This document discusses key concepts in governance, risk management, and internal controls including: - The role of internal auditing in evaluating risk management and governance processes - Components of enterprise risk management and the COSO framework - Types of internal controls and the responsibility of management and auditors - Governance structures and the role of internal auditing in ensuring effective governance

1. Governance, risk, and Control Knowledge Elements IyadMourtada, CIA, CMA, CFE www.OpenThinkingAcademy.com

2. Internal Auditing “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. ” The Institute of Internal Auditors

4. RiskThe possibility of an event occurring that will have an impact on the achievement of objectives. Risk is measured in terms of impact and likelihood.

7. Implemented by Operation Management

8. Evaluated by Internal Audit Activity

11. Implemented by Operation Management

12. Evaluated by Internal Audit Activity

14. Control Any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved. Management plans, organizes, and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.

15. COSO (Committee of Sponsoring Organizations)

17. Management’s philosophy and operating style.

18. Organizational structure.

19. Assignment of authority and responsibility.

20. Human resource policies and practices.

22. Reliability of financial reporting

25. Responsibility Core internal auditing roles in regard to ERM • Giving assurance on risk management processes. • Giving assurance that risks are correctly evaluated. • Evaluating risk management processes. • Evaluating the reporting of key risks. • Reviewing the management of key risks.

27. Which of the following is generally considered one of the main reasons why internal auditors evaluate the effectiveness of their company's internal control structure? To determine whether all risks and exposures of the company have been either reduced or eliminated. To determine whether the established internal controls are functioning as intended by management. To determine the extent of reliance the internal auditors can place on the controls in the process of evaluating the financial statements. To reduce the amount of detailed testing for their external auditors.

28. Which of the following is generally considered one of the main reasons why internal auditors evaluate the effectiveness of their company's internal control structure? To determine whether all risks and exposures of the company have been either reduced or eliminated. To determine whether the established internal controls are functioning as intended by management. To determine the extent of reliance the internal auditors can place on the controls in the process of evaluating the financial statements. To reduce the amount of detailed testing for their external auditors.

30. Surveys

32. Internal auditing roles in regard to Governance Improving the governance process in its accomplishment of the following objectives (IIA Standard 2130): Promoting appropriate ethics and values within the organization Ensuring effective organizational performance management and accountability Effectively communicating risk and control information to appropriate areas of the organization Effectively coordinating the activities of and communicating information among the board, external and internal auditors, and management Evaluate the design, implementation, and effectiveness of the organization’s ethics-related objectives, programs, and activities

33. Segregation of Duties

35. avoid payment or loss of services

37. Which of the following represents the best governance structure?

38. IyadMourtada, CMA, CIA, CFE, CPLP, M.A. iyad.mourtada@gmail.com http://ae.linkedin.com/in/iyadmourtada http://twitter.com/iyadmourtada http://www.youtube.com/Iyadmourtada http://www.iyadmourtada.com http://www.facebook.com/iyad.mourtada iyadmourtada www.openthinkingacademy.com