Agenda - Council - 06/09/2015 - Laserfiche WebLink

Home

COSO INTERNAL CONTROL FRAMEWORK The clarified auditing standards applicable to governmental audits incorporate a definition of internal control that is based on the internal control integrated framework developed and issued in 1992 by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In May 2013, COSO issued an updated framework which supersedes the original after December 15, 2014. The new COSO framework retains the basic definition of internal control and its five components established in its original framework, along with the fundamental requirements to consider these five components and to use judgment when assessing and evaluating the effectiveness of a system of internal controls. The new COSO framework enhances and clarifies a number of concepts from the original framework to make it easier to use and apply. One of the more significant enhancements was the establishment of 17 principles, associated with the 5 components of internal control, intended to assist users in understanding the requirements of effective internal control and designing effective systems of internal control. The 5 components of internal control and 17 underlying principles are as follows: Control Environment — 1. Organization demonstrates a commitment to integrity and ethical values. 2. Governing body is independent from management and exercises oversight control. 3. Management establishes structure, reporting lines, authority, and responsibilities. 4. Organization demonstrates a commitment to the competence of individuals involved with internal control. 5. Organization holds individuals accountable for internal control responsibilities. Risk Assessment — 6. Organization specifies clear objectives for the identification and assessment of risks. 7. Organization identifies and analyzes risk. 8. Organization assesses the potential for fraud risks. 9. Organization identifies and assesses significant changes that could impact internal control. Control Activities — 10. Organization selects and develops control activities to mitigate risks. 11. Organization selects and develops general IT controls. 12. Organization establishes and implements control policies and procedures. Information and Communication — 13. Organization uses relevant, quality information to support internal control. 14. Organization communicates internal control information internally. 15. Organization communicates internal control information externally. Monitoring — 16. Organization conducts ongoing and/or separate internal control evaluations. 17. Organization evaluates and communicates deficiencies to responsible parties for corrective action. COSO defines an effective system of internal control as one that reduces to an acceptable level the risk of failing to achieve an organizational objective in the areas of operations, compliance, or reporting. According to the new framework, an organization can achieve effective internal control by applying all of the principles listed above. To achieve this, each of these five components and the relevant principles must be present and functioning, and the five components must operate in an integrated manner. Local governments should be reviewing their internal control systems to assure these principles have been incorporated and implemented. -21-