The document discusses COSO (Committee of Sponsoring Organizations of the Treadway Commission), an internal control framework that auditors use to assess clients' internal controls. It describes the five components of COSO - control environment, risk assessment, control activities, information and communication, and monitoring. The document also discusses how COSO fits into the audit process and provides an overview of COSO 2, which incorporates enterprise risk management.

1. COSO and Internal AuditIjaz ur Rehman Qureshi

2. Session objectives By the end of the session you will be able to Understand how COSO links to our audit approachUnderstand the dimensions of the COSO cubeList the 5 internal control componentsDescribe the key considerations within each componentHave an awareness of COSO2

3. What are the 4 stages of the ACM?ScopingUnderstandingEvaluatingValidating

4. Where does COSO fit into AuditWhen performing the understanding, evaluating and validating stages we look at our clients’ internal controls.SCOPINGVALIDATINGAUDITCOMFORTCYCLEUNDERSATANDINGEVALUATINGINTERNALCONTROLS

5. Internal Control Framework (COSO)SCOPINGVALIDATINGAUDITCOMFORTCYCLEUNDERSATANDINGEVALUATINGINTERNALCONTROLSCOSO = Framework against which we assess internal controls

6. Who or what is COSO?The Committee of Sponsoring Organizations of the Treadway CommissionVoluntary, private sector organisation originally formed in 1985Dedicated to improving the quality of financial reporting through business ethics, effective internal controls and corporate governance.

7. Five components of internal controlMonitoringInformation and CommunicationControl ActivitiesRisk AssessmentControl EnvironmentThe five components of internal control as described in the COSO framework are as follows:

8. Understanding Control Activities Policies/procedures that ensure management directives are carried out.

9. They help ensure that necessary actions are taken to address risks.

10. Control activities occur throughout the organization, at all levels and in all functions.

11. Range of activities including:Approvals, authorizations, verifications, recommendations, performance reviews, asset security and segregation of duties.

12. COSO and Control Activities Business performance reviews:

13. Top Level Reviews

14. Direct Functional or Activity Management

15. Performance Indicators

16. Information Processing

17. Application controls

18. IT general controls