This document provides templates and scenarios to help management assess the effectiveness of a system of internal control based on the COSO Internal Control-Integrated Framework. The templates can be used to evaluate whether the five components of internal control and relevant principles are present and functioning, and whether the components are operating together in an integrated manner. The scenarios illustrate how the templates can support an assessment. The templates focus on evaluating components and principles, not underlying control activities. They present a summary of the assessment and are not intended to satisfy regulatory requirements. Management can modify the templates to reflect their entity's facts, objectives, and assessment processes.
In 2013, COSO released their update to the COSO 1992 framework. This framework is used widely by public companies for SEC compliance. After working on updating their compliance efforts, many users are having discussions with their financial auditors about the use of the new standard.
This presentation looks at the needs of the auditor in understanding internal control and its documentation.
Audit of Internal Financial Control over Financial Reporting (IFCR) A complet...Taufir Alam
Introduction to the Presentation on internal financial control over financial reporting_a complete guide
The Companies Act, 2013 has introduced some new requirements relating to audits and reporting by the statutory auditors of companies.
One of these requirements is given under Section 143(3)(i) of the Act which requires the statutory auditor to state in his audit report whether the company has adequate internal financial controls system in place and the operating effectiveness of such controls.
The section has cast onerous responsibilities on the statutory auditors because reporting on internal financial controls is not covered under the Standards on Auditing issued by the ICAI.
Since the concept of reporting on internal financial controls is still new in India this new reporting requirement has thrown up many challenges for the members.
To help the members properly understand and perform the various aspects of this reporting responsibility, the Auditing and Assurance Standards Board of the Institute of Chartered Accountants of India has brought out this Guidance Note on Audit of Internal Financial Controls Over Financial Reporting.
The Guidance Note covers aspects such as Scope of reporting on internal financial controls under Companies Act 2013, essential components of internal controls, Technical guidance on the audit of Internal Financial Controls, Implementation guidance on the audit of Internal Financial Controls.
I have presented the above guidance note into a presentation that will have a complete guide for those who are planning to go for Audit of Internal financial control over financial reporting. this presentation will cover all the relevant aspects and also provide the standard operation process for the efficient conduct of the IFCR Audit. You don't need to read the complete Guidance note.
In 2013, COSO released their update to the COSO 1992 framework. This framework is used widely by public companies for SEC compliance. After working on updating their compliance efforts, many users are having discussions with their financial auditors about the use of the new standard.
This presentation looks at the needs of the auditor in understanding internal control and its documentation.
Audit of Internal Financial Control over Financial Reporting (IFCR) A complet...Taufir Alam
Introduction to the Presentation on internal financial control over financial reporting_a complete guide
The Companies Act, 2013 has introduced some new requirements relating to audits and reporting by the statutory auditors of companies.
One of these requirements is given under Section 143(3)(i) of the Act which requires the statutory auditor to state in his audit report whether the company has adequate internal financial controls system in place and the operating effectiveness of such controls.
The section has cast onerous responsibilities on the statutory auditors because reporting on internal financial controls is not covered under the Standards on Auditing issued by the ICAI.
Since the concept of reporting on internal financial controls is still new in India this new reporting requirement has thrown up many challenges for the members.
To help the members properly understand and perform the various aspects of this reporting responsibility, the Auditing and Assurance Standards Board of the Institute of Chartered Accountants of India has brought out this Guidance Note on Audit of Internal Financial Controls Over Financial Reporting.
The Guidance Note covers aspects such as Scope of reporting on internal financial controls under Companies Act 2013, essential components of internal controls, Technical guidance on the audit of Internal Financial Controls, Implementation guidance on the audit of Internal Financial Controls.
I have presented the above guidance note into a presentation that will have a complete guide for those who are planning to go for Audit of Internal financial control over financial reporting. this presentation will cover all the relevant aspects and also provide the standard operation process for the efficient conduct of the IFCR Audit. You don't need to read the complete Guidance note.
Internal Audit is a tool of control to measure and evaluate the effectiveness of the working of an organization primarily with accounting, financial and operational matters.
Internal Audit plays a constructive role by rendering service to the management with objective appraisal of systems, procedures, practices, compliance with policies.
LetzConsult presents a smarter ways for companies to find the most relevant Consultant for their business needs. Find the right consultants for your Company on LetzConsult.com
What is the purpose of internal auditing? How important is it to the business? How are internal audits planned and carried out? These slides show the relevance of internal audit to the business, how internal audits relate to the objectives and risks of the business, how they are planned and the work involved in an internal audit. Further advice is available from www.internalaudit.biz
Resume : "Internal audit quality : developing a quality assurance and improve...asvary asvary
This book will assist chief audit executives and internal auditors to develop a quality assurance and improvement program and embed processes that enhance the quality of their internal audit function. The book looks at what constitutes quality, and how a greater understanding of quality drivers can lead to more valuable internal audit practices. Most internal auditors understand quality and performance. Good internal audit practice benchmarks organizational areas and activities against commonly accepted criteria. This book provides similar criteria for internal audit functions to benchmark themselves against
Internal Audit is a tool of control to measure and evaluate the effectiveness of the working of an organization primarily with accounting, financial and operational matters.
Internal Audit plays a constructive role by rendering service to the management with objective appraisal of systems, procedures, practices, compliance with policies.
LetzConsult presents a smarter ways for companies to find the most relevant Consultant for their business needs. Find the right consultants for your Company on LetzConsult.com
What is the purpose of internal auditing? How important is it to the business? How are internal audits planned and carried out? These slides show the relevance of internal audit to the business, how internal audits relate to the objectives and risks of the business, how they are planned and the work involved in an internal audit. Further advice is available from www.internalaudit.biz
Resume : "Internal audit quality : developing a quality assurance and improve...asvary asvary
This book will assist chief audit executives and internal auditors to develop a quality assurance and improvement program and embed processes that enhance the quality of their internal audit function. The book looks at what constitutes quality, and how a greater understanding of quality drivers can lead to more valuable internal audit practices. Most internal auditors understand quality and performance. Good internal audit practice benchmarks organizational areas and activities against commonly accepted criteria. This book provides similar criteria for internal audit functions to benchmark themselves against
- Observations on new commercial lending activity in the market and regulatory concerns
- Industry Events and Important releases to be mindful of
- CEIS Spotlight on Mr. Christopher “Kit” Webbe, Structured Finance & International Specialist
- Ms. Liz Williams answers Common Questions about the “ALLL – Important” ALLL Validation
http://www.ceisreview.com/the-ceis-quarterly-newsletter-volume-2-issue-1/
Project Charter template (contains Scope Section) project nameExe.docxstilliegeorgiana
Project Charter template (contains Scope Section): project name:Executive Summary
Where did this project come from?
Why is it being done?
What impact will the project create (internally, externally)?
What strategic plan does it contribute to?
What does the customer receive/not receive by project end?
What key assumptions are driving this project?
What risks could challenge project success?Goals
What business/organization goal(s) does this project support?
What business need is being satisfied by this project?Objectives
What, specifically, needs to be done to meet project/customer requirements/expectations/goal?
What is the target of the project?
Note: Ensure each objective contributes to the goal. Check to satisfy the "SMART" criteriaScope:
What does the work of the project to meet goal include/not include?Work IncludesWork does not IncludePhases ⁄ Deliverables:
What are the major components of work to meet the goals/objectives/scope?
What are the customer, process, and project deliverables within each phase?
Phase
Description of Phase
Deliverables
Internal
External
Assumptions:
What unknowns are being made known in this project?
What uncertainties are considered true, real, or certain for planning purposes?
What trial balloons are being floated to verify information?
Assumption
Rationale
Probability of Assumption being True
Impact to Project if Assumption is not True
Risks:
What events could jeopardize this project's success?
Risk
Supporting Detail (Analysis to be continued in Risk Management Plan/ Register)
Constraints:
What is restricting this project?
What standards, regulations, technologies, resource availability impact this project?
Constraint
Supporting Detail
Initial Project SizingBudget:
What are the estimated costs to complete this project (document variability, range, precision at this point)
What is the financial justification for this project?
(i.e. Benefit Cost Analysis, Return on Investment, NPV . . .)
What financial gains are there to doing/not doing this project?High Level Schedule:
When are the phases/deliverables planned to begin/end?
Phase/Deliverable
Time
Milestones:
What major points are important to communicate/measure against?
When should/will they occur?Resource Requirements:
What specialized resources are necessary to complete this project?
Team Member
Role
Responsibility
Sponsor
Project Manager
Management Approaches:
How will status be taken?
How will project be communicated?
How will change be managed?
How will issues be escalated?
How will the risk be managed?
Communication Type
Stakeholders
Frequency
Agenda/ Content
Responsible
Distribution Media
Note: These may be separate plans within the context of the integrated project planSign-offs/Reviews:
At what points will management/customer/team/peer reviews be conducted? For what ...
The role of audit committees continues to expand to keep pace with the modern business operating environment. In addition to responsibility for a company’s financial reporting and management, audit committees increasingly take an active role in an organization’s risk management strategy.
Audit committees can be instrumental in helping their organizations implement procedures to address the challenges they face. They can also assist with addressing internal and external audit findings or with exploring best practices for addressing areas of operations that may be vulnerable to disruption or extraordinary risks.
The world of search engine optimization (SEO) is buzzing with discussions after Google confirmed that around 2,500 leaked internal documents related to its Search feature are indeed authentic. The revelation has sparked significant concerns within the SEO community. The leaked documents were initially reported by SEO experts Rand Fishkin and Mike King, igniting widespread analysis and discourse. For More Info:- https://news.arihantwebtech.com/search-disrupted-googles-leaked-documents-rock-the-seo-world/
What are the main advantages of using HR recruiter services.pdfHumanResourceDimensi1
HR recruiter services offer top talents to companies according to their specific needs. They handle all recruitment tasks from job posting to onboarding and help companies concentrate on their business growth. With their expertise and years of experience, they streamline the hiring process and save time and resources for the company.
Business Valuation Principles for EntrepreneursBen Wann
This insightful presentation is designed to equip entrepreneurs with the essential knowledge and tools needed to accurately value their businesses. Understanding business valuation is crucial for making informed decisions, whether you're seeking investment, planning to sell, or simply want to gauge your company's worth.
What is the TDS Return Filing Due Date for FY 2024-25.pdfseoforlegalpillers
It is crucial for the taxpayers to understand about the TDS Return Filing Due Date, so that they can fulfill your TDS obligations efficiently. Taxpayers can avoid penalties by sticking to the deadlines and by accurate filing of TDS. Timely filing of TDS will make sure about the availability of tax credits. You can also seek the professional guidance of experts like Legal Pillers for timely filing of the TDS Return.
Falcon stands out as a top-tier P2P Invoice Discounting platform in India, bridging esteemed blue-chip companies and eager investors. Our goal is to transform the investment landscape in India by establishing a comprehensive destination for borrowers and investors with diverse profiles and needs, all while minimizing risk. What sets Falcon apart is the elimination of intermediaries such as commercial banks and depository institutions, allowing investors to enjoy higher yields.
Putting the SPARK into Virtual Training.pptxCynthia Clay
This 60-minute webinar, sponsored by Adobe, was delivered for the Training Mag Network. It explored the five elements of SPARK: Storytelling, Purpose, Action, Relationships, and Kudos. Knowing how to tell a well-structured story is key to building long-term memory. Stating a clear purpose that doesn't take away from the discovery learning process is critical. Ensuring that people move from theory to practical application is imperative. Creating strong social learning is the key to commitment and engagement. Validating and affirming participants' comments is the way to create a positive learning environment.
Enterprise Excellence is Inclusive Excellence.pdfKaiNexus
Enterprise excellence and inclusive excellence are closely linked, and real-world challenges have shown that both are essential to the success of any organization. To achieve enterprise excellence, organizations must focus on improving their operations and processes while creating an inclusive environment that engages everyone. In this interactive session, the facilitator will highlight commonly established business practices and how they limit our ability to engage everyone every day. More importantly, though, participants will likely gain increased awareness of what we can do differently to maximize enterprise excellence through deliberate inclusion.
What is Enterprise Excellence?
Enterprise Excellence is a holistic approach that's aimed at achieving world-class performance across all aspects of the organization.
What might I learn?
A way to engage all in creating Inclusive Excellence. Lessons from the US military and their parallels to the story of Harry Potter. How belt systems and CI teams can destroy inclusive practices. How leadership language invites people to the party. There are three things leaders can do to engage everyone every day: maximizing psychological safety to create environments where folks learn, contribute, and challenge the status quo.
Who might benefit? Anyone and everyone leading folks from the shop floor to top floor.
Dr. William Harvey is a seasoned Operations Leader with extensive experience in chemical processing, manufacturing, and operations management. At Michelman, he currently oversees multiple sites, leading teams in strategic planning and coaching/practicing continuous improvement. William is set to start his eighth year of teaching at the University of Cincinnati where he teaches marketing, finance, and management. William holds various certifications in change management, quality, leadership, operational excellence, team building, and DiSC, among others.
Premium MEAN Stack Development Solutions for Modern BusinessesSynapseIndia
Stay ahead of the curve with our premium MEAN Stack Development Solutions. Our expert developers utilize MongoDB, Express.js, AngularJS, and Node.js to create modern and responsive web applications. Trust us for cutting-edge solutions that drive your business growth and success.
Know more: https://www.synapseindia.com/technology/mean-stack-development-company.html
Taurus Zodiac Sign_ Personality Traits and Sign Dates.pptxmy Pandit
Explore the world of the Taurus zodiac sign. Learn about their stability, determination, and appreciation for beauty. Discover how Taureans' grounded nature and hardworking mindset define their unique personality.
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...PaulBryant58
This article provides a comprehensive guide on how to
effectively manage the convert Accpac to QuickBooks , with a particular focus on utilizing online accounting services to streamline the process.
Discover the innovative and creative projects that highlight my journey throu...dylandmeas
Discover the innovative and creative projects that highlight my journey through Full Sail University. Below, you’ll find a collection of my work showcasing my skills and expertise in digital marketing, event planning, and media production.
[Note: This is a partial preview. To download this presentation, visit:
https://www.oeconsulting.com.sg/training-presentations]
Sustainability has become an increasingly critical topic as the world recognizes the need to protect our planet and its resources for future generations. Sustainability means meeting our current needs without compromising the ability of future generations to meet theirs. It involves long-term planning and consideration of the consequences of our actions. The goal is to create strategies that ensure the long-term viability of People, Planet, and Profit.
Leading companies such as Nike, Toyota, and Siemens are prioritizing sustainable innovation in their business models, setting an example for others to follow. In this Sustainability training presentation, you will learn key concepts, principles, and practices of sustainability applicable across industries. This training aims to create awareness and educate employees, senior executives, consultants, and other key stakeholders, including investors, policymakers, and supply chain partners, on the importance and implementation of sustainability.
LEARNING OBJECTIVES
1. Develop a comprehensive understanding of the fundamental principles and concepts that form the foundation of sustainability within corporate environments.
2. Explore the sustainability implementation model, focusing on effective measures and reporting strategies to track and communicate sustainability efforts.
3. Identify and define best practices and critical success factors essential for achieving sustainability goals within organizations.
CONTENTS
1. Introduction and Key Concepts of Sustainability
2. Principles and Practices of Sustainability
3. Measures and Reporting in Sustainability
4. Sustainability Implementation & Best Practices
To download the complete presentation, visit: https://www.oeconsulting.com.sg/training-presentations
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...BBPMedia1
Grote partijen zijn al een tijdje onderweg met retail media. Ondertussen worden in dit domein ook de kansen zichtbaar voor andere spelers in de markt. Maar met die kansen ontstaan ook vragen: Zelf retail media worden of erop adverteren? In welke fase van de funnel past het en hoe integreer je het in een mediaplan? Wat is nu precies het verschil met marketplaces en Programmatic ads? In dit half uur beslechten we de dilemma's en krijg je antwoorden op wanneer het voor jou tijd is om de volgende stap te zetten.
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
Coso illustrative tool
1. C o m m i t t e e o f S p o n s o r i n g O r g a n i z a t i o n s o f t h e T r e a d w a y C o m m i s s i o n
September 2012
Illustrative Tools for Assessing Effectiveness
of a System of Internal Control
Internal Control—Integrated Framework
Committee of Sponsoring Organizations of the Treadway Commission
Exposure Period Version
3. C o m m i t t e e o f S p o n s o r i n g O r g a n i z a t i o n s o f t h e T r e a d w a y C o m m i s s i o n
September 2012
Illustrative Tools for Assessing Effectiveness
of a System of Internal Control
Internal Control—Integrated Framework
Committee of Sponsoring Organizations of the Treadway Commission
Exposure Period Version
4. Exposure Period Version
Committee of Sponsoring Organizations of
the Treadway Commission
Board Members Representative
COSO Chair David L. Landsittel
American Accounting Association Mark S. Beasley
Douglas F. Prawitt
The Institute of Internal Auditors Richard F. Chambers
American Institute of Certified Public Accountants Charles E. Landes
Financial Executives International Marie N. Hollein
Institute of Management Accountants Sandra Rictermeyer
Jeffrey C. Thomson
PwC
Author
Principal Contributors
Miles E.A. Everson Engagement Leader New York, USA
Stephen E. Soske Project Lead Partner Boston, USA
Jay A. Posklensky Project Lead Director Florham Park, USA
Cara M. Beston Partner San Jose, USA
Charles E. Harris Partner Florham Park, USA
J. Aaron Garcia Director San Diego, USA
Subhojit Goswami Director New York, USA
Keith Handler Director Florham Park, USA
Catherine I. Jourdan Director Paris, France
Frank J. Martens Director Vancouver, Canada
Sallie Jo Perraglia Manager New York, USA
5. Exposure Period Version
Advisory Council
Sponsoring Organizations Representatives
Audrey A. Gramling Bellarmine University Fr. Raymond J. Treece
Endowed Chair
Steven E. Jameson Community Trust Bank Executive Vice President and
Chief Internal Audit Risk
Officer
J. Stephen McNally Campbell Soup Company Finance Director/Controller
Ray Purcell Pfizer Director of Financial Controls
Bill Schneider ATT Director of Accounting
Members at Large
Jennifer Burns Deloitte Partner
Jim DeLoach Protiviti Managing Director
Trent Gazzaway Grant Thornton Partner
Cees Klumper The Global Fund to Fight AIDS,
Tuberculosis and Malaria
Chief Risk Officer
Thomas Montminy PwC Partner
Al Paulus EY Partner
Thomas Ray KPMG Partner
Dr. Larry E. Rittenberg University of Wisconsin Emeritus Professor of
Accounting
Chair Emeritus COSO
Ken Vander Wal ISACA President
6. Exposure Period Version
Advisory Council (cont.)
Regulatory Observers and Other Observers
James Dalkin Government Accountability
Office
Director in the Financial
Management and Assurance
Team
Harrison E. Greene, Jr. Federal Deposit Insurance
Corporation
Assistant Chief Accuntant
Christian Peo Securities and Exchange
Commission
Professional Accounting Fellow
(Through June 2012)
Amy Steele Securities and Exchange
Commission
Associate Chief Accountant
(Commencing July 2012)
Vincent Tophoff International Federation
of Accountants
Senior Technical Manager
Keith Wilson Public Company Accounting
Oversight Board
Deputy Chief Auditor
Additional PwC Contributors
Junya Hakoda Partner (Retired) Tokyo, Japan
Alan Martin Partner Frankfurt, Germany
Eric M. Bloesch Managing Director Philadelphia, USA
James M. Downs Director San Francisco, USA
(Through January 2012)
Christopher Michaelson Director Minneapolis, USA
7. Exposure Period Version
Preface
This project was commissioned by COSO, which is dedicated to providing thought lead-
ership through the development of comprehensive frameworks and guidance on internal
control, enterprise risk management, and fraud deterrence designed to improve organ-
izational performance and oversight and to reduce the extent of fraud in organizations.
COSO is a private sector initiative, jointly sponsored and funded by:
•• American Accounting Association (AAA)
•• American Institute of Certified Public Accountants (AICPA)
•• Financial Executives International (FEI)
•• Institute of Management Accountants (IMA)
•• The Institute of Internal Auditors (IIA)
9. Table of Contents
Introduction...................................................................................................... 1
Templates
1. Overall Assessment of Internal Control Template..................................... 8
2. Component Evaluation Template ............................................................. 9
3. Principle Evaluation Templates.................................................................21
4. Summary of Deficiencies Template......................................................... 60
Scenarios
5. Scenario A: Is a Principle and Component
Present and Functioning?........................................................................ 62
6. Scenario B: Are the Five Components Present, Functioning
and Operating Together in an Integrated Manner?................................. 84
7. Scenario C: How Does a Material Weakness in a Control Activity
Impact Principles, Components, and Internal control?..........................105
8. Scenario D: Are the Principles and Components Present and
Functioning in a Division, Operating Unit, or Function?.........................115
9. Scenario E: How are the Assessments of
Multiple Locations Combined?..............................................................132
11. Exposure Period Version
Introduction
Introduction
This publication, Internal Control—Integrated Framework: Illustrative Tools for Assess-
ing Effectiveness of a System of Internal Control (Illustrative Tools), is intended to assist
management of entities using the COSO Internal Control—Integrated Framework:
Framework and Appendices (Framework and Appendices) when assessing effective-
ness of a system of internal control based on the requirements set forth in the Frame-
work. More specifically, Illustrative Tools can help management assess whether:
•• Each of the five components and relevant principles are present and function-
ing; and
•• The five components are operating together in an integrated manner.
For complete details, please refer to the Framework and Appendices, especially
Chapter 3, Effective Internal Control, when using Illustrative Tools.
This publication is organized into sections: Introduction, Templates and Scenarios:
•• The templates can be used to assess the effectiveness of a system of internal
control and to document such assessment.
•• The scenarios illustrate how the templates can be used to support an assess-
ment of effectiveness of a system of internal control.
The templates and scenarios focus on evaluating components and relevant principles,
not the underlying controls (e.g., transaction-level control activities) that effect princi-
ples. These tools are not designed with the intent to satisfy any regulatory, jurisdictional,
or standard-setting requirements for evaluating the severity of internal control defi-
ciencies associated with a particular objective, such as external financial reporting. As
noted in the Framework, regulators, standard-setting bodies, and other relevant third
parties may establish criteria for evaluating the severity and corresponding classification
and reporting of deficiencies relating to external reporting objectives, operations, and
compliance objectives.
Templates
The templates included here are designed to present only a summary of the assess-
ment results. They are not an integral part of the Framework, and they may not address
all matters that need to be considered in assessing a system of internal control for a
specified objective. Further, they do not represent a preferred method of conducting
and documenting an assessment. Their purpose is limited to illustrating one possible
assessment process based on the requirements set forth in the Framework. Accord-
ingly, the templates do not illustrate management’s selection of controls to effect prin-
ciples or the determination of scope, nature, timing, and extent of testing such controls
embedded within each component. The facts and circumstances relevant to an assess-
ment will vary among different categories of objectives and among different entities and
industries; therefore, the practical adoption and use of these tools will also vary.
Internal Control — Integrated Framework • September 2012 1
1
2
3
4
12. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Form and Use
As the Framework applies to any type of entity, including large and small public, private,
governmental and not-for-profit, so do the templates presented in this publication.
Management planning to use these templates can modify them to reflect the facts (e.g.,
specified objectives and sub-objectives, scope of application, organizational structure)
and assessment processes for their entity. For example,
•• An entity with a complex organizational structure can modify or supple-
ment the templates appropriately, as illustrated in Scenario E: “How are The
Assessments of Multiple Locations Combined?”.
•• A smaller entity can simplify the templates to reflect a less complex organiza-
tional structure and to acknowledge a less-formal, less-structured system of
internal control; for instance a system that reflects more direct and continuous
communications about internal control among the CEO, senior managers, and
other personnel.
•• An entity may use technology to maintain a consolidated summary of defi-
ciencies that is referenced by all the templates rather than having summaries
included in each template.
Organizations may leverage the templates to develop or configure automated solu-
tions to support their separate and/or ongoing evaluations and overall assessment
process. Automated solutions can provide relevant information through system-gen-
erated reports and dashboards, which in turn may be used by various stakeholders
such as the board of directors1
, management, auditors, owners, and control and
compliance management. Management would consider the outputs of the automated
solutions to support its overall assessment of a system of internal control, but man-
agement would generally exercise judgment about its overall assessment outside of its
automated solution.
An organization can customize the level and amount of detail included in the templates,
as they may deem necessary. For example, consider Principle 2 within the Control
Environment, Exercises Oversight Responsibility. The controls that effect this principle
likely occur at the entity level, and management may determine that the documenta-
tion relating to these controls may not need to be extensive to support the evaluation.
Accordingly, in this example, these templates can be used to fully document and assess
whether this principle is present and functioning. In contrast, controls to effect Principle
10 within Control Activities, Selects and Develops Control Activities, are likely deployed
throughout the organization and, accordingly, the documentation relating to these
controls would be expected to be more extensive and detailed. Documentation of man-
agement’s evaluation of whether this principle is present and functioning would likely
require additional templates, such as detailed risk and control matrices, not set forth in
Illustrative Tools.
1 As in the Framework, this publication uses the term “board of directors,” which encompasses the govern-
ing body, including board, board of trustees, general partners, owner, or supervisory board.
Internal Control — Integrated Framework • September 20122
5
6
7
13. Exposure Period Version
Introduction
In summary, management may use these templates in several important ways:
•• To support the assessment of whether all five components of a system of
internal control are operating together in an integrated manner.
•• To support the determination of whether components and relevant principles
are present and functioning.
•• To support the assessment of whether the system of internal control is effec-
tive relating to one category of objectives, such as reporting, or more than
one category.
•• To document management’s overall assessment relating to the effectiveness
of a system of internal control at the entity and subunit levels, considering
components and relevant principles.
•• To document internal control deficiencies identified during the
assessment process.
If the templates are used as suggested, they offer the following benefits:
•• They provide a logical structure for management to analyze and document
the organization’s assessment of effectiveness of internal control, including
the presence and functioning of components and principles as set forth in the
Framework using the points of focus for assistance.
•• They assist management in developing a process for identifying and evalu-
ating internal control deficiencies within components and relevant principles
relating to the assessment of effectiveness of internal control.
Organization
The templates are organized to support a top-down, risk-based assessment approach.
Four different templates are included.2
•• Overall Assessment—Summarizes management’s determination of whether all
five components are present, functioning and operating together in an inte-
grated manner, including the severity of internal control deficiencies or combi-
nation of internal control deficiencies when considered collectively across the
components.
•• Components—Summarizes management’s determination of whether each
component, including its associated relevant principles, is present and func-
tioning. Internal control deficiencies relating to each principle are listed and
the severity of each deficiency is assessed considering whether it is compen-
sated3
for by controls that effect other principles in the component.
2 For illustrative purposes the templates are shown as separate documents. In practice, an organization
would likely use technology to link these templates to reduce redundant information; information common
to more than one template would then automatically be populated across the templates. For example, an
organization will likely use technology to maintain a consolidated summary of internal control deficiencies
that is referenced by all the templates rather than having summaries included in each template.
3 This publication broadly uses the term compensating controls as defined by the Securities Exchange
Commission in the United States, “Compensating controls are controls that serve to accomplish the
objective of another control that did not function properly, helping to reduce risk to an acceptable level.”
Internal Control — Integrated Framework • September 2012 3
8
9
10
14. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
•• Principles—Summarizes management’s determination of whether each
relevant principle is present and functioning4
. Points of focus are provided
to assist management in this determination. Management, in its judgment,
identifies and considers suitable and relevant points of focus, including those
presented in the Framework, that reflect the entity’s industry, operating, and
regulatory environments. Thus, the templates include the points of focus set
forth in the Framework as a starting point, which can be modified as appro-
priate. These templates also summarize any identified internal control defi-
ciencies along with a preliminary determination of the severity of the internal
control deficiencies. The determination of severity is preliminary pending the
consideration of any compensating controls that effect the other principles
within the component.
•• Summary of Internal Control Deficiencies—Provides a log of all identified inter-
nal control deficiencies that can be leveraged in the evaluation of components
and principles, and facilitate the combination of internal control deficiencies.
The diagram on the right page shows the relationship between each of the templates
and the expected flow of key information (i.e., evaluation summaries and internal control
deficiencies). While shown here as a serial process, in practice, it is likely to be iterative.
Scenarios
The scenarios present several practical examples of how the templates can be used
to support an assessment of effectiveness of a system of internal control based on the
requirements set forth in the Framework. Each scenario is designed to illustrate a partic-
ular aspect, or set of related aspects, of the assessment process, and each consists of
two parts:
•• Background material to provide context for the scenario (e.g., company back-
ground, relevant paragraphs of the Framework, summary of key points)
•• Completed templates
The scenarios highlight important considerations in performing an assessment. They
do not present a comprehensive view of how an organization would perform the
overall assessment of internal control as they do not present all possible aspects of
the assessment process. The templates that accompany the scenarios are intended to
serve as examples and should not be viewed as comprehensive documentation depict-
ing all relevant controls and assessments. Management should consider the Framework
only for designing and implementing a system of internal control. The content in the
templates is meant to enable readers to focus on the concepts illustrated in the scenar-
ios. It does not necessarily show an acceptable level of documentation set by man-
agement or established by laws, regulations and standards. Also, only those templates
relevant to the objective of the scenario are included.
4 All principles set forth in the Framework are included in the templates. There may be a rare industry,
operating, or regulatory situation in which management has determined that a particular principle is not
relevant to the associated component.
Internal Control — Integrated Framework • September 20124
11
12
13
15. Exposure Period Version
Introduction
The severity of internal control deficiencies contained in the scenarios is included to
illustrate considerations in performing an assessment. Determining the severity of a
deficiency is a highly judgmental process that depends on specific facts and circum-
stances and that is often defined by criteria established by regulators, standard-setting
bodies, and other relevant third parties.
Each scenario is pertinent to any type of entity, although specific facts and circum-
stances may not apply. Each scenario is accompanied by a brief summary of any differ-
ences that are likely to exist between the scenario and other types of entities.
Evaluation summary
for each principle
Evaluation summary
for each component
PostPublicExposureVersion
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
1. Overall Assessment of Internal Control Template
Assessment of Internal Control
Entity or part of organization structure subject to the assessment (entity,
division, operating unit, function)
Objective(s) being considered for the scope of internal control being
assessed
Considerations regarding management’s acceptable level of risk
Operations
Reporting
Compliance
Present? (Y/N) Functioning?
(Y/N)
Explanation/conclusion
Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring Activities
Are all components operating together in an integrated manner?
Evaluate if a combination of internal control deficiencies, when considered
across components, represent a major deficiency.*
Update Summary of Deficiencies Template as needed
Is the overall system of internal control effective? Y/N*
Basis for conclusion
* If it is determined that there is a major deficiency, then management must conclude that the overall system of internal control is not effective.
8
Overall Assessment
Summary of Internal
Control Deficiencies
Update severity of
internal control
deficiencies
Record internal controls
deficiencies
Component
Evaluation (5)
Component
Evaluation (5)
Component Evaluation
x 5
Principle Evaluation
x 17
PostPublicExposureVersion
Template | Component Evaluation
2. Component Evaluation Template
Component Evaluation — Control Environment
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
1. Demonstrates Commitment to Integrity and Ethical Values—The
organization demonstrates a commitment to integrity and ethical values.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
2. Exercises Oversight Responsibility—The board of directors demon-
strates independence from management and exercises oversight for the
development and performance of internal control.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
9
PostPublicExposureVersion
Template | Principle Evaluation
3. Principle Evaluation Templates
Principle Evaluation Template — Control Environment
Control Environment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
1. Demonstrates Commitment to Integrity and Ethical Values—The organization demonstrates a commitment to integrity and ethical values.
Sets the Tone at the Top—How do the board
of directors and management at all levels of
the entity demonstrate through their directives,
actions, and behavior the importance of integrity
and ethical values to support the functioning of
the system of internal control?
Establishes Standards of Conduct—How are
the expectations of the board of directors and
senior management concerning integrity and
ethical values defined in the entity’s standards
of conduct and understood at all levels of the
organization and by outsourced service provid-
ers and business partners?
Evaluates Adherence to Standards of Conduct—
What processes are in place to evaluate the
performance of individuals and teams against
the entity’s expected standards of conduct?
Addresses Deviations in a Timely Manner—How
are deviations of the entity’s expected standards
of conduct identified and remedied in a timely
and consistent manner?
(Other entity specific points of focus, if any)
21
PostPublicExposureVersion
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
4. Summary of Deficiencies Template
Summary of Deficiencies Template
ID # Source of the internal control
deficiency
Internal
Control
Deficiency
Description
Severity
Consider-
ations
Is internal
control defi-
ciency a major
deficiency?
(Y/N)
Owner Remediation
Plan and Date
Impact on
Present/
Functioning
List any internal
control defi-
ciencies in other
principles that
may have con-
tributed to this
internal control
deficiency
Component Principle
This template is an example of a summary of deficiencies. Management may tailor this template to include additional columns to capture other relevant informa-
tion, as needed.
60
Internal Control — Integrated Framework • September 2012 5
14
15
16. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Internal Control — Integrated Framework • September 20126
18. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
1. Overall Assessment of Internal Control Template
Assessment of Internal Control
Entity or part of organization structure subject to the assessment (entity,
division, operating unit, function)
Objective(s) being considered for the scope of internal control being
assessed
Considerations regarding management’s acceptable level of risk
Operations
Reporting
Compliance
Present? (Y/N) Functioning?
(Y/N)
Explanation/conclusion
Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring Activities
Are all components operating together in an integrated manner?
Evaluate if a combination of internal control deficiencies, when considered
across components, represent a major deficiency.*
Update Summary of Deficiencies Template as needed
Is the overall system of internal control effective? Y/N*
Basis for conclusion
* If it is determined that there is a major deficiency, then management must conclude that the overall system of internal control is not effective.
Internal Control — Integrated Framework • September 20128
19. Exposure Period Version
Template | Component Evaluation
2. Component Evaluation Template
Component Evaluation — Control Environment
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
1. Demonstrates Commitment to Integrity and Ethical Values—The
organization demonstrates a commitment to integrity and ethical values.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
2. Exercises Oversight Responsibility—The board of directors demon-
strates independence from management and exercises oversight for the
development and performance of internal control.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Internal Control — Integrated Framework • September 2012 9
20. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Component Evaluation — Control Environment
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
3. Establishes Structure, Authority, and Responsibility—Management
establishes, with board oversight, structures, reporting lines, and appropri-
ate authorities and responsibilities in the pursuit of objectives.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
4. Demonstrates Commitment to Competence—The organization demon-
strates a commitment to attract, develop, and retain competent individuals
in alignment with objectives.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Internal Control — Integrated Framework • September 201210
21. Exposure Period Version
Template | Component Evaluation
Component Evaluation — Control Environment
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
5. Enforces Accountability—The organization holds individuals accountable
for their internal control responsibilities in the pursuit of objectives.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Explanation/Conclusion
Evaluate deficiencies across the component:*
Evaluate if any internal control deficiencies or combination of internal control
deficiencies, when considered across the component, represent a major
deficiency.**
Evaluate the component using judgment and based on the principles and the
deficiencies.**
Yes/No Explanation/Conclusion
Is the component present?
Is the component functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
**If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 11
22. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Component Evaluation — Risk Assessment
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
6. Specifies Suitable Objectives—The organization specifies objectives
with sufficient clarity to enable the identification and assessment of risks
relating to objectives.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
7. Identifies and Analyzes Risks—The organization identifies risks to the
achievement of its objectives across the entity and analyzes risks as a
basis for determining how the risks should be managed.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Internal Control — Integrated Framework • September 201212
23. Exposure Period Version
Template | Component Evaluation
Component Evaluation — Risk Assessment
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
8. Assesses Fraud Risk—The organization considers the potential for fraud
in assessing risks to the achievement of objectives.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
9. Identifies and Analyzes Significant Change—The organization identi-
fies and assesses changes that could significantly impact the system of
internal control.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Internal Control — Integrated Framework • September 2012 13
24. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Component Evaluation — Risk Assessment
Explanation/Conclusion
Evaluate deficiencies across the component:*
Evaluate if any internal control deficiencies or combination of internal control
deficiencies, when considered across the component, represent a major
deficiency.**
Evaluate the component using judgment and based on the principles and the
deficiencies.**
Yes/No Explanation/Conclusion
Is the component present?
Is the component functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 201214
25. Exposure Period Version
Template | Component Evaluation
Component Evaluation — Control Activities
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
10. Selects and Develops Control Activities—The organization selects and
develops control activities that contribute to the mitigation of risks to the
achievement of objectives to acceptable levels.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
11. Selects and Develops General Controls over Technology—The organi-
zation selects and develops general control activities over technology to
support the achievement of objectives.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Internal Control — Integrated Framework • September 2012 15
26. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Component Evaluation — Control Activities
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
12. Deploys through Policies and Procedures—The organization deploys
control activities through policies that establish what is expected and
procedures that put the policies into action
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Explanation/Conclusion
Evaluate deficiencies across the component:*
Evaluate if any internal control deficiencies or combination of internal control
deficiencies, when considered across the component, represent a major
deficiency.**
Evaluate the component using judgment and based on the principles and the
deficiencies.**
Yes/No Explanation/Conclusion
Is the component present?
Is the component functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 201216
27. Exposure Period Version
Template | Component Evaluation
Component Evaluation — Information and Communication
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
13. Uses Relevant Information—The organization obtains or generates
and uses relevant, quality information to support the functioning of other
components of internal control.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
14. Communicates Internally—The organization internally communicates
information, including objectives and responsibilities for internal control,
necessary to support the functioning of other components of internal
control.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Internal Control — Integrated Framework • September 2012 17
28. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Component Evaluation — Information and Communication
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
15. Communicates Externally—The organization communicates with exter-
nal parties regarding matters affecting the functioning of other compo-
nents of internal control.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Explanation/Conclusion
Evaluate deficiencies across the component:*
Evaluate if any internal control deficiencies or combination of internal control
deficiencies, when considered across the component, represent a major
deficiency.**
Evaluate the component using judgment and based on the principles and the
deficiencies.**
Yes/No Explanation/Conclusion
Is the component present?
Is the component functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 201218
29. Exposure Period Version
Template | Component Evaluation
Component Evaluation — Monitoring Activities
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
16. Conducts Ongoing and/or Separate Evaluations—The organization
selects, develops, and performs ongoing and/or separate evaluations to
ascertain whether the components of internal control are present and
functioning.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Present? (Y/N) Functioning? (Y/N) Explanation/Conclusion
17. Evaluates and Communicates Deficiencies—The organization evalu-
ates and communicates internal control deficiencies in a timely manner
to those parties responsible for taking corrective action, including senior
management and the board of directors, as appropriate.
Identification No. Internal control deficiency description Evaluate internal control deficiency
severity: (Consider whether the controls to
effect another principle compensate for the
internal control deficiency.)
List internal control
deficiencies related to
another principle that may
impact this internal control
deficiencyIs internal control
deficiency a major
deficiency? (Y/N)
Comments/Compen-
sating Controls
Internal Control — Integrated Framework • September 2012 19
30. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Component Evaluation — Monitoring Activities
Explanation/Conclusion
Evaluate deficiencies across the component:*
Evaluate if any internal control deficiencies or combination of internal control
deficiencies, when considered across the component, represent a major
deficiency.**
Evaluate the component using judgment and based on the principles and the
deficiencies.**
Yes/No Explanation/Conclusion
Is the component present?
Is the component functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 201220
31. Exposure Period Version
Template | Principle Evaluation
3. Principle Evaluation Templates
Principle Evaluation Template — Control Environment
Control Environment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
1. Demonstrates Commitment to Integrity and Ethical Values—The organization demonstrates a commitment to integrity and ethical values.
Sets the Tone at the Top—How do the board
of directors and management at all levels of
the entity demonstrate through their directives,
actions, and behavior the importance of integrity
and ethical values to support the functioning of
the system of internal control?
Establishes Standards of Conduct—How are
the expectations of the board of directors and
senior management concerning integrity and
ethical values defined in the entity’s standards
of conduct and understood at all levels of the
organization and by outsourced service provid-
ers and business partners?
Evaluates Adherence to Standards of Conduct—
What processes are in place to evaluate the
performance of individuals and teams against
the entity’s expected standards of conduct?
Addresses Deviations in a Timely Manner—How
are deviations of the entity’s expected standards
of conduct identified and remedied in a timely
and consistent manner?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 2012 21
32. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Environment
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 201222
33. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Environment
Control Environment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
2.Exercises Oversight Responsibility—The board of directors demonstrates independence from management and exercises oversight for the
development and performance of internal control.
Establishes Oversight Responsibilities—How
does the board of directors identify and accept
its oversight responsibilities in relation to estab-
lished requirements and expectations?
Applies Relevant Expertise—How does the
board of directors define, maintain, and period-
ically evaluate the skills and expertise needed
among its members to enable them to ask
probing questions of senior management and
take commensurate actions?
Operates Independently—Does the board of
directors have sufficient members who are
independent from management and how do they
demonstrate they are objective in evaluations
and decision making?
Provides Oversight for the System of Internal
Control—How does the board of directors
retain oversight responsibility for management’s
development and performance of internal
control (see areas below)?
Control Environment—Establishing integrity
and ethical values, oversight structures,
authority and responsibility, expectations
of competence, and accountability to
the board.
Internal Control — Integrated Framework • September 2012 23
34. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Environment
Risk Assessment—Overseeing manage-
ment’s assessment of risks to the achieve-
ment of objectives, including the potential
impact of significant changes, fraud, and
management override of internal control.
Control Activities—Providing oversight to
senior management in the development and
performance of control activities.
Information and Communication—Analyzing
and discussing information relating to the
entity’s achievement of objectives.
Monitoring Activities—Assessing and over-
seeing the nature and scope of monitoring
activities and the management’s evaluation
and remediation of deficiencies.
(Other entity specific points of focus, if any)
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Internal Control — Integrated Framework • September 201224
35. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Environment
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 25
36. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Environment
Control Environment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
3. Establishes Structure, Authority, and Responsibility—Management establishes, with board oversight, structures, reporting lines, and appro-
priate authorities and responsibilities in the pursuit of objectives.
Considers All Structures of the Entity—How
do management and the board of directors
consider the multiple structures used (includ-
ing operating units, legal entities, geographic
distribution, and outsourced service providers)
to support the achievement of objectives?
Establishes Reporting Lines—How does man-
agement design and evaluate lines of reporting
for each entity structure to enable execution of
authorities and responsibilities and flow of infor-
mation to manage the activities of the entity?
Defines, Assigns, and Limits Authorities and
Responsibilities—How does management and
the board of directors delegate authority, define
responsibilities, use appropriate process and
technology to assign responsibilities and segre-
gate duties as necessary at the various levels of
the organization?
Board of Directors—Retains authority over
significant decisions and reviews man-
agement’s assignments and limitations of
authorities and responsibilities
Senior Management—Establishes directives,
guidance, and control to enable management
and other personnel to understand and carry
out their internal control responsibilities.
Management—Guides and facilitates the
execution of senior management directives at
entity and its subunits.
Internal Control — Integrated Framework • September 201226
37. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Environment
Personnel—Understands the entity’s stan-
dard of conduct, assessed risks to objectives,
and the related control activities at their
respective levels of the entity, the expected
information and communication flow, and
monitoring activities relevant to their achieve-
ment of the objectives.
Outsourced Service Providers—Adheres to
management’s definition of the scope of
authority and responsibility for all non-em-
ployees engaged.
(Other entity specific points of focus, if any)
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Internal Control — Integrated Framework • September 2012 27
38. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Environment
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 201228
39. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Environment
Control Environment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
4. Demonstrates Commitment to Competence—The organization demonstrates a commitment to attract, develop, and retain competent indi-
viduals in alignment with objectives.
Establishes Policies and Practices—How do the
policies and practices reflect expectations of
competence necessary to support the achieve-
ment of objectives?
Evaluates Competence and Addresses Short-
comings—How do the board of directors and
management evaluate competence across the
organization and in outsourced service providers
in relation to established policies and practices,
and act as necessary to address shortcomings?
Attracts, Develops, and Retains Individuals—
How does the organization provide the men-
toring and training needed to attract, develop,
and retain sufficient and competent personnel
and outsourced service providers to support the
achievement of objectives?
Plans and Prepares for Succession—How do
senior management and the board of directors
develop contingency plans for assignments of
responsibility important for internal control?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 2012 29
40. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Environment
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 201230
41. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Environment
Control Environment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
5. Enforces Accountability—The organization holds individuals accountable for their internal control responsibilities in the pursuit
of objectives.
Enforces Accountability through Structures,
Authorities, and Responsibilities—How do man-
agement and the board of directors establish
the mechanisms to communicate and hold indi-
viduals accountable for performance of internal
control responsibilities across the organization
and implement corrective action as necessary?
Establishes Performance Measures, Incentives,
and Rewards—How do management and the
board of directors establish performance mea-
sures, incentives, and other rewards appropriate
for responsibilities at all levels of the entity,
reflecting appropriate dimensions of perfor-
mance and expected standards of conduct, and
considering the achievement of both short-term
and longer-term objectives?
Evaluates Performance Measures, Incentives,
and Rewards for Ongoing Relevance—How do
management and the board of directors align
incentives and rewards with the fulfillment of
internal control responsibilities in the achieve-
ment of objectives?
Considers Excessive Pressures—How do
management and the board of directors
evaluate and adjust pressures associated with
the achievement of objectives as they assign
responsibilities, develop performance measures,
and evaluate performance?
Internal Control — Integrated Framework • September 2012 31
42. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Environment
Evaluates Performance and Rewards or Disci-
plines Individuals—How do management and
the board of directors evaluate performance of
internal control responsibilities, including adher-
ence to standards of conduct and expected
levels of competence and provide rewards or
exercise disciplinary action as appropriate?
(Other entity specific points of focus, if any)
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Internal Control — Integrated Framework • September 201232
43. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Environment
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 33
44. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Risk Assessment
Risk Assessment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
6. Specifies Suitable Objectives—The organization specifies objectives with sufficient clarity to enable the identification and assessment of
risks relating to objectives.
Consider Points of Focus Relating to Operations
Objectives
Reflects Management’s Choices—How do the
operations objectives reflect management’s
choices about structure, industry consider-
ations, and performance of the entity?
Considers Tolerances for Risk—How does
management consider the acceptable levels
of variation relative to the achievement of opera-
tions objectives?
Includes Operations and Financial Performance
Goals—How does the organization reflect
the desired level of operations and financial
performance for the entity within operations
objectives?
Forms Basis for Committing of Resources—
How does management use operations objec-
tives as a basis for allocating resources needed
to attain desired operations and financial
performance?
Consider Points of Focus Pertaining to External
Financial Reporting
Complies with Applicable Accounting Stan-
dards—How does management ensure that the
financial reporting objectives are consistent with
accounting principles suitable and available for
that entity and that the accounting principles
selected are appropriate in the circumstances?
Internal Control — Integrated Framework • September 201234
45. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Risk Assessment
Considers Materiality—How does management
consider materiality in financial statement
presentation?
Reflects Entity Activities—How does external
reporting reflect the underlying transactions
and events to show qualitative characteristics
and assertions?
Consider Points of Focus Pertaining to External
Non-Financial Reporting
Complies with Externally Established Standards
and Frameworks—How does management
establish objectives consistent with laws and
regulations or standards and frameworks of
recognized external organizations?
Considers the Required Level of Precision—
How does management reflect the required
level of precision and accuracy suitable for user
needs and as based on criteria established by
third parties in non-financial reporting?
Reflects Entity Activities—How does external
reporting reflect the underlying transactions and
events within a range of acceptable limits?
Consider Points of Focus Pertaining to Internal
Reporting Objectives (External and Internal)
Reflects Management’s Choices—How does
internal reporting provide management with
accurate and complete information regarding
management’s choices and information needed
in managing the entity?
Internal Control — Integrated Framework • September 2012 35
46. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Risk Assessment
Considers the Required Level of Precision—
How does management reflect the required
level of precision and accuracy suitable for user
needs in non-financial reporting objectives and
materiality within financial reporting objectives?
Reflects Entity Activities—How does internal
reporting reflect the underlying transactions and
events within a range of acceptable limits?
Consider Points of Focus Pertaining to Compli-
ance Objectives
Reflects External Laws and Regulations—How
does the entity integrate into compliance
objectives laws and regulations that establish
minimum standards of conduct for the entity?
Considers Tolerances for Risk—How does
management consider the acceptable levels of
variation relative to the achievement of compli-
ance objectives?
(Other entity specific points of focus, if any)
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Internal Control — Integrated Framework • September 201236
47. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Risk Assessment
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 37
48. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Risk Assessment
Risk Assessment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
7. Identifies and Analyzes Risk—The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a
basis for determining how the risks should be managed.
Includes Entity, Subsidiary, Division, Operating
Unit, and Functional Levels—How does the
organization identify and assess risks at the
entity, subsidiary, division, operating unit, and
functional levels relevant to the achievement of
objectives?
Analyzes Internal and External Factors—How
does management ensure that risk identification
considers both internal and external factors and
their impact on the achievement of objectives?
Involves Appropriate Levels of Management—
How does the organization put into place effec-
tive risk assessment mechanisms that involve
appropriate levels of management?
Estimates Significance of Risks Identified—How
does management ensure that identified risks
are analyzed through a process that includes
estimating the potential significance of the risk?
Determines How to Respond to Risks—How
does management ensure that the risk assess-
ment includes considering how the risk should
be managed and whether to accept, avoid,
reduce, or share the risk?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 201238
49. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Risk Assessment
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 39
50. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Risk Assessment
Risk Assessment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
8. Assess Fraud Risk—The organization considers the potential for fraud in assessing risks to the achievement of objectives.
Considers Various Types of Fraud—How does
the assessment of fraud consider fraudulent
reporting, possible loss of assets, and corrup-
tion resulting from the various ways that fraud
and misconduct can occur?
Assesses Incentive and Pressures—How does
the assessment of fraud risk consider incentives
and pressures?
Assesses Opportunities—How does the
assessment of fraud risk consider opportunities
for unauthorized acquisition, use, or disposal of
assets, altering of the entity’s reporting records,
or committing other inappropriate acts?
Assesses Attitudes and Rationalizations—How
does the assessment of fraud risk consider how
management and other personnel might engage
in or justify inappropriate actions?
(Other entity specific points of focus, if any)
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Internal Control — Integrated Framework • September 201240
51. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Risk Assessment
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 41
52. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Risk Assessment
Risk Assessment Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
9. Identifies and Analyzes Significant Change—The organization identifies and assesses changes that could significantly impact the system of
internal control.
Assesses Changes in the External Environment
—How does the risk identification process
consider changes to regulatory, economic, and
the physical environment in which the entity
operates?
Assesses Changes in the Business Model—
How does the organization consider the poten-
tial impacts of new business lines, dramatically
altered compositions of existing business lines,
acquired or divested business operations on
the system of internal control, rapid growth,
changing reliance on foreign geographies, and
new technologies?,
Assesses Changes in Leadership—How does
the organization consider changes in manage-
ment and their respective attitudes and philoso-
phies on the system of internal control?
(Other entity specific points of focus, if any)
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Internal Control — Integrated Framework • September 201242
53. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Risk Assessment
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 43
54. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Activities
Control Activities Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
10. Selects and Develops Control Activities—The organization selects and develops control activities that contribute to the mitigation of risks
to the achievement of objectives to acceptable levels.
Integrates with Risk Assessment—How do the
control activities help ensure that responses
that address and mitigate risks are carried out?
Determines Relevant Business Processes—How
does management determine which relevant
business processes require control activities?
Considers Entity-Specific Factors—How does
management consider how the environment,
complexity, nature, and scope of its operations,
as well as the specific characteristics of its
organization, affect the selection and develop-
ment of control activities?
Evaluates a Mix of Control Activity Types—How
do the control activities include a range and
variety of controls and a balance of approaches
to mitigate risks, considering both manual and
automated controls, and preventive and detec-
tive controls?
Considers at What Level Activities Are
Applied—How does management consider
control activities at various levels in the entity?
Addresses Segregation of Duties—How does
management segregate incompatible duties,
and where such segregation is not practical,
does management select and develop alterna-
tive control activities?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 201244
55. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Activities
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 45
56. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Activities
Control Activities Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
11. Selects and Develops General Controls over Technology—The organization selects and develops general control activities over technology
to support the achievement of objectives.
Determines Dependency between the Use of
Technology in Business Processes and Technol-
ogy General Controls—How does management
understand and determine the dependency and
linkage between business processes, auto-
mated control activities, and technology general
controls?
Establishes Relevant Technology Infrastructure
Control Activities—How does management
select and develop control activities over the
technology infrastructure, which are designed
and implemented to help ensure the complete-
ness, accuracy, and availability of technology
processing?
Establishes Relevant Security Management
Process Control Activities—How does man-
agement select and develop control activities
that are designed and implemented to restrict
technology access rights to authorized users
commensurate with their job responsibilities
and to protect the entity’s assets from external
threats.
Establishes Relevant Technology Acquisition,
Development, and Maintenance Process Control
Activities—How does management select and
develop control activities over the acquisition,
development, and maintenance of technology
and its infrastructure to achieve management’s
objectives.
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 201246
57. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Activities
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 47
58. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Control Activities
Control Activities Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
12. Deploys through Policies and Procedures—The organization deploys control activities through policies that establish what is expected and
procedures that put the policies into action.
Establishes Policies and Procedures to Support
Deployment of Management’s Directives—How
does management establish control activities
that are built into business processes and
employees’ day-to-day activities through poli-
cies establishing what is expected, and relevant
procedures specifying actions?.
Establishes Responsibility and Accountability
for Executing Policies and Procedures—How
does management establish responsibility and
accountability for control activities with man-
agement (or other designated personnel) of the
operating unit or function in which the relevant
risks reside?
Performs in a Timely Manner—How do respon-
sible personnel perform control activities in a
timely manner as defined by the policies and
procedures?
Takes Corrective Action—How do responsible
personnel investigate and act on matters identi-
fied as a result of executing control activities?
Performs Using Competent Personnel—How do
competent personnel perform control activities
with diligence and continuing focus?
Reassesses Policies and Procedures—How
does management periodically review control
activities to determine their continued rele-
vance, and refresh them when necessary?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 201248
59. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Control Activities
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 49
60. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Information and Communication
Information and Communication Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
13. Uses Relevant Information—The organization obtains or generates and uses relevant, quality information to support the functioning of
other components of internal control.
Identifies Information Requirements—How does
management consider if a process is in place to
identify the information required and expected
to support the functioning of the other compo-
nents of internal control and the achievement of
entity’s objectives?
Captures Internal and External Sources of
Data—How do the information systems capture
internal and external sources of data?
Processes Relevant Data into Information—How
do the information systems process and trans-
form relevant data into information?
Maintains Quality throughout Processing—How
do the information systems produce informa-
tion that is timely, current, accurate, complete,
accessible, protected, and verifiable and
retained? Consider if the information is reviewed
to assess its relevance in supporting the internal
control components.
Considers Costs and Benefits—How does
management consider if the nature, quantity,
and precision of information communicated are
commensurate with and support the achieve-
ment of objectives?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 201250
61. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Information and Communication
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 51
62. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Information and Communication
Information and Communication Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
14. Communicates Internally—The organization internally communicates information, including objectives and responsibilities for internal
control, necessary to support the functioning of other components of internal control.
Communicates Internal Control Information
with Personnel—What process is in place to
communicate required information to enable
all personnel to understand and carry out their
internal control responsibilities?
Communicates with the Board of Directors—
What communication exists between manage-
ment and the board of directors so that both
have information needed to fulfill their roles with
respect to the entity’s objectives?
Provides Separate Communication Lines—Are
separate communication channels, such as
whistle-blower hotlines, in place and serve as
fail-safe mechanisms to enable anonymous
or confidential communication when normal
channels are inoperative or ineffective?
Selects Relevant Method of Communica-
tion—How does the method of communication
consider the timing, audience, and nature of the
information?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 201252
63. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Information and Communication
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 53
64. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Information and Communication
Information and Communication Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
15. Communicates Externally—The organization communicates with external parties regarding matters affecting the functioning of other
components of internal control.
Communicates to External Parties—What
processes are in place to communicate relevant
and timely information to external parties,
including shareholders, partners, owners, reg-
ulators, customers, and financial analysts and
other external parties?
Enables Inbound Communications—How do
the open communication channels allow input
from customers, consumers, suppliers, external
auditors, regulators, financial analysts, and
others, providing management and the board of
directors with relevant information?
Communicates with the Board of Directors—
How is the relevant information resulting from
assessments conducted by external parties
communicated to the board of directors?
Provides Separate Communication Lines—Are
separate communication channels, such as
whistle-blower hotlines, in place and serve as
fail-safe mechanisms to enable anonymous
or confidential communication when normal
channels are inoperative or ineffective?
Selects Relevant Method of Communica-
tion—How does the method of communication
consider the timing, audience, and nature of
the communication and legal, regulatory, and
fiduciary requirements and expectations?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 201254
65. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Information and Communication
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 55
66. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Monitoring Activities
Monitoring Activities Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
16. Conducts Ongoing and/or Separate Evaluations—The organization selects, develops, and performs ongoing and/or separate evaluations to
ascertain whether the components of internal control are present and functioning.
Considers a Mix of Ongoing and Separate
Evaluations—How does management include a
balance of ongoing and separate evaluations?
Considers Rate of Change—How does manage-
ment consider the rate of change in business
and business processes when selecting and
developing ongoing and separate evaluations?
Establishes Baseline Understanding—How
is the design and current state of an internal
control system used to establish a baseline for
ongoing and separate evaluations?
Uses Knowledgeable Personnel—How does
management help ensure that the evaluators
performing ongoing and separate evaluations
have sufficient knowledge to understand what is
being evaluated?
Integrates with Business Processes—How do
the ongoing evaluations built into the business
processes adjust to changing conditions?
Adjusts Scope and Frequency—How does
management vary the scope and frequency of
separate evaluations depending on risk?
Objectively Evaluates—How do the separate
evaluations performed periodically provide
objective feedback?
(Other entity specific points of focus, if any)
Internal Control — Integrated Framework • September 201256
67. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Monitoring Activities
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 57
68. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Principle Evaluation Template — Monitoring Activities
Monitoring Activities Principles Summary of Controls Deficiencies/Notes/Other Considerations
(also record deficiencies in log below)
17. Evaluates and Communicates Deficiencies—The organization evaluates and communicates internal control deficiencies in a timely manner
to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
Assesses Results—How do management and
the board of directors, as appropriate, assess
results of ongoing and separate evaluations?
Communicates Deficiencies—How are
deficiencies communicated to parties respon-
sible for taking corrective action and to senior
management and to the board of directors, as
appropriate?
Monitors Corrective Actions—How does
management track whether deficiencies are
remediated on a timely basis?
(Other entity specific points of focus, if any)
Deficiencies Applicable to the Principle
Identification No. Internal control deficiency
description
Possible Impact on
Principle
Evaluate preliminary deficiency severity:
(Consider whether other controls to effect this
principle compensate for the internal control
deficiency.)
List internal control
deficiencies related to
another principle that
may impact this internal
control deficiency
Present?
(Y/N)
Functioning?
(Y/N)
Preliminary Sever-
ity—Is internal control
deficiency a major
deficiency? (Y/N)
Comments/ Compen-
sating Controls
Internal Control — Integrated Framework • September 201258
69. Exposure Period Version
Template | Principle Evaluation
Principle Evaluation Template — Monitoring Activities
Evaluate deficiencies within the principle:*
Evaluate if any internal control deficiencies or
combination of internal control deficiencies,
when considered within the principle, represent
a major deficiency.**
Update Summary of Deficiencies Template as
required
Explanation
Evaluate the principle using judgment.** Y/N Explanation/Conclusion
Is the principle present?
Is the principle functioning?
* Note: Record deficiencies in Summary of Deficiencies Template.
** If it is determined that there is a major deficiency, then management must conclude that the component is not present and functioning and the overall system of
internal control is not effective.
Internal Control — Integrated Framework • September 2012 59
70. Exposure Period Version
Framework | Illustrative Tools for Assessing Effectiveness of a System of Internal Control
4. Summary of Deficiencies Template
Summary of Deficiencies Template
ID # Source of the internal control
deficiency
Internal
Control
Deficiency
Description
Severity
Consider-
ations
Is internal
control defi-
ciency a major
deficiency?
(Y/N)
Owner Remediation
Plan and Date
Impact on
Present/
Functioning
List any internal
control defi-
ciencies in other
principles that
may have con-
tributed to this
internal control
deficiency
Component Principle
This template is an example of a summary of deficiencies. Management may tailor this template to include additional columns to capture other relevant informa-
tion, as needed.
Internal Control — Integrated Framework • September 201260