COSO Based Auditing

Committee
Of
Sponsoring
Organizations
of Treadway Commission
Benefits of Embracing COSO
• Comparability
 Recognized Internal Control Framework world wide
 Using a common audit framework and rating system enables the controls in
different business segments to be contrasted.

• Enhanced Value to Management and the Audit Committee

 Reporting in terms of the COSO framework helps to portray strengths and
weaknesses on the internal control system.
 Assist to discharge the ARC and the Board responsibility in providing conclusion for
Statement of Internal Control.

• Communication
 Integrating COSO criteria in discussions with Auditee enhances their
understanding of internal control concepts.

• Effectiveness and Efficiency

 Focused COSO objectives
 Testing all five COSO control components provides a solid foundation for
determining the degree of assurance provided by controls
 Benefits of Embracing COSO
• Better articulate fundamental principles of Internal Control.

• Produce a comprehensive and balanced picture of the entire control

system in a relatively short period of time.

• Provide consistent criteria across processes.

• Significant issues can be diagnosed in a collegial manner, enabling

management to focus on findings solutions rather than fixing blame.

• Moving the company along the continuum from imperfect to

enhanced controls in a constructive way, thus helping to ensure
continued organizational health and well-being.
VALUE to the stakeholders
 Assist to discharge the ARC and the Board responsibility in
providing conclusion for Statement of Internal Control.
 Helps to evaluate health or the scorecard of the Company’s
internal control system based on the 5 core IC Elements.
 Provide consistent criteria across processes to understand
further root causes of failure in controls.
 Complement benchmarking since it’s a recognised Internal
Control Framework worldwide.
 Awareness to the auditees and employees across the
organisation in enhancing understanding of internal controls.
COSO Framework and
It’s Elements
COSO
Definition of Internal Control
Internal control is a process, effected by an entity’s board
of directors, management and other personnel, designed
to provide reasonable assurance regarding the
achievement of objectives in the following categories:

1. Effectiveness and efficiency of operations

2. Reliability of financial reporting
3. Compliance with applicable laws and regulations
COSO Internal Control
Integrated Framework

on
Monitoring

Info
ati
ic

rm
un
mm

a
tio
Control Activities

n&
Co

Co
n&

Risk Assessment
tio

mm
a
rm

un
ic
Info

a ti
Control Environment

on
An internal control system is judged to be effective if the five components are present and
functioning effectively for operations, financial reporting, and compliance.
COSO Control Elements

Sets the tone of an Identifies and analyzes

organization and risks to achieving
serves as a objectives. Determines
foundation for all how risk should be
other components managed.
I. Control II. Risk
Environment Assessment

The ongoing V. Monitoring III. Control

Activities Encompass policies
assessment of and practices along
internal control quality IV. with process-level
to assure controls are Information procedures that
operating as intended & Communication ensure
management’s
directives are carried
out
Captures and exchanges relevant
information to use as a basis for
decision making. Also, effectively
communicates roles and
responsibilities for maintaining
internal controls.
Current vs. COSO Methodology

Current Method COSO Method

 Hard control  Includes soft

ie control, such
organisation as control
chart, Policy environment
& Procedure
etc.
 Operational
efficiency and
effectiveness
 Compliance
Testing
Your Role as Process Owner

• Educate your personnel and reinforce internal focus on

controls within your area
• Surface any risks, concerns or issues promptly to allow
adequate attention for correction (don’t wait for an
audit!)
• Fix control gaps as soon as possible
Your Role as Process Owner
General expectations
• Acknowledge responsibility for the design, implementation
and maintenance of the control structure within your
business processes
• Contribute direction to identify, prioritize and review risks
and controls
• Remove obstacles for compliance; remedy control
deficiencies
• Continue or begin a program of self-assessment and testing
to monitor the controls within your processes
The End