The Updated Internal Control–Integrated Framework by COSO

COSO stands for Committee of Sponsoring Organizations of the Treadway Commission, is an alternative from the private sectors to against fraud and corruption in America, 1970s. Its private sectors formed National Commission on Fraudulent Financial Reporting that also known as The Treadway Commission in 1985. The commission is sponsored by five professional association, they are AICPA, AAA, FEI, IIA and IMA. COSO purposes for doing reserach about fraud in financial reporting (on fraudulent financial reporting) and making recommendations associated with it for public companies, independent auditors, the SEC, and educational institutions.

COSO has defined internal control as a process that runs by board of directors, management, and staff, to make reasonable assurance regarding the effectiveness and efficiency operational, the realibility of financial reporting, and compliance for the laws and regulations.

According to COSO, the updated framework, internal control has eight integrated frameworks

Internal Environment: the internal environment sets foundation for how risk is viewed and addressed by entity's, including risk management philosophy, risk appetite, board of directors, integrity and ethical values, commitment to competence, organizational structures, assignment of authority and responsibility, human resource standards.

Objective Setting: objectives must exist before management can identify potential events affecting their achievement. Management has in place a process to set objectives and that the chosen objectives support and align with the entity's mission and consistent with its risk appetite. Components: strategic objectives, related objectives, selected objectives, risk appetite, and risk tolerances.

Event Identification: internal and external events affecting the achievement of an entity's objectives must be identified, distinguishing between risks and opportunities. Components: Events, influencing factors, event identifications techniques, event interdependencies, event categories, and distinguishing risk and opportunities.

Risk Assessment: Risk are analyzed, considering likelihood and impact, as a basis for determining how they should be managed. Risks are assessed on an inherent and a residual basis. Components: Inherent and residual risk, establishing likelihood and impact, data sources, assessment techniques, and event relationships.

Risk Response: Management selects risk responses—avoiding, accepting, reducing or sharing risk—developing a set of actions to align risks with the entity's risk tolerances and risk appetite. Components: Evaluating possible responses, selected responses, portfolio  view

Control Activities: Policies and procedures are established and implemented to help ensure the risk responses are effectively carried out. Components: Integration with risk response, types of control activities, policies and procedures, controls over information systems and entity specific.

Information and Communication: Relevant information is identified, captured and communicated in a form and timeframe that enable people to carry out their responsibilities. Effective communication also occurs in a broader sense, flowing down, across and up the entity. Components: Information and communication.

Monitoring: The entire process is monitored, and modifications made as necessary. Monitoring is accomplished through ongoing management activities, separate evaluations for both. Components: Ongoing monitoring activities, separate evaluations, reporting deficiencies.

References:

http://info.knowledgeleader.com/bid/163293/what-is-the-coso-enterprise-risk-management-framework (access on saturday 11th march 2017, 11 p.m.)

https://www.google.co.id/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&cad=rja&uact=8&ved=0ahUKEwjCn-64yc3SAhWIgLwKHXTHAUEQFgg0MAI&url=http%3A%2F%2Fwww.stjohns.edu%2Fsites%2Fdefault%2Ffiles%2Fdocuments%2Facademics%2Ftobin%2Fenterprise_risk_management_frameworks.pdf&usg=AFQjCNExOstMsTLYbn4X88QIe6VbLPAcaQ&sig2=797gDH3YC4NR5LQThSG6xw (access on saturday, 11th march 2017, 12 p.m.)


Auditing II / C1L014007 Laela Fitria Perdana