More Related Content
Similar to Red Flag Reporting - Organizational Level Controls
Red Flag Reporting - Organizational Level Controls
- 1.
- 2. Components of Internal Control • COSO sets forth five components of internal control: – Control Environment – Risk Assessment – Control Activities – Information and Communication – Monitoring
- 3. Components of Internal Control (continued) Two types of Controls: • Organizational Level Controls (Focus of this Presentation) • Functional Level Controls COSO Component Primary Level of Application Organizational Level Functional Level Control Environment X Risk Assessment X Information and X Communication (Communication) X (Information Systems) Control Activities X Monitoring X
- 4. Control Environment •Sets the Organization’s Tone • Most Cost Effective and Efficient way to Implement Internal Control • Effects all Other Aspects of Internal Control • Control Environment Factors Include the Following Principles: – Integrity and ethical values, commitment to competence, oversight by board or audit committee, management’s philosophy and operating style, organizational structure, manner of assigning authority and responsibility, HR policies and procedures. • Hard Controls vs. Soft Controls
- 5. Integrity and EthicalValues • Management’s Integrity Plays a Significant Role in “Setting the Tone at the Top” • Challenges Faced when Establishing Ethical Values: – Balancing the Issues and Concerns of Various Parties – Assigning Prominence to High Ethical Behavior within the Organization – Balancing Short-Term and Long-Term Goals
- 6. Commitment to Competence • Employee Competence is Critical to an Organization’s Control Environment – Otherwise, Employees May Not Follow Policies – Internal Control Effectiveness would be Impaired • Competence Levels Required are Determined by Management. – Implemented by hiring decisions, training – Competence comes with cost – Jobs with less supervision require more Competence
- 7. Board of Directors/ Audit Committee • Their Existence Plays a Role in Setting Tone at the Top • Board and Audit Committee Should Consist of Executives Outside the Company – Outsiders are Less Likely to be Influenced by Management • Audit Committee Should Oversee: – Internal Controls over Financial Reporting – Fraud Risks Identified by Management – Implementation of Anti-Fraud Measures – Creation of Appropriate Tone at the Top – Consideration of Management Override of Controls
- 8. The Audit Committee Should… • Exercise Appropriate Skepticism • Have Knowledge of the Business and Industry • Brainstorm Possible Fraud Risks • Assess Tone at the Top via the Code of Conduct • Use an Effective Whistleblower Program (including a fraud hotline) • Develop an Effective Information and Feedback Network
- 9. Management’s Philosophy andOperating Style • Management Style: Formal vs. Informal – Organizations with a formal management style generally have more structured policies and procedures in place. – Organizations with an informal management style use personal contact with supervisors as a control function instead of written policies and procedures. • Management’s Philosophy and Operating Style Determine Acceptable Behavior and Expectations for Each Employee – An effective antifraud environment is created with a strong value system founded on integrity. – Proper examples set by management resonate through the business
- 10. Organizational Structure •Organizational Structure: – “Provides the framework within which its activities for achieving entity-wide objectives are planned, controlled, and monitored.” – Types of structures include: Centralized, decentralized, matrix reporting relationships, direct reporting relationships. – Can be organized by: Product line, industry, geographic location, distribution network, marketing network, function. – Issues to consider when establishing appropriate organizational structure are how: Areas of authority are defined, appropriate responsibilities are assigned, appropriate lines or reporting are established.
- 11. Assignment of Authorityand Responsibility • Determined by Management – Segregation of Duties should be Considered – Delegating authority to those closest to the transaction facilitates timely decision-making. However, raises the risk of poor decisions. • Other Factors Affecting how Organizations Delegate Responsibilities include: – Organizational structure, competence, accountability, monitoring.
- 12. Assignment of Authorityand Responsibility (Continued) • Considerations for assignment of authority and responsibility related to financial reporting include: – Appropriateness of authority and responsibility to meet required objectives – Policies that prevent unauthorized access – Assignments of authorization is assigned at appropriate levels
- 13. Human Resource Policiesand Procedures • HR Policies and Procedures enable and reinforce other aspects of the control environment. – Includes an organization’s practices relating to: hiring, orientation, training, evaluating, counseling, promoting, compensating, and remedial actions.
- 14. Special Considerations forSmall and Mid-sized Businesses • Nature and Size of the Business • Organization and Ownership Characteristics • Diversity and Complexity of Operations • Methods for Processing Financial Information • Legal and Regulatory Requirements
- 15. Challenges for SmallerBusinesses in Implementing Internal Controls • Management Influence – Potential for management override of controls is greater with smaller companies. • Segregation of Duties – This is often difficult with smaller companies since there are less employees to split tasks with. • Qualified Accounting Personnel – Smaller companies may not have the resources to hire accounting personnel with the appropriate technical skills.
- 16. Challenges for SmallerBusinesses in Implementing Internal Controls (Continued) • Board of Directors and Audit Committee – Smaller companies may not have the resources to attract a qualified board of directors. • Information Technology – It may not make financial sense for a smaller company to have an expensive ERP system with robust controls.
- 17. Managing Change –Potential Changes with Significant Impact • Changes in the Organization’s Operating Environment – Management implements changes that result in additional risks – Competitive pressures affect marketing or production strategies – Deregulation affects competition and cost structures • New Personnel May: – Not have proper understanding of control – Not understand the corporate culture – Emphasize performance over control activities – Not have the training and supervision necessary for controls to operate • New or Revised Information Systems – Time and cost constraints, and other issues on implementation – Lack of training and lack of new controls related to new system
- 18. Managing Change –Potential Changes with Significant Impact (Continued) • Rapid Growth within the Organization – May strain existing systems and personnel – Shifting responsibilities – More focused on results than on controls • New Technology – New or modified controls need to be implemented to address new technology – Personnel may require training on use of new technology • New Business Models, Products, or Activities – Personnel may be unfamiliar of new business models, products, and activities – Existing controls may not address new areas
- 19. Managing Change –Potential Changes with Significant Impact (Continued) • Restructuring Within the Organization May Result In: – Staff reductions, inadequate supervision, inadequate separation of duties, reassignment of personnel and new duties • Expanded Foreign Operations – Culture and customs of foreign country may different – Economic and regulatory environment may be different • Adaption of New Accounting Principles – Unfamiliar with new requirements – New requirements may affect a variety of accounts and transactions – Complex requirements may require study and analysis to ensure provisions are applied properly – Presentation and disclosure issues
- 20. Communication • Communicationof expectations, responsibilities, and other matters is necessary for the business to operate effectively • Internal Communication- It is important that management communicates: – The importance of internal control – Internal control responsibilities – That unexpected events should be investigated – How job activities relate to the work of others
- 21. Communication (Continued) •Importance of Upstream Communication – Information flowing from bottom to top – Significant operating issues are typically identified by people close to the transaction – Sales representatives may learn new way to give company products an edge – Personnel may be aware of ways to cut costs – Finance employees may be aware of misstatements
- 22. Communication (Continued) •For upstream communication to occur, open channels must be available • Management should communicate key issues to the board
- 23. Communication (Continued) •External Communication – Communication with companies doing business with the organization – Communication with independent auditors – Communication with regulators – Communication with shareholders
- 24. Monitoring • Monitoringcan be accomplished through: – Ongoing Activities • Comparisons • Reconciliations • Internal and External Audit • Regulators • Vendors & Customers – Separate Evaluations – A Combination of the Two
- 25.
- 26. Thank You! Pleasecall Debbie Risher or Marvin Willis at Smith & Howard with questions. 404-874-6244 www.smith-howard.com drisher@smith-howard.com
Editor's Notes
- #4 Organizational level controls relate to the organization as a whole, as opposed to functional level controls, which focus on specific processes. Organizational level controls serve as the foundation for all control components within the organization. Control Environment: Sets the tone of an organization and influences the control consciousness of its people. The control environment is the foundation for all other components of internal control and provides structure and discipline. Risk Assessment is the process of setting objectives, prioritizing, identifying, analyzing, and managing risks to the organization. Communication related to providing an understanding of the control policies to employees. Monitoring is the process that assesses the quality of internal control, and taking actions if necessary.
- #5 (Mostly self-explanatory without much more wording in the chapter) Hard Controls include oversight from the Board, organizational structure, assigning authority and responsibility, and HR policies. Soft controls are less tangible and include: integrity, ethical values, competence, management philosophy and operating style.
- #6 Balancing the issues and concerns of various parties: Management must consider issues concerning the organization, employees, suppliers, customers, competitors, and the public. Assigning prominence to high ethical behavior: Successful organizations have generally recognized the importance of integrity and ethical behavior. Balancing short and long term goals: Overemphasizing short term results (sales, profit) may lead to unethical behavior such as unethical sales practices, financial statement manipulation, fraud.
- #7 Employees should possess the knowledge and skills necessary to accomplish job-related tasks. Competence comes with a cost. Higher competence typically means hiring more expensive employees, and extra costs incurred to maintain proper training.
- #8 An organization’s board and audit committee play an important role within the control environment of an organization: setting the tone at the top.
- #9 Exercising appropriate skepticism: Audit committees should have the proper attitude towards the risk of management override of controls. Audit committees should understand the risk of fraud is present in every entity. Asking tough, probing questions would reflect the audit committee’s skepticism. Knowledge of the business and industry: Committee members should have knowledge of the business and industry. Risks are different, depending on which industry the entity operates in. There are also risks specific to an individual entity based on their history and operating structure. Brainstorming possible fraud risks: Brainstorming helps the audit committee take a step back and access how fraud could occur. Tone at the top via the code of conduct: The Audit committee use the code of conduct as a benchmark for assessing whether the company’s culture at the top is likely to maintain a high level of integrity needed to prevent fraud. Whistleblower programs: Allows an anonymous employee to submit information regarding suspected unethical behavior by members of the organization. This is an effective tool to combat management override of controls. Tips are the leading method of detecting fraud – as many as 40% of detected frauds are uncovered as a result of an employee tip. Develop an effective information and feedback network: It is important for the audit committee to consider sources of information other than that of senior management. Communication network should include: Key employees, compensation committee, internal audit, external audit.
- #10 The philosophy and operating style displayed by management impacts how the organization is managed, including its approach to accepting and managing business risks.
- #12 Many organizations have placed responsibility for making decisions with employees closest to the situation or transaction. Delegating authority in this manner facilitates timely decision-making and quick reaction to changing conditions. However, delegation also raises the risk that employees will make poor decisions or act in ways contrary to management’s wishes. Thus, management should weigh the risks associated with decisions and delegate authority and responsibilities only to the extent required to achieve the organization’s objectives. Organizational structure: The level of delegation impacts the organizational structure since it generally leads to a flatter structure. Competence: Employee competence is an even bigger factor when authority has been extensively delegated. Accountability: As management and employees are granted more authority and responsibilities, they must be held accountable for their decisions. Monitoring: Management must monitor the decision-making process and associated results.
- #13 (no further detail available)
- #14 HR policies and procedures enable and reinforce other aspects of the control environment: integrity, ethical behavior, and competence. HR policies and procedures that affect financial reporting and safeguarding of assets include: Standards for hiring qualified job candidates, recruiting that includes comprehensive interviews, background checks and reference checks of financial reporting personnel, training, employee performance evaluations, compensation and advancement policies, and remedial actions.
- #16 Smaller businesses, due to their size and limited resources, are generally more sensitive to the costs of implementing controls. However, COSO’s expectation for smaller businesses is the same as large businesses. The approaches a small business takes to achieve an effective internal control environment may differ from that of a large business.