Committee of Sponsoring Organizations of the Treadway Commission
From Wikipedia, the free encyclopedia
- For people named "Treadway", see Treadway (surname).
Committee of Sponsoring Organizations of the Treadway Commission (COSO), is a U.S. private-sector initiative, formed in 1985. Its major objective is to identify the factors that cause fraudulent financial reporting and to make recommendations to reduce its incidence. COSO has established a common definition of internal controls, standards, and criteria against which companies and organizations can assess their control systems.
COSO is sponsored and funded by 5 main professional accounting associations and institutes; American Institute of Certified Public Accountants (AICPA), American Accounting Association (AAA), Financial Executives Institute (FEI), The Institute of Internal Auditors (IIA) and The Institute of Management Accountants (IMA).
Contents |
[edit] History
Due to questionable corporate political campaign finance practices and foreign corrupt practices in the mid-1970s, the SEC and the U.S. Congress enacted campaign finance law reforms and the 1977 Foreign Corrupt Practices Act (FCPA) which criminalised transnational bribery and required companies to implement internal control programs. In response, a private-sector initiative, called the National Commission on Fraudulent Financial Reporting (commonly known as the Treadway Commission) was formed in October 1985. The Treadway Commission issued its initial report in 1987, and among other items, recommended that the organisations sponsoring the Commission work together to develop integrated guidance on internal control. As a result of this initial report, the Committee of Sponsoring Organisations (COSO) was formed and it retained Coopers & Lybrand, a major CPA firm, to study the issues and author a report regarding an integrated framework of internal control. The Coopers & Lybrand authored report, issued in 1992 and re-published with minor amendments in 1994, was entitled "Internal Control - Integrated Framework." This report presented a common definition of internal control and provided a framework against which internal control systems can be assessed and improved. This report is the standard that U.S. companies use to evaluate their compliance with FCPA.
[edit] Key Concepts
- Internal control is a process. It is a means to an end, not an end in itself.
- Internal control is effected by people. It’s not merely policy manuals and forms, but people at every level of an organization.
- Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board.
- Internal control is geared to the achievement of objectives in one or more separate but overlapping categories.
[edit] COSO Definition of Internal Control
Internal control is a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
- Effectiveness and efficiency of operations
- Reliability of financial reporting
- Compliance with applicable laws and regulations
[edit] COSO Internal Control Framework: the Five Components
Internal control consists of five interrelated components. These components provide an effective framework for describing and analyzing the internal control system implemented in an organization. The five components are the following:
Control environment: The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, management's operating style, delegation of authority systems, as well as the processes for managing and developing people in the organization.
Risk assessment: Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives and thus risk assessment is the identification and analysis of relevant risks to achievement of assigned objectives. Risk assessment is a prerequisite for determining how the risks should be managed.
Control activities: Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.
Information and communication: Information systems play a key role in internal control systems as they produce reports, including operational, financial and compliance-related information, that make it possible to run and control the business. In a broader sense, effective communication must ensure information flows down, across and up the organization. Effective communication should also be ensured with external parties, such as customers, suppliers, regulators and shareholders.
Monitoring: Internal control systems need to be monitored--a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities or separate evaluations. Internal control deficiencies detected through these monitoring activities should be reported upstream and corrective actions should be taken to ensure continuous improvement of the system.
[edit] COSO Enterprise Risk Management Framework: Now Eight Components
In 2004 COSO published Enterprise Risk Management - Integrated Framework, expanding the initial COSO framework.
The eight components - additional components highlighted - are:
- Internal Environment
- Objective Setting
- Event Identification
- Risk Assessment
- Risk Response
- Control Activities
- Information and Communication
- Monitoring
[edit] COSO ICOFR - Guidance for Smaller Public Companies
Published in 2006, Internal Control over Financial Reporting - Guidance for Smaller Public Companies aims at supporting smaller organisations in implementing adequate internal controls over financial reporting (ICOFR).
[edit] The Role of Internal Audit
Internal auditors play an important role in evaluating the effectiveness of control systems. As an independent function reporting to the top management, Internal Audit is able to assess the internal control systems implemented by the organization and contribute to ongoing effectiveness. As such internal audit often plays a significant monitoring role. In order to preserve its independence of judgment Internal Audit should not take any direct responsibility in designing, establishing, or maintaining the controls it is supposed to evaluate. It may only advise on potential improvement to be made.
