PRINCIPLE 4: COMMITMENT TO ATTRACT,

DEVELOP, AND
RETAIN COMPETENT INDIVIDUALS IN ALIGNMENT
WITH
OBJECTIVES
• Do adequate policies and procedures exist?
• Can the policies and procedures be linked to show support of
objectives and strategic goals of the organization?
• How are any gaps in skill sets and competencies addressed?
• Are the right people working in the organization?
• How are personnel developed and retained?
• Are succession plans in place for members of the governing body and
key personnel?
Activities to be done
• Determine a calendar for policy review
• Link competency standards to hiring, training and retention activities
• Look for gaps in knowledge, skills and expertise
• Define performance expectations
• Create a training plan
• Evaluate your ability to implement complex regulations, accounting
standards, tax matters
• Review (or create) succession plan
competence
• Competence should relate to the knowledge and skills necessary to
accomplish tasks that define an individual’s job.
• Commitment to competence includes management’s consideration of
the competence levels for particular jobs and how those levels
translate into requisite skills and knowledge.
• Competence is an attribute that is assessed based on the company
and its operating environment
Point of focus
• Establishes Policies and Practices
- Policies and practices reflect expectations of competence necessary to support the
achievement of objectives
• Evaluates Competence and Addresses Shortcomings
- The board of directors and management evaluate competence across the organization
and in outsourced service providers in relation to established policies and practices, and
act as necessary to address shortcomings
• Attracts, Develops, and Retains Individuals
- The organization provides the mentoring and training needed to attract, develop, and
retain sufficient and competent personnel and outsourced service providers to support
the achievement of objectives
• Plans and Prepares for Succession
- Senior management and the board of directors develop contingency plans for
assignments of responsibility important for internal control
• HR policies and practices affect an entity’s ability to employ sufficient
competent personnel to accomplish its goals and objectives.
• HR policies and practices include an entity’s policies and procedures
for
 Hiring
 Orienting
 training
 Evaluating
 Counselling
 promoting
 compensating, and taking remedial action
• Standards for hiring the most qualified individuals demonstrate an
entity’s commitment to competent and trustworthy people.
• Hiring practices that include formal, in-depth employment interviews
and informative and insightful presentations on the company’s
history, culture, and operating style send a message that the company
is committed to its people.
• Personnel policies that communicate prospective roles and
responsibilities and that provide training opportunities indicate
expected levels of performance and behavior.
• Rotation of personnel and promotions driven by periodic
performance appraisals demonstrate the entity’s commitment to
advancement of qualified personnel to higher levels of responsibility..
• Competitive compensation programs that include bonus incentives
serve to motivate and reinforce outstanding performance.
• Disciplinary actions send a message that violations of expected
behavior will not be tolerated.
• Some issues involving competence may also involve HR issues (hiring,
training, etc.), and an issue identified may be a competence issue and
may also involve a control environment issue.
• In the COSO Framework, issues often may not neatly fall into only one
principle, but the important thing is that they be assessed and
Considered.
• In some cases it may be appropriate when using a formatted tool to
cross reference an issue that could be assessed in one place or
another in the documentation.
• Common sources of evidence regarding this principle include a full
review of HR policies and procedures and seeking some evidence that
the policies and documented procedures are actually in place.
• Seeking more evidence, such as when high reliance on controls is
sought, would perhaps lead to interviews or group discussions.
• Auditors and corporate project team members may be reluctant to
criticize the quantity or quality of accounting resources and
leadership, even when called for, since auditors have to work with
these individuals in the audit process. However, not addressing the
issue usually does not lead to a resolution and often just delays the
inevitable..
• Failing to note such deficiencies can be a source of business risk to the
auditor since professional standards require communication of
deficiencies that are significant or material. In addition, ignoring the
issue leads to continuing risk that a problem will arise that may not be
detected in a timely manner.
• In most cases the communication can be accompanied with some
remediation suggestions that can make the communication less of a
pure criticism.
PRINCIPLE 5: THE ORGANIZATION HOLDS
INDIVIDUALS
ACCOUNTABLE FOR THEIR INTERNAL CONTROL
RESPONSIBILITIES IN THE PURSUIT OF
OBJECTIVES
• Questions to be addressed
• How are personnel held accountable for internal control
responsibilities?
• Are performance indicators or metrics linked to incentives and
rewards?
• Are those responsible for the system of internal control evaluated
Activities….

• Obtain sign-offs on goals mutually agreed upon with management

and the board
• Develop incentives that are properly linked to performance
• Evaluate the appropriateness of awards
• Establish clear ways to communicate the basis for rewards
• Board and management periodic review of the appropriateness of
incentives and reward
• Evaluate link between incentives and organizational values
• control environment is highly dependent on every key person having
controls awareness. Controls are not likely to be effective if thought of
as the controller’s problem.
• Every individual in an organization has some role in implementing
internal control, and these roles and responsibilities will vary.
Point of focus
• Enforces Accountability through Structures, Authorities, and
Responsibilities
- Management and the board of directors establish the mechanisms to
communicate and hold individuals accountable for performance of
internal control responsibilities across the organization and implement
corrective action as necessary.
• Establishes Performance Measures, Incentives, and Rewards
-Management and the board of directors establish performance
measures, incentives, and other rewards appropriate for responsibilities
at all levels of the entity, reflecting appropriate dimensions of
performance and expected standards of conduct, and considering the
achievement of both short-term and longer-term objectives
cont.
• Evaluates Performance Measures, Incentives, and Rewards for Ongoing
Relevance
- Management and the board of directors align incentives and rewards with the
fulfillment of internal control responsibilities in the achievement of objectives.
• Considers Excessive Pressures
- Management and the board of directors evaluate and adjust pressures
associated with the achievement of objectives as they assign responsibilities,
develop performance measures, and evaluate performance.
• Evaluates Performance and Rewards or Disciplines Individuals
- Management and the board of directors evaluate performance of internal
control responsibilities, including adherence to standards of conduct and
expected levels of competence and provide rewards or exercise disciplinary
action as appropriate.
• Sources of evidence to support or refute adherence to this principle
can be
 management files and records regarding disciplinary actions
 issues reported via the hotline
 patterns of excessive turnover in specific business functions
 issues raised in interviews or focus group discussions.