system over the period from October 1985 to September 1987 and issued a report of findings and recommendations in October 1987, Report of the National Commission on Fraudulent Financial Reporting.[1] As a result of this initial report, the Committee of Sponsoring Organizations (COSO) was formed and it retained Coopers & Lybrand, a major CPA firm, to study the issues and author a report regarding an integrated framework of internal control.

In September 1992, the four volume report entitled Internal Control— Integrated Framework[2] was released by COSO and later re-published with minor amendments in 1994. This report presented a common definition of internal control and provided a framework against which internal control systems may be assessed and improved. This report is one standard that U.S. companies use to evaluate their compliance with FCPA. According to a poll by CFO magazine released in 2006, 82% of respondents claimed they used COSO's framework for internal controls. Other frameworks used by respondents included COBIT, AS2 (Auditing Standard No. 2, PCAOB), and SAS 55/78 (AICPA).[3]

Internal Control — Integrated Framework

Key concepts of the COSO framework

The COSO framework involves several key concepts:

Definition of internal control and framework objectives

The COSO framework defines internal control as a process, effected by an entity's board of directors, management and other personnel, designed to provide "reasonable assurance" regarding the achievement of objectives in the following categories:

Five framework components

The COSO internal control framework consists of five interrelated components derived from the way management runs a business. According to COSO, these components provide an effective framework for describing and analyzing the internal control system implemented in an organization as required by financial regulations (see Securities Exchange Act of 1934,[4]) The five components are the following:

Control environment: The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, management's operating style, delegation of authority systems, as well as the processes for managing and developing people in the organization.

Risk assessment: Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives and thus risk assessment is the identification and analysis of relevant risks to the achievement of assigned objectives. Risk assessment is a prerequisite for determining how the risks should be managed.

Control activities: Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address the risks that may hinder the achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.

Information and communication: Information systems play a key role in internal control systems as they produce reports, including operational, financial and compliance-related information, that make it possible to run and control the business. In a broader sense, effective communication must ensure information flows down, across and up the organization. For example, formalized procedures exist for people to report suspected fraud. Effective communication should also be ensured with external parties, such as customers, suppliers, regulators and shareholders about related policy positions.

Monitoring: Internal control systems need to be monitored—a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities or separate evaluations. Internal control deficiencies detected through these monitoring activities should be reported upstream and corrective actions should be taken to ensure continuous improvement of the system.

Limitations

Internal control involves human action, which introduces the possibility of errors in processing or judgment. Internal control can also be overridden by collusion among employees (see separation of duties) or coercion by top management.

CFO magazine reported that companies are struggling to apply the complex model provided by COSO. "One of the biggest problems: limiting internal audits to one of the three key objectives of the framework. In the COSO model, those objectives are applied to five key components (control environment, risk assessment, control activities, information and communication, and monitoring). Given the number of possible matrices, it's not surprising that the number of audits can get out of hand.".[5] CFO magazine continued by stating that many organizations are creating their own risk-and-control matrix by taking the COSO model and altering it to focus on the components that relate directly to Section 404 of the Sarbanes-Oxley Act.

Enterprise Risk Management — Integrated Framework

In 2001, COSO initiated a project, and engaged PricewaterhouseCoopers, to develop a framework that would be readily usable by managements to evaluate and improve their organizations' enterprise risk management. High-profile business scandals and failures (e.g. Enron, Tyco International, Adelphia, Peregrine Systems and WorldCom) led to calls for enhanced corporate governance and risk management. As a result the Sarbanes-Oxley act was enacted. This law extends the long-standing requirement for public companies to maintain systems of internal control, requiring management to certify and the independent auditor to attest to the effectiveness of those systems. The Internal Control – Integrated Framework continues to serve as the broadly accepted standard for satisfying those reporting requirements; however, in 2004 COSO published Enterprise Risk Management - Integrated Framework.[6] COSO believes this framework expands on internal control, providing a more robust and extensive focus on the broader subject of enterprise risk management.

Four categories of business objectives

This enterprise risk management framework is still geared to achieving an entity's objectives; however, the framework now includes four categories:

Eight framework components

The eight components of enterprise risk management encompass the previous five components of the Internal Control-Integrated Framework while expanding the model to meet the growing demand for risk management:

Internal environment: The internal environment encompasses the tone of an organization, and sets the basis for how risk is viewed and addressed by an entity's people, including risk management philosophy and risk appetite, integrity and ethical values, and the environment in which they operate.

Objective setting: Objectives must exist before management can identify potential events affecting their achievement. Enterprise risk management ensures that management has in place a process to set objectives and that the chosen objectives support and align with the entity's mission and are consistent with its risk appetite.

Event identification: Internal and external events affecting achievement of an entity's objectives must be identified, distinguishing between risks and opportunities. Opportunities are channeled back to management's strategy or objective-setting processes.

Risk assessment: Risks are analyzed, considering likelihood and impact, as a basis for determining how they should be managed. Risks are assessed on an inherent and a residual basis.

Risk response: Management selects risk responses – avoiding, accepting, reducing, or sharing risk – developing a set of actions to align risks with the entity's risk tolerances and risk appetite.

Control activities: Policies and procedures are established and implemented to help ensure the risk responses are effectively carried out.

Information and communication: Relevant information is identified, captured, and communicated in a form and time frame that enable people to carry out their responsibilities. Effective communication also occurs in a broader sense, flowing down, across, and up the entity.

Monitoring: The entirety of enterprise risk management is monitored and modifications made as necessary. Monitoring is accomplished through ongoing management activities, separate evaluations, or both.

COSO believes the Enterprise Risk Management – Integrated Framework provides a clearly defined interrelationship between an organization's risk management components and objectives that will fill the need to meet new law, regulation, and listing standards and expects it will become widely accepted by companies and other organizations and interested parties.

Limitations

COSO admits in their report that while enterprise risk management provides important benefits, limitations exist. Enterprise risk management is dependent on human judgment and therefore susceptible to decision making. Human failures such as simple errors or mistakes can lead to inadequate responses to risk. In addition, controls can be circumvented by collusion of two or more people, and management has the ability to override enterprise risk management decisions. These limitations preclude a board and management from having absolute assurance as to achievement of the entity's objectives.

Philosophically, COSO is more oriented towards controls. Therefore, it has a bias towards risks that could have negative impact rather than the risks of missing opportunities. See ISO 31000.

Although COSO claims their expanded model provides more risk management, companies are not required to switch to the new model if they are using the Internal Control-Integrated Framework.

Internal Control over Financial Reporting — Guidance for Smaller Public Companies

This document contains guidance to help smaller public companies apply the concepts from the 1992 Internal Control – Integrated Framework. This publication show the applicability of those concepts to help smaller public companies design and implement internal controls to support the achievement of financial reporting objectives. It highlights 20 key principles of the 1992 framework, providing a principles-based approach to internal control. As explained in the publication, the 2006 guidance applies to entities of all sizes and types.[7]

Guidance on Monitoring Internal Control Systems

Companies have invested heavily in improving the quality of their internal controls; however, COSO noted that many organizations do not fully understand the importance of the monitoring component of the COSO framework and the role it plays in streamlining the assessment process. In January 2009, COSO published its Guidance on Monitoring Internal Control Systems to clarify the monitoring component of internal control.

Over time effective monitoring can lead to organizational efficiencies and reduced costs associated with public reporting on internal control because problems are identified and addressed in a proactive, rather than reactive, manner.

COSO's Monitoring Guidance builds on two fundamental principles originally established in COSO's 2006 Guidance:

The monitoring guidance further suggests that these principles are best achieved through monitoring that is based on three broad elements:

Role of internal audit

Internal auditors play an important role in evaluating the effectiveness of control systems. As an independent function reporting to the top management, internal audit is able to assess the internal control systems implemented by the organization and contribute to ongoing effectiveness. As such, internal audit often plays a significant monitoring role. In order to preserve its independence of judgment internal audit should not take any direct responsibility in designing, establishing, or maintaining the controls it is supposed to evaluate. It may only advise on potential improvement to be made.

Role of external audit

Under Section 404 of the Sarbanes-Oxley Act, management and the external auditors are required to report on the adequacy of the company's internal control over financial reporting. Auditing Standard No. 5, published by the Public Company Accounting Oversight Board, requires auditors to "use the same suitable, recognized control framework to perform his or her audit of internal control over financial reporting as management uses for its annual evaluation of the effectiveness of the company's internal control over financial reporting".[8]

Internal Control — Integrated Framework update project

In November 2010, COSO has announced a project to review and update the Internal Control — Integrated Framework to make it more relevant in the increasingly complex business environment.[9] The five framework components remain the same. A new feature in the updated framework is that the internal control concepts introduced in the original framework will now be codified into 17 principles explicitly listed among five components.[10] Changes to the framework include internal controls over technology, such as email and the Internet, that were not in widespread use when the original framework was issued in 1992.[11] Along with the updated Framework, COSO intends to publish the following documents:

See also

References

  1. ↑ http://www.coso.org/Publications/NCFFR.pdf, "Report of the National Commission on Fraudulent Financial Reporting", Retrieved March 23, 2011.
  2. ↑ http://www.coso.org/IC-IntegratedFramework-summary.htm, "Internal Control— Integrated Framework", Retrieved March 23, 2011.
  3. ↑ http://www.cfo.com/article.cfm/5598405/c_2984409/?f=archives, "The Trouble with COSO", March 15, 2006, Retrieved March 23, 2011.
  4. ↑ 17 CFR Section 240 15d-15, Retrieved March 23, 2011.
  5. ↑ http://www.cfo.com/article.cfm/5598405/2/c_5620756, CFO Magazine, Retrieved March 23, 2011.
  6. ↑ http://www.coso.org/Publications/ERM/COSO_ERM_ExecutiveSummary.pdf, "Enterprise Risk Management - Integrated Framework", Retrieved March 23, 2011.
  7. ↑ http://www.coso.org/IC.htm, Retrieved December 28, 2012.
  8. ↑ http://www.pcaobus.org/Rules/Docket_021/2007-05-24_Release_No_2007-005.pdf, (AS No. 5.5), Retrieved March 23, 2011.
  9. ↑ http://www.coso.org/documents/COSOReleaseNov2010_000.pdf, COSO Press Release, November 18, 2010.
  10. ↑ http://www.coso.org/documents/COSO%20ICIF%20Press%20Release%2012%2019%2011%20FINAL2.pdf, COSO Press Release, December 19, 2011.
  11. ↑ Tysiac, Ken (March 2012). "Internal Control, Revisited". Journal of Accountancy (American Institute of Certified Public Accountants) 213 (3): 24–29. ISSN 0021-8448.
  12. ↑ http://www.coso.org/documents/COSO%20ICIF%20Press%20Release%2009%2018%202012.pdf, COSO Press Release, September 18, 2012.

External links

This article is issued from Wikipedia - version of the Thursday, December 10, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.