2013 COSO Framework

Deloitte Training
Agenda

Module Topic
Module 1 COSO Background
Module 2 Objectives of Internal Control
Module 3 Effective Internal Control
Module 4 Additional Considerations
Module 5 Control Environment
Module 6 Risk Assessment
Module 7 Control Activities
Module 8 Information and Communication
Module 9 Monitoring Activities
Module 10 Considerations and Next Steps
Module 11 Resources Available

1 Copyright 2013 Deloitte Development LLC. All rights reserved.

Course Objective
Provide an overview of COSOs structure and mission
Provide an overview of the COSO1 2013 framework, including:
What was carried forward
Broad changes
Transition guidance
Conduct practical implementation examples facilitated through directed
questions and activities
Plan the considerations and next steps during the transition period,
using the available tools and resources

2 1 Committee of Sponsoring Organizations of the Treadway Commission Copyright 2013 Deloitte Development LLC. All rights reserved.
Module 1
COSO Background
Background
COSOs structure and mission COSO

AAA AICPA FEI IMA IIA

COSO is a joint initiative of five sponsoring organizations

American Accounting Association (AAA)
American Institute of Certified Public Accountants (AICPA)
Financial Executives International (FEI)
Institute of Management Accountants (IMA)
Institute of Internal Auditors (IIA)

to provide thought leadership through the development of comprehensive

frameworks and guidance on enterprise risk management, internal control and
COSOs fraud deterrence designed to improve organizational performance and
mission is governance and to reduce the extent of fraud in organizations.

www.coso.org/aboutus.htm

6 Copyright 2013 Deloitte Development LLC. All rights reserved.

Background
Enhancing COSOs 1992 Framework
Project initiated to address changes in the business and
operating environments since the1992 Internal Control-
Integrated Framework (the 1992 Framework) was
published
Directed and supervised by COSOs Board of Directors (the
Board) with input from the following:
Over 700 survey respondents
An Advisory Council comprised of representatives from:
Companies
Academia
Government agencies
The accounting profession
Nonprofit organizations
Responses to public exposure of documents
7 Copyright 2013 Deloitte Development LLC. All rights reserved.
Background
Enhancing COSOs 1992 Framework

The update project includes:

Executive Summary

Internal Control Integrated Framework (2013 Framework)

Illustrative Tools for Assessing Effectiveness of a System of

Internal Control
Internal Control over External Financial Reporting (ICEFR): A
Compendium of Approaches and Examples

Other COSO documents:

Guidance on Monitoring Internal Control Systems

Enterprise Risk Management Integrated Framework

8 Copyright 2013 Deloitte Development LLC. All rights reserved.

Background
COSO transition guidance

Transition period: May 14, 2013 December 15, 2014

COSO will consider the 1992 Framework superseded after
December 15, 2014
If applying and referencing COSOs Internal Control
Integrated Framework for external reporting purposes
External reporting should clearly disclose whether the 1992 or
2013 Framework was utilized

9 Copyright 2013 Deloitte Development LLC. All rights reserved.

Transition
SEC and PCAOB
The SEC has not issued formal transition guidance
SEC Chief Accountant Paul Beswick stated the following:
The SEC staff plans to monitor the transition for issuers using the
1992 framework to evaluate whether and if any staff or
Commission actions become necessary or appropriate at some
point in the future. However, at this time, Ill simply refer users of
the COSO framework to the statements COSO has made about
their new framework and their thoughts about transition.
The PCAOB has not issued formal or informal
transition guidance to auditors
PCAOB Auditing Standard No. 5 requires the auditor to use
the same internal control framework used by management

10 Copyright 2013 Deloitte Development LLC. All rights reserved.

2013 Framework and guidance
What was carried forward from the 1992 Framework?

Definition of internal control

A process, effected by an entitys board of directors, management and other

personnel, designed to provide reasonable assurance regarding the
achievement of objectives in the following categories:
Effectiveness and efficiencies of operations
Reliability of reporting
Compliance with applicable laws and regulations

Five components of internal control

Use of judgment in evaluating effectiveness of internal
control

12 Copyright 2013 Deloitte Development LLC. All rights reserved.

2013 Framework and guidance
General enhancements to the 1992 Framework

The 2013 Framework:

Creates a more formal structure for the design and evaluation
of the effectiveness of internal control
Adds and refreshes guidance within each of the components
of internal control

Information
Control Risk Control Monitoring
&
Environment Assessment Activities Activities
Communication

13 Copyright 2013 Deloitte Development LLC. All rights reserved.

2013 Framework and guidance
Structure

2013 Framework ICEFR

Compendium
Components
Approaches

Principles Illustrative Tools

Examples

Points of Focus
Templates

Scenarios

14 Copyright 2013 Deloitte Development LLC. All rights reserved.

2013 Framework and Guidance
Components Summarized Principles

1. Demonstrates commitment to integrity and ethical values

2. Exercises oversight responsibility
Control Environment 3. Establishes structure, authority and responsibility
4. Demonstrates commitment to competence
5. Enforces accountability

6. Specifies relevant objectives

7. Identifies and analyzes risk
Risk Assessment 8. Assesses fraud risk
9. Identifies and analyzes significant change

10. Selects and develops control activities

Control Activities 11. Selects and develops general controls over technology
12. Deploys through policies and procedures

13. Uses relevant information

Information & 14. Communicates internally
Communication 15. Communicates externally

16. Conducts ongoing and/or separate evaluations

Monitoring Activities 17. Evaluates and communicates deficiencies

15 Copyright 2013 Deloitte Development LLC. All rights reserved.

2013 Framework and Guidance
Specific significant enhancements to the 1992 Framework that may pose
challenges to management:

Risk Assessment
More detailed discussions about risk assessment concepts, including those related
to inherent risk, risk tolerance, how risks may be managed, and linkage between
risk assessment and control activities
Considering the potential for fraud risk when assessing risks to the achievement of
an organizations objectives

Outsources Service Providers (OSPs)

Considerations related to OSPs are included throughout the framework, including
12 out of 17 principles
Requires management to specifically consider how OSPs are monitored

Information Technology (IT)

Considerations related to IT are included in 14 of 17 principles
Discussion of using IT to assist in continuous monitoring
Requirements for ensuring quality of information (data integrity)

17 Copyright 2013 Deloitte Development LLC. All rights reserved.

2013 Framework
Effective system of internal control

Per COSO, an effective system of internal control requires:

Each of the five components of internal control and relevant
principles to be present and functioning
The five components to be operating together in an integrated
manner
Control
Environment

Risk
Monitoring
Assessment

Information and Control

Communication Activities

18 Copyright 2013 Deloitte Development LLC. All rights reserved.

Comparison of COSO to other rules
Effective system of internal control in ICEFR context
COSO SEC1 PCAOB2
Present: the determination Under the Commissions Design effectiveness:
that components and rules, managements annual Controls (if they are
relevant principles exist in assessment of the operated as prescribed by
the design and effectiveness of ICFR must persons possessing the
implementation of the be made in accordance necessary authority and
system of internal control with a suitable control competence to perform the
frameworks [COSO] control effectively) that
Functioning: the definition of effective satisfy the company's
determination that internal control. These control objectives and can
components and relevant control frameworks define effectively prevent or detect
principles continue to exist elements of internal control errors or fraud that could
in the conduct of the system that are expected to be result in material
of internal control present and functioning in misstatements in the
an effective internal control financial statements
system.
Operating effectiveness:
Controls that operate as
designed and are performed
by persons possessing the
necessary authority and
competence to perform the
control effectively
1 Securities and Exchange Commission (SEC) Securities Act Release No. 33-8810, File No. S7-24-06 (June 27, 2007)
2 As defined by Public Company Accounting Oversight Board (PCAOB) Auditing Standard No. 5, An Audit of Internal Control Over Financial

Reporting that is Integrated with an Audit of Financial Statements; Para. 4245

19 Copyright 2013 Deloitte Development LLC. All rights reserved.
Comparison of COSO to other rules
Internal control deficiency in ICEFR context
COSO SEC1 PCAOB2
Internal control A deficiency in the A deficiency in
deficiency: A design of ICFR exists internal control over
shortcoming in a when (a) necessary financial reporting
component or controls are missing exists when the
components and or (b) existing design or operation of
relevant principle(s) controls are not a control does not
that reduces the properly designed so allow management or
likelihood that the that, even if the employees, in the
entity can achieve its control operates as normal course of
objectives designed, the performing their
financial reporting assigned functions, to
risks would not be prevent or detect
addressed misstatements on a
timely basis

1 As defined by Securities Act Release No. 33-8810, File No. S7-24-06 (June 27, 2007); Footnote 29
2 Asdefined by PCAOB Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial
Statements; Appendix A: Definitions, A3

20 Copyright 2013 Deloitte Development LLC. All rights reserved.

Comparison of COSO to other rules
Significant deficiency in ICEFR context
COSO SEC1 PCAOB2
COSO does not define The term significant A significant
significant deficiency, deficiency means a deficiency is a
however, COSO deficiency, or a deficiency, or a
acknowledges that when combination of combination of
an entity is applying a deficiencies, in internal deficiencies, in internal
law, rule, regulation, or control over financial control over financial
external standard, reporting that is less reporting that is less
management should use severe than a material severe than a material
only the relevant criteria weakness, yet important weakness, yet important
contained in those enough to merit enough to merit
documents to classify attention by those attention by those
the severity of internal responsible for oversight responsible for oversight
control deficiencies. of the registrants of the company's
financial reporting financial reporting

1 As defined by Securities Act Release No. 33-8829, File No. S7-24-06 (September 10, 2007)
2 As defined by PCAOB Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial

Statements; Appendix A: Definitions, A11

21 Copyright 2013 Deloitte Development LLC. All rights reserved.

Comparison of COSO to other rules
Major deficiency and material weakness in ICEFR context
COSO SEC1 PCAOB2
An internal control The term material A material weakness is
deficiency or weakness is a a deficiency, or a
combination of deficiency, or a combination of
deficiencies that combination of deficiencies, in internal
severely reduces the deficiencies, in internal control over financial
likelihood that the entity control over financial reporting, such that
can achieve its reporting such that there there is a reasonable
objectives is referred to is a reasonable possibility that a material
as a major deficiency possibility that a material misstatement of the
misstatement of the company's annual or
registrants annual or interim financial
interim financial statements will not be
statements will not be prevented or detected
prevented or detected on a timely basis
on a timely basis

1 As defined by Securities Act Release No. 33-8809, File No. S7-24-06 (June 20, 2007)
2 As defined by PCAOB Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial

Statements; Appendix A: Definitions, A7

22 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 2
Objectives of Internal Control
Relationship of Objectives, Components and the
Entity
Definitions
Objectives: Are what an entity desires to achieve.

Components: Represent what is required to achieve objectives.

Entity Structure: Represent the operating units, legal entities and

other structures

A direct relationship exists between objectives,

components, and the entity structure which can
be depicted in the form of a cube.
The objectives are represented by the columns.
The components are represented by the rows.
The entity structure is represented by the third
dimension of the cube

24 Copyright 2013 Deloitte Development LLC. All rights reserved.

Objectives Defined
Internal control is a process effected by an entities board
of directors, management and other personnel, designed
to provide reasonable assurance regarding the
achievement of objectives relating to operations,
reporting and compliance.
Management, with board oversight, sets entity level
objectives that align with the entitys vision, mission &
strategies. The framework groups objectives into the
following three categories:
Operations Pertain to the effectiveness and efficiency of the entitys
operations, including operational and financial performance goals and
safeguarding of assets against loss.
Reporting Pertain to internal and external financial and non financial reporting.
Encompasses reliability, timeliness, transparency and other characteristics
defined by regulators, standard setters or the entitys policy.
Compliance Pertain to the adherence to laws and regulations to which the
entity is subject.
25 Copyright 2013 Deloitte Development LLC. All rights reserved.
Objectives - Operations
Operations objectives relate to the achievement of an
entitys basic mission and vision the fundamental
reason for its existence.

These objectives relate to all entities but will vary based on

managements choices relating to operating model, industry
considerations, and the entities performance.

May relate to improving financial performance, productivity,

quality, environmental practices, innovation, customer
satisfaction etc.

If an entitys operations objectives are not well defined (i.e.,

aligned to mission & vision) or clearly specified its
26
resources may be misdirected. Copyright 2013 Deloitte Development LLC. All rights reserved.
Objectives Operations (cont.)
The operations objective includes safeguarding of assets
Entities may set objectives relating to the prevention of loss of
assets and the timely detection and reporting of any such losses
These objectives form the basis of assessing risk relating to the
safeguarding of assets and selecting and developing controls
needed to mitigate such risk
Some entities consider safeguarding of assets a separate
category of objective
Laws, rules, regulations, and external standards have created an
expectation that management reporting on internal control
includes controls relating to preventing and detecting
unauthorized acquisition, use, or disposition of entity assets.

27 Copyright 2013 Deloitte Development LLC. All rights reserved.

Objectives Reporting
Pertains to the preparation of reports for use by organizations and
stakeholders and may relate to financial or non-financial reporting
and to internal or external reporting.

External Financial Reporting External Non- Financial

Objectives Objectives

Annual Financial Statements Internal Control Reports

Interim Financial Statements Sustainability Reports
Internal / External

Earning Releases Supply Chain / Custody of Assets

Internal Financial Reporting Internal Non-Financial

Objectives Objectives

Divisional Financial Reports Staff / Asset Utilization

Customer Profitability Analysis Customer Satisfaction Measures
Bank Covenant Calculations Health and Safety Measures

Financial / Non Financial

28 Copyright 2013 Deloitte Development LLC. All rights reserved.
Objectives Compliance
The compliance objective pertains to the adherence to applicable
laws and regulations that apply across the entity.

As part of specifying compliance objectives, organizations need

to understand which laws, rules and regulations apply across the
entity.
Laws, rules and regulations establish minimum standards of
conduct expected of the entity. Entities are expected to
incorporate these standards into the objectives set for the
organization.
Some entities will set objectives utilizing a higher level of
performance and management can exercise discretion in this
regard
For example, while a law may limit minors working more than
18 hours in a school week, an organization may set an
objective that limits its minor-age staff to working 15 hours per
week.
29 Copyright 2013 Deloitte Development LLC. All rights reserved.
Module 3
Effective Internal Control
Module 3 - Agenda

Requirements for Effective Internal Control

Suitability & Relevance of Components and Principles

a) Present & Functioning
b) Operating Together in an Integrated Manner

Deficiencies in Internal Control

32 Copyright 2013 Deloitte Development LLC. All rights reserved.

2013 Framework
Requirements for Effective Internal Control

Per COSO, an effective system of internal control requires:

Achievement of objectives relating to one, two, or all three
objective categories (i.e., operations, reporting, and
compliance)
Each of the five components of internal control and relevant
principles to be present and functioning
The five components and relevant principles to be operating
together in an integrated manner Control
Environment

Risk
Monitoring
Assessment

Information and Control

Communication Activities

33 Copyright 2013 Deloitte Development LLC. All rights reserved.

COSO Internal Control Framework
Requirements for Effective Internal Control
For internal control to be effective, senior management
and the board of directors have reasonable assurance of the
following categories of objectives:
Operations
Reporting
Compliance

For an effective system the senior management should have reasonable

assurance that the system of internal control reduces to an acceptable
level, the risk of not achieving an objective relating to one, two, or all three
categories.

34 Copyright 2013 Deloitte Development LLC. All rights reserved.

COSO Internal Control Framework
Suitability & Relevance of Components and Principles

The Framework views all components of internal control as

suitable and relevant to all entities

The 17 principles explain the concepts associated with the five

COSO components. As such, the presumption is that all 17
principles are relevant to all entities.

If a relevant principle is not present and functioning, the

associated component cannot be present and functioning.
In the rare instance that Management determines that a principle is not
relevant to a component, Management must support its determination that
a principle is not relevant with the rationale of how, in the absence of that
principle, the associated component can be present and functioning
Note: While the points of focus may help management design, implement, and
evaluate internal control and assess whether relevant principles are present and
functioning, they are not required for assessing the effectiveness of internal control.
35 Copyright 2013 Deloitte Development LLC. All rights reserved.
COSO Internal Control Framework
Suitability & Relevance of Components and Principles:
Present & Functioning
Per 2013 Framework, an effective system of internal control
requires each of the five components and relevant principles
to be present and functioning.

Present is defined as the determination that components

and relevant principles exist in the design and
implementation of the system of internal control to achieve
specified objectives.

Functioning is defined as the determination that

components and relevant principles continue to exist in the
conduct of the system of internal control to achieve
specified objectives.

36 Copyright 2013 Deloitte Development LLC. All rights reserved.

COSO Internal Control Framework
Suitability & Relevance of Components and Principles:
Operating Together
Operating together refers to the determination that all five
components collectively reduce, to an acceptable level, the
risk of not achieving an objective.
Management can demonstrate that Control
components operate together when: Environment

The components are present and Monitoring

Risk
Assessment
functioning.

Internal control deficiencies aggregated

across components do not result in the Information and Control
determination that one or more major Communication Activities

deficiencies exist.

37 Copyright 2013 Deloitte Development LLC. All rights reserved.

Key Terminology Updates - Overview
Deficiency Terminology Comparison
Deficiency COSO SEC PCAOB
Internal Control
X
Deficiency
Deficiency X X
COSO does not define significant
Significant Deficiency deficiency, although they do note,
For purposes of applying the
Framework to external financial
reporting, management must apply
laws, rules, regulations, and X X
standards appropriate for the entity
in evaluating, classifying, and
reporting internal control
deficiencies.

Major Deficiency
(equivalent of X
material weakness)
Material Weakness
(equivalent of major X X
deficiency)

38 Copyright 2013 Deloitte Development LLC. All rights reserved.

Effective Internal Control
Operating together in an integrated manner
The template below is an Illustrative Tool that can be used as a logical structure
to help management analyze and document the organizations assessment of
internal control, including the requirement that the five components and relevant
principles operate together in an integrated manner
Once you have identified a control deficiency, how do you plan to assess the
impact to other components?

39 Copyright 2013 Deloitte Development LLC. All rights reserved.

Activity: Evaluating Control Deficiencies Team

Refer to the Illustrative Tool in the previous slide to help you think of how to assess
the effectiveness of the system of internal control and document the assessment to
ensure the 5 components are operating together in an integrated manner in the
examples below.
As a table group, discuss the following examples:
1. Errors were identified in a critical excel analysis supporting warranty reserves.
The analysis included and incorrect formula. Further, due to recent significant
quality issues, and an incorrect assumption was used. Both errors resulted in an
understatement of the p&l and an under accrual in the warranty reserve. Errors
were identified by the auditors.
2. A company had a significant FCPA violation related to payments being made to a
government official in China. The company found out about the violation when
one of their managers in China was arrested.
Which principles and components have been impacted by these deficiencies?
Consider whether the principles are present and functioning and operating together
in an integrated manner.

Read Handout 5 minutes

Table Activity 5 minutes
Group Debrief 10 minutes

40 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 4
Additional Considerations
Module 4 - Agenda

Judgment
Points of focus
Controls to effect principles
Organizational boundaries
Technology
Larger versus smaller entities
Benefits and costs of internal control
Documentation

42 Copyright 2013 Deloitte Development LLC. All rights reserved.

Judgment
An effective system of internal control demands more
than rigorous adherence to policies and procedures: it
requires the use of judgment.
Management exercises judgment in areas such as:
Applying internal control components relative to categories of objectives
Applying internal control components and principles within the entity structure
Specifying suitable objectives and sub-objectives and assessing risks to
achieving these objectives
Selecting, developing, and deploying controls necessary to effect principles
Assessing whether components are present, functioning, and operating
together
Assessing whether principles are relevant to the entity and present and
functioning
Assessing the severity of internal control deficiencies

43 Copyright 2013 Deloitte Development LLC. All rights reserved.

Points of focus
Important characteristics of the principles 87 in total
Assist management in designing, implementing and evaluating internal control
and assessing whether relevant principles are present and functioning
May determine some are not suitable or relevant and others may be identified
Framework does not require that management assess separately that the points
of focus are in place when evaluating the effectiveness of internal control
Example:
Control component:
Control environment
Principle 1:
The organization demonstrates a commitment to integrity and ethical values.
Points of focus:
Sets the tone at the top
Establishes standards of conduct
Evaluates adherence to standards of conduct
Addresses deviations in a timely manner
44 Copyright 2013 Deloitte Development LLC. All rights reserved.
Controls to effect principles
The Framework does not prescribe specific controls that must be selected,
developed and deployed for an effective system of internal controls.
The controls an organization selects to effect the principles and components is
a function of management judgment based on factors unique to the
organization.
The absence of controls necessary to effect the relevant principles represents
an internal control deficiency.
Management may consider other controls (whether or not associated with that
particular component or principle) that compensate for an internal control
deficiency.
Control component:
Control activities
Principle 10:
The organization selects and develops control activities that contribute to the
mitigation of risks to the achievement of objectives to acceptable levels.
Controls embedded in other components may effect this principle, e.g.:
Control Activity #1 Control Activity #2 Control Activity #3
Risk Information & Monitoring
Assessment Communication Activities
45 Copyright 2013 Deloitte Development LLC. All rights reserved.
Organizational boundaries

One of the significant additions to the 2013 Framework is the

incorporation of considerations related to outsourced service
providers (OSPs.)
In todays environment, many organizations choose to outsource
business or information technology processes and related
activities to OSPs.
Dependency on OSPs changes the risks of business activities,
increases the importance of the quality of information and
communications from outside the organization, and creates
challenges in overseeing activities and related controls.
Management still retains responsibility for the system of internal
control.
Important for users of the 2013 Framework to consider how the
use of OSPs may effect the components and relevant principles
within their overall system of internal control
Third Party (i.e. vendors) vs. OSPs
46 Copyright 2013 Deloitte Development LLC. All rights reserved.
Activity: Outsourced Service Providers Team

Refer to Handout 1 Heads Up: COSO Enhances its Internal Control

Integrated Framework (6/10/13) Appendix B - Summary of Concepts
and Discussion in the 2013 Framework Related to the Use of Outsourced
Service Providers (OSPs)
As a table group, discuss the following questions:
1. Have you identified a population/inventory of OSPs where key
internal controls have been outsourced and evaluated the
effectiveness of your Companys monitoring procedures over the
control activities performed by the OSPs? Do your contracts with
OSPs contain a requirement to provide a SOC1/SOC2 report?
2. How does the entity ensure the organizations expectations for
integrity and ethical values are understood by the OSPs?
3. As companies may now need to enhance existing practices and
documentation around third-party oversight/governance, do you
think your company has solid controls around OSPs?

Read Handout 5 minutes

Table Activity 5 minutes
Group Debrief 10 minutes
47 Copyright 2013 Deloitte Development LLC. All rights reserved.
Technology

The Framework uses the term technology to refer to all

computerized systems, including software applications
running on a computer and operational control systems.
The principles presented in the 2013 Framework do not
change with the application of technology.
Technology affects how an organization designs,
implements, and conducts internal control; but, the same
principles remain suitable and relevant.

48 Copyright 2013 Deloitte Development LLC. All rights reserved.

Activity: Technology Team

Refer to Handout 1 Heads Up: COSO Enhances its Internal Control

Integrated Framework (6/10/13) Appendix C Summary of Concepts
and Discussion in the 2013 Framework Related to Information Technology
As a table group, discuss the following questions:
1. How have you considered changes in IT and their impact on
control effectiveness ?
2. How do you leverage IT to support completeness and accuracy of
information?
3. How do you leverage IT to support continuous monitoring?
4. Have you considered how effective your IT security system is, with
respect to internal security and external security, i.e. cyber
security?

Read Handout 5 minutes

Table Activity 5 minutes
Group Debrief 10 minutes

49 Copyright 2013 Deloitte Development LLC. All rights reserved.

Larger versus Smaller Entities
Internal control components and principles are applicable for both large
and small entities; however, implementation approaches may vary.

Benefits and costs of internal control

Internal control provides many benefits to an entity ; however, there are
costs that Management must weigh to strike the right balance of
making the right use of the entitys resources, mitigating the areas of
greatest risk and complexity and meeting the entitys objectives.

Documentation
Management must determine the level/extent of documentation
needed to assess the effectiveness of internal control.
Some level of documentation is always necessary to assure
management that each of the components and relevant principles
is present and functioning and components are operating
together.

50 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 5
Control Environment
Module 5 - Agenda

Control Environment Overview

Discussion of Principles

Points of Focus

Enhanced Aspects

ICEFR Approaches and Examples

52 Copyright 2013 Deloitte Development LLC. All rights reserved.

Control Environment Overview

1.
3. Establishes
Demonstrates 4.
Commitment to 2. Exercises structure,
authority and Demonstrates 5. Enforces
Integrity and Oversight
responsibility Commitment to Accountability
Ethical Values Responsibility
Competence

Principles of Component

53 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 1
Demonstrates Commitment to Integrity and Ethical Values

The organization demonstrates a commitment to integrity

and ethical values
Management and the board of directors or equivalent
oversight body establish the standards and mechanisms
for the organization to understand and adhere to doing
what is right, and define the process and resources for
interpreting and addressing the potential for deviations

Points of Focus
Sets the tone at the top
Establishes standards of conduct
Evaluates adherence to standards of conduct
Addresses deviations in a timely manner

54 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 1
Demonstrates Commitment to Integrity and Ethical
Values (cont.)

Summary of Enhanced Concepts of Principle 1:

Integrity as a prerequisite to ethical behavior and an effective system of

internal control
Need to consider impacts of control environment across the structure
Importance of:
- Tone at the top as set by the board of directors and management
- Establishing standards of conduct for employees and outsourced service
providers (OSPs)
- Evaluating adherence to expected standards and addressing any deviations
in a timely manner

55 Copyright 2013 Deloitte Development LLC. All rights reserved.

 Principle 1
Demonstrates Commitment to Integrity and Ethical
Values (cont.)
ICEFR ICEFR
Approaches Examples
Establishing standards of Defining, communicating, and regularly updating
conduct the code of business conduct and ethical standards

Leading by example on Using a company newsletter to reinforce

matters of integrity and ethics expectations of integrity and ethics
Evaluating management and
other personnel, outsourced Evaluating misconduct reported through an
service providers, and anonymous hotline
business partners for
adherence to standards of Conducting Ethics Audits
conduct
Developing processes to
report and promptly act on
Taking action when deviations occur
deviations from standards of
conduct

56 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Evaluating Misconduct Reported through an Anonymous
Hotline

All-World Food Distributors provides an anonymous hotline

for employees to report potential fraud and other ethical
concerns. The entity engages a third-party service provider to
administer the hotline to provide the comfort of anonymity for
its employees. This service immediately reports any potential
illegal acts or financial reporting improprieties directly to the
companys legal department and audit committee. Issues and
trends are analyzed and conclusions are reported to the audit
committee of the board.

57 Copyright 2013 Deloitte Development LLC. All rights reserved.

Discussion Question

As it relates to the whistle blower hotline, how would

management demonstrate that the program is effective?
What documentation/evidence of the program's effectiveness
would support this?

58 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 2
Exercises Oversight Responsibility

The board of directors demonstrates independence from

management and exercises oversight of the development
and performance of internal control
The board of directors or equivalent oversight body (the
board) understands the business and expectations of
stakeholders, including customers, employees, investors,
and the general public, as well as legal regulatory
requirements and related risks
Points of Focus
Establishes oversight responsibilities
Applies relevant expertise
Operates independently
Provides oversight for the system of internal control
59 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 2
Exercises Oversight Responsibility (cont.)

Summary of Enhanced Concepts of Principle 2:

Expanded discussion of governance concepts, including the need to

establish oversight responsibilities for the board and its committees
Matters related to board independence, skills, and expertise
Includes a detailed table illustrating board oversight responsibilities for each
of the five components of internal control

60 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 2
Exercises Oversight Responsibility (cont.)
ICEFR ICEFR
Approaches Examples
Establishing the roles,
Reviewing and documenting key activities of the
responsibilities, and delegation of
audit committee
authority of the board of directors

Establishing policies and practices Establishing an audit committee meeting

for meetings between the board of calendar
directors and management
Changing the board composition of a closely
Identifying and reviewing board of held company
director candidates Assessing and Disclosing Director Qualifications
Reviewing managements Reviewing financial statement estimates
assertions and judgments

Obtaining an external view Interacting with auditors

Considering whistle-blower Assessing the potential of management override

information about financial Investigating and reporting whistle-blower
statement errors and irregularities allegations
61 Copyright 2013 Deloitte Development LLC. All rights reserved.
ICEFR Compendium - Example
Reviewing and documenting key activities of the audit
committee
Every year the board of Directors of Northern Power, a distributor of electricity, commissions
an effective evaluation of its audit committee. An independent consultant with expertise in
governance reviews the means by which the audit committee fulfills its responsibilities, as
set out in its charter. Specially, it evaluates how the member of the audit committee:
Oversee the quality and reliability of financial reporting and disclosures
Understand the key risks facing the organization and the processes management uses to identify,
assess and manage risks, considering internal audit findings, litigations, compensation schemes,
regulations and compliance
Evaluate organizational behavior, culture, and adherence to standards of conduct
Challenge management and the external auditor in determining materiality for financial reporting
purposes
Assess reasonableness and appropriateness of critical accounting policies of the company
Confirm or reject the basis for management estimates and proposed accounting policies changes
before approving
Evaluate, retain, or change external auditors
Review audit plans
Review managements assessment of internal control over external financial reporting

The results of the evaluation are used to determine whether the roles and responsibilities of
the committee have been met and could result in committee member changes or impact
remuneration. In addition to the annual review, every three years the company conducts a
benchmark review against leading practices and refines its charter as appropriate.
62 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 3
Establishes Structure, Authority, and Responsibility
Management establishes, with board oversight, structures,
reporting lines, and appropriate authorities and responsibilities in
the pursuit of objectives
Senior management and the board of directors establish the
organizational structure and reporting lines necessary to plan,
execute, control, and periodically assess the activities of the
entity, in other words carry out their oversight responsibility
Points of Focus
Considers all structures of the entity
Establishes reporting lines
Defines, assigns, and limits authorities and responsibilities
Board of Directors
Senior Management
Management
Personnel
Outsourced Service Providers
63 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 3
Establishes Structure, Authority, and Responsibility (cont.)

Summary of Enhanced Concepts of Principle 3:

Defining, assigning, and limiting authority and responsibility at different

organizational levels and along the various lines of reporting (e.g.,
considering product or service lines, legal entity structures, geographical
markets, and arrangements with OSPs).

64 Copyright 2013 Deloitte Development LLC. All rights reserved.

 Principle 3
Establishes Structure, Authority, and Responsibility (cont.)

ICEFR ICEFR
Approaches Examples
Defining roles and reporting lines and Reorganizing to support control structure
assessing them for relevance Redefining roles with CEO and Board input

Defining authority at different levels of

Maintaining an authority and approval matrix
management

Aligning roles and responsibilities with objectives

Maintaining job descriptions and
service-level agreements Maintaining control while engaging outside service
providers

Defining the role of internal auditors Reviewing and approving the internal audit plan

65 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Approach
Defining authority at different levels of management

The board of directors outlines its oversight authority for

financial reporting over senior management through its charter.
When assigning authorities and responsibilities, management
considers the impact on the control environment and the
importance of effectively segregating duties. Policy documents
define cascading levels of authority, checks, and balances for
authorizing transactions, and accounting and reporting of
financial results. Such authority and responsibility is deliberately
limited in order to balance the need for the efficient achievement
of objectives against the risks that could result from unmonitored
inappropriate conduct. Management empowers employees to
correct problems or implement improvements in their assigned
business process as necessary.

66 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 4
Demonstrates Commitment to Competence

The organization demonstrates a commitment to attract,

develop, and retain competent individuals in alignment with
objectives
Policies and practices provide the foundation for defining
the competence needed within the organization and
provide the basis for more detailed procedures for
executing and evaluating performance as well as
determining remedial actions, as necessary
Points of Focus
Establishes policies and practices
Evaluates competence and addresses shortcomings
Attracts, develops, and retains individuals
Plans and prepares for succession
67 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 4
Demonstrates Commitment to Competence (cont.)

Summary of Enhanced Concepts of Principle 4:

Planning and preparing for succession for those roles that are important to
the effectiveness of internal control
Expectation and evaluation of competencies

Incorporates consideration of OSPs

68 Copyright 2013 Deloitte Development LLC. All rights reserved.

 Principle 4
Demonstrates Commitment to Competence (cont.)

ICEFR ICEFR
Approaches Examples
Establishing required knowledge,
Periodically reviewing policies
skills, and expertise

Linking competence standards to

established policies and Recruiting and retaining key financial reporting positions
practices in hiring, training, and Defining performance expectations
retention decisions

Identifying and delivering

financial reporting-related Implementing complex accounting standards
training as needed

Selecting appropriate outsourced

Retaining external tax assistance
service providers

69 Copyright 2013 Deloitte Development LLC. All rights reserved.

 Principle 4
Demonstrates Commitment to Competence (cont.)

ICEFR ICEFR
Approaches Examples
Evaluating competence and Periodically assessing performance
behavior Audit Committee review of manager roles
Assessing the adequacy of staffing levels for financial
Evaluating the capacity of reporting
finance personnel Aligning competencies with key financial reporting
positions

Developing alternate candidates

Addressing succession planning
for key finance reporting roles

70 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Assessing the Adequacy of Staffing Levels for Financial
Reporting

The senior management of Tall Tree Finance, an investment bank and

institutional securities company, annually assesses the adequacy of
staffing levels of its key financial reporting function to understand and
manage effectively the companys current business activities, related
accounting questions, and IT implementation challenges. The audit
committee oversees this assessment.

In particular, the assessment considers how adequately personnel

respond to emerging accounting, reporting, and internal control issues.
Senior management uses the results of this assessment to make
decisions on staff training, reassignments, or other organizational
changes.

71 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 5
Enforces Accountability

The organization holds individuals accountable for their

internal control responsibilities in the pursuit of objectives
The board of directors ultimately holds the chief executive
officer accountable for understanding the risks faced by the
entity and establishing the requisite system of internal
control to support the achievement of the entitys
objectives
Points of Focus
Enforces accountability through structures, authorities, and responsibilities
Establishes performance measures, incentives, and rewards
Evaluates performance measures, incentives, and rewards for ongoing relevance
Considers excessive pressures
Evaluates performance and rewards or disciplines individuals

72 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 5
Enforces Accountability (cont.)

Summary of Enhanced Concepts of Principle 5:

The importance of holding individuals accountable for their internal control
responsibilities
Aligning incentives and rewards with internal control responsibilities
Considering excessive pressures
Incorporates consideration of OSPs

73 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 5
Enforces Accountability (cont.)

ICEFR ICEFR
Approaches Examples
Defining and confirming Cascading responsibilities throughout the
responsibilities organization and certifying results
Developing balanced
performance measures, Defining and communicating the basis for reward
incentives, and rewards
Evaluating performance
Establishing and overseeing performance
measures for intended
measures, incentives, and rewards
influence

Linking compensation and Aligning incentives with ethics and values

other rewards to Providing recognition for suggestions made to
performance enhance internal control

74 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Defining and Communicating the Basis for Reward

Modern Financial Services has implemented a rewards system that requires

the achievement of defined performance measures and encourages
departments to monitor the effectiveness of their internal control systems and
to self-report possible control deficiencies or opportunities for enhancement.
This encouragement comes in the form of a policy that gives departments
credit in the internal audit grading system for self-reported deficiencies. Any
deficiencies that are identified through internal audit procedures, rather than
through a departments monitoring efforts, are counted against the score.

The credit does not preclude the internal audit department from reporting
specific deficiencies to management or the board when warranted, but it does
positively affect the grading system, which can affect departmental
compensation and benefits. The result is that Modern Financial Services is
more likely to identify control deficiencies before they can become material to
the organization.

75 Copyright 2013 Deloitte Development LLC. All rights reserved.

Activity: Identify Component Controls
Team

Refer to Handout 2, which is the summary of Components, Principles

and Points of Focus.
Identify relevant controls that address the principles within the assigned
component. Consider the points of focus to assist in the identification of
relevant control activities.
Flipchart the:
Relevant controls identified for each principle
Control gaps identified for each principle

Prepare Responses 15 minutes

Debrief Responses 10 minutes

76 Copyright 2013 Deloitte Development LLC. All rights reserved.

Activity #1 Flipchart Example

COMPONENT : Control Environment________

Control Principle#1 Principle#2 Principle#3
CA#1 X
CA#2 X X
CA#3 X

n/a GAP

77 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 6
Risk Assessment
Module 6 - Agenda

Risk Assessment Overview

Discussion of Principles

Points of Focus

Enhanced Aspects

ICEFR Approaches and Examples

79 Copyright 2013 Deloitte Development LLC. All rights reserved.

Risk Assessment Overview

9. Identify
6. Specify
7. Identify and 8. Assess and Analyze
Suitable
Analyze Risks Fraud Risk Significant
Objectives
Change

Principles of Component

80 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 6
Specifies Suitable Objectives (cont.)

The organization specifies objectives with sufficient clarity to

enable the identification and assessment of risks relating to
objectives
Principle 6 is organized into three distinct sections, each with different
points of focus:

Points of Focus:
Operations Objectives
Reporting Objectives
External Financial Reporting Objectives
External Non-financial Reporting Objectives
Internal Reporting Objectives
Compliance Objectives

Enhanced Aspects of Principle 6: Separates the financial reporting

category into three separate objectives
81 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 6
Specifies Suitable Objectives (cont.)

Points of Focus
Reflects managements choices
Operations Considers tolerance for risk
Objectives Includes operations and financial performance
goals
Forms a basis for committing of resources

82 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 6
Specifies Suitable Objectives (cont.)

Points of Focus

External Financial Complies with applicable accounting standards

Reporting Considers materiality
Objectives Reflects entity activities

Complies with externally established standards

External Non- and frameworks
Financial Reporting Considers the required level of precision
Objectives
Reflects entity activities

Reflects managements choices

Internal Reporting
Considers the required level of precision
Objectives
Reflects entity activities

83 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 6
Specifies Suitable Objectives (cont.)

Points of Focus
Compliance
Reflects external laws and regulations
Objectives
Considers tolerances for risk

84 Copyright 2013 Deloitte Development LLC. All rights reserved.

 Principle 6
Specifies Suitable Objectives (cont.)
ICEFR ICEFR
Approaches Examples
Identifying Financial Statement
Accounts, Disclosures and Linking Accounts, Assertions, and Risks
Assertions

Specifying Financial Reporting Specifying Objectives

Objectives Assessing the Suitability of Specified Objectives

Assessing Materiality for a Private Company Financial

Assessing Materiality
Statement

Reviewing Financial Accounting Policies

Reviewing and Updating Reviewing and Updating Understanding of Applicable
Understanding of Applicable Standards
Standards
Reviewing and Updating Statutory Reporting
Requirements

Considering the Range of Entity

Considering the Range of Assessment Activities
Activities
85 Copyright 2013 Deloitte Development LLC. All rights reserved.
ICEFR Compendium - Example
Reviewing Financial Accounting Policies

Celia Mendez is the controller of a $100 million biotechnology

company. She reviews its accounting principles by considering:
Policies selected that are acceptable according to the
applicable standards (US GAAP)
Situations where multiple acceptable alternatives are available
and the rationale for selecting one policy over another
Differences in accounting policies from those of its peers
Management discusses significant accounting policies with the
audit committee on an annual basis.

86 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 7
Identify, Analyze and Respond to Risk

The organization identifies risks to the achievement of its

objectives across the entity and analyzes risks as a basis for
determining how the risks should be managed
Identifying and analyzing risks is an ongoing iterative
process conducted to enhance the entitys ability achieve
its objectives
Management considers risks at all levels of the entity and
takes the necessary actions to respond

Points of Focus
Includes entity, subsidiary, division, operating unit, and functional levels Identify
Analyzes internal and external factors; Involves appropriate levels of Analyze
management; Estimates significance of risks identified
Determines how to respond to risks Respond

87 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 7
Identify, Analyze and Respond to Risk (cont.)

Summary of Enhanced Concepts of Principle 7:

Details that risk assessment includes risk identification, analysis, and
response.
Incorporates the concepts of inherent risk.

Expands discussion regarding risk tolerance and how risk may be managed,
including through acceptance, avoidance, reducing, and sharing risk.

Considers velocity and persistence of risk (in addition to impact and

likelihood).

Incorporates consideration of outsourced service providers (OSPs).

88 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 7
Identify, Analyze and Respond to Risk (cont.)
ICEFR ICEFR
Approaches Examples
Applying a Risk Identification
Analyzing Risk Across Functions
Process
Assessing Risks to Significant Financial
Assessing Risks to Significant Statement Accounts
Financial Statement Accounts
Using Risk Ratings

Meeting with Entity Personnel Analyzing Risk for Information Technology

Identifying and Responding to Risk

Assessing the Likelihood and
Significance of Identified Risks Using Benchmark Data to Asses Significance
and Response to Risk

Considering Internal and External

Analyzing Risks from External Factors
Factors
Considering Risk Response in a Revenue
Evaluating Risk Responses
Process

89 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Analyzing Risk Across Functions
The CFO holds a working session of department leaders from
marketing, production, IT, HR, and administration to perform a risk
analysis by department. Risks are rated from 1 (least risk) to 5 (most
risk) based on potential impact on financial reporting and likelihood of
occurrence. After the discussion sessions, the participants document
the results in a table that outlines each specific risk together with the
rating and factors contributing to the rating.

90 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Considering Risk Response in a Revenue Process
Bailey Campbell, the controller for Center Bay Packing, assesses the
risk relating to completeness of revenue. The company has grown over
the past five years and now has annual revenues in excess of $50
million. Currently, Center Bay relies on a paper-based-bill-of-lading
system. Delivery is deemed to have occurred when the bill of lading is
signed by the customer as evidence that the goods have been
received.

Ms. Campbell has noted instances in the past year where shipping
documentation was not provided to the finance department in a timely
manner, sometimes as late as two weeks after the shipment was
completed. These delays have resulted in misstatement of revenue.
Ms. Campbell has determined that the risk related to revenue
completeness need to be further reduced, and so she has decided to
implement a bar-code scanner shipment system to track and capture
shipping and revenue.
91 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 8
Assesses Fraud Risk
The organization considers the potential for fraud in
assessing risks to the achievement of objectives.

The following points of focus highlight important

characteristics relating to this principle:
Points of Focus:
Considers various types of fraud
Assesses incentive and pressures
Assesses opportunities
Assesses attitudes and rationalization

92 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 8
Assesses Fraud Risk (cont.)

Summary of Enhanced Concepts of Principle 8:

Incorporates the concept of fraud risk assessment.
Considerations related to various types of fraud, including fraudulent financial
reporting, fraudulent non-financial reporting, misappropriation of assets,
management override, safeguarding of assets, and corruption.
Evaluating incentives and pressures, opportunities, and attitudes and
rationalizations.
Incorporates considerations of OSPs

93 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 8
Assesses Fraud Risk (cont.)
As part of the risk assessment process, organizations should identify the
various ways that fraudulent financial reporting can occur, considering:
Management bias, for instance in selecting accounting principles
Degree of estimates and judgments in external reporting
Fraud schemes and scenarios common to the industry sectors and
markets in which the entity operates
Geographic regions where the entity does business
Incentives that may motivate fraudulent behavior
Nature of technology and managements ability to manipulate
information
Unusual or complex transactions subject to significant management
influence
Vulnerability to management override and potential schemes to
circumvent existing control activities

94 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 8
Assesses Fraud Risk (cont.)

ICEFR ICEFR
Approaches Examples

Conducting Fraud Risk Assessments Assessing Fraud Risk

Considering Approaches to Circumvent

Maintaining Oversight
or Override Controls

Considering Fraud Risk in the Internal Identifying and Analyzing Risk of Material
Audit Plan Omission and Misstatement Due to Fraud

Reviewing Incentives and Pressures

Analyzing Compensation Structure
Related to Compensation Programs

95 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Assessing Fraud Risk
The chief compliance officer at a global retail operation, annually conducts a fraud risk assessment.
In doing so, he interviews management at all the international locations about fraud issues. He
analyzes:
Historical fraud, including theft of inventory and the processes in place to identify and
record such theft
The methodology used for recording and calculating inventory and shrinkage
Whistle-blower reports
The number of manual entries vs. automated entries recorded
The number of late entries due to subjective estimates

With this information, the chief compliance officer:

Forms a preliminary view of the potential fraud activities, which he discusses with management
of each jurisdiction in order to consider implications and what control activities can reduce the
risk of fraud.
Has discussions with human resources personnel and reviews information in the staff files.
Uses his historical knowledge and staff information to assess the attitude of the local
management toward the tolerance of fraud and to determine whether local management may
rationalize fraudulent activities, including corruption.
Once complete, submits a report to the audit committee for its consideration.

96 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Identifying and Analyzing Risk of Material Omission and
Misstatement Due to Fraud
Divisional controllers at consumer products company with locations in
several countries, work with business unit leaders to identify and
assess potential fraud risks.

These risks are prioritized and categorized into various components,

including risks of inventory theft, manipulation of data and bias in the
development of accounting estimates, and other potential means of
overriding controls.

Internal audit reviews the resulting fraud risks and provides its point of
view. In addition, the company meets with its external auditor to
discuss the fraud risks to determine if there are others that should be
under consideration. Business unit management plans responses and
then selects and develops controls to mitigate these fraud risks.

97 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 9
Identifies and Analyzes Significant Change

The organization identifies and assesses changes that could

significantly impact the system of internal control.
The following points of focus highlight important
characteristics relating to this principle:
Points of Focus:
Assesses changes in the external environment
Assesses changes in the business model
Assesses changes in leadership

Summary of Enhanced Concepts of Principle 9:

Importance of assessing changes in the external
environment, business model, operations, technology,
relationship with OSPs, leadership and how such changes
may impact internal control.
99 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 9
Identifies and Analyzes Significant Change (cont.)
ICEFR ICEFR
Approaches Examples

Assessing Change in the Reacting to Significant Change Caused by External

External Environment Factors

Updating Risk Assessments For a New CEO

Responding to Significant Change from
Conducting Risk Assessments
International Exposure
Relating to Significant Change
Responding to Significant Change from an
Acquisition
Considering Change through
Succession Planning for Executive Transition

Considering CEO and Senior

Preparing for a Change in CEO
Executive Changes

100 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Responding to Significant Change from International
Exposure

Consecutive Corp., a multi-billion-dollar technology equipment

manufacturer that has historically focused on sales in the United
States, has decided to expand internationally with both sales and
manufacturing. As part of the expansion plans, Consecutive has
assessed several factors:
Incremental revenue opportunities
Competition in the marketplace
Cultural dynamics of the targeted international location
Different laws and regulations, including those that would affect the
companys ability to defend its patents
Risk of increased fraud from theft and corruption

101 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Responding to Significant Change from International
Exposure (cont.)

Each of these factors presents incremental risks to financial reporting

and processes that need to be managed. Therefore, Consecutives
corporate controller is performing a risk assessment with the finance
teams in the international locations to ensure these new risks are
identified and to help management determine how best to respond.

102 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principles 6 - 9
Practical Application Examples
Risk and control knowledge bases: Map the
relevant assertions and risks to the material
accounts, processes, and controls.

Industry based risk maps: Identify the risks,

both external and internal, across functions,
that are most relevant for a company
operating within your industry.

Annual risk assessment, and prioritization:

Analyze and prioritize identified risks based
on the impact and vulnerability, including
changes to people, process or technology.

104 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 7
Control Activities
Module 7 - Agenda

Control Activities Overview

Discussion of Principles

Points of Focus

Enhanced Aspects

ICEFR Approaches and Examples

106 Copyright 2013 Deloitte Development LLC. All rights reserved.

Control Activities Overview

11. Selects and

10. Selects and 12. Deploys
Develops General
Develops Control through Policies
Controls over
Activities and Procedures
Technology

Principles of Component

107 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 10
Selects and Develops Control Activities

The organization selects and develops control activities that

contribute to the mitigation of risks to the achievement of
objectives to acceptable levels

The following points of focus highlight important

characteristics relating to this principle:

Points of Focus
Integrates with Risk Assessment
Considers Entity-Specific Factors
Determines Relevant Business Processes
Evaluates a Mix of Control Activity Types

108 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 10
Selects and Develops Control Activities (cont.)

Summary of Enhanced Concepts of Principle 10:

The linkage between risk assessment and control activities.

The types of controls applied (including considering preventive vs. detective

controls).
Differentiates between business process control activities and transaction
control activities.
Consideration of the level at which control activities are applied (including
various levels of the organization).

109 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 10
Selects and Develops Control Activities (cont.)

ICEFR ICEFR
Approaches Examples

Using Matrices, Workshops, or an

Inventory of Control Activities to Map Using an inventory of risks and control
Identified Risks to Control Activities activities

Implementing or Assessing Control Obtaining a Report on Controls at a Service

Activities when Outsourcing to a Third Organization from a Service Payroll
Party Provider

Considering the Types of Control Evaluating Preventive versus Detective

Activities Control Activities

Manually Assessing Incompatible Functions

Identifying incompatible functions
Across an Entity
Using Alternative Control Activities when
Considering Alternative Control
Access to Purchasing Transactions Are Not
Activities to the Segregation of Duties
Segregated

110 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Obtaining a Report on Controls at a Service Organization
from a Service Payroll Provider
ABC Company uses a third-party service to process payroll, which is
considered significant to the companys financial reporting because
employee costs are a large part of their expenses. ABC Company obtains
an SSAE16 (SOC1) report on controls from its third-party vendor, and
reviews:
Whether the described control objectives and control activities
performed impact internal control over external financial reporting
related to existence, completeness, and valuation of payroll expense
The test results in the report and whether any exceptions have been
identified
Whether the period covered by the report is appropriate
The control activities that it is expected to have in place in its own
organization (as specified by the user control activities in the SSAE 16
report) to verify they are implemented and operating as intended

111 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 11
Selects and Develops General Controls over Technology

The organization selects and develops general control

activities over technology to support the achievement of
objectives

The following points of focus highlight important

characteristics relating to this principle:

Points of Focus
Dependency between the Use of Technology in Business Process and Technology
General Controls
Establishes Relevant Technology Infrastructure Control Activities
Establishes Relevant Security Management Process Control Activities
Establishes Relevant Technology Acquisition, Development, and Maintenance
Process Control Activities

112 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 11
Selects and Develops General Controls over Technology
(cont.)

Summary of Enhanced Concepts of Principle 11:

Incorporates updated technology concepts, including those related to

technology infrastructure, security, acquisition, development, maintenance,
and use of Outsourced Service Providers (OSPs).
Discusses the relationship between automated control activities and general
information technology controls.

113 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 11
Selects and Develops General Controls over Technology
(cont.)
ICEFR ICEFR
Approaches Examples
Using Risk and Control Matrices to
Using a Walkthrough to Understand
Document Technology and
Technology Dependencies
Dependencies

Evaluating Financial Close End-User

Evaluating End- User Computing
Spreadsheet Control Activities

Implementing or Assessing Control Obtaining a Report on Controls at a Service

Activities when Outsourcing IT Organization from a Cloud-Based Service
Functions to a Third Party Provider

Administering Security and Access Establishing Logical Security

114 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 11
Selects and Develops General Controls over Technology
(cont.)
ICEFR ICEFR
Approaches Examples
Configuring the IT Infrastructure to Configuring the IT Infrastructure to Support
Support Restricted Access and Restricted Access and Segregation of
Segregation of Duties Duties

Configuring IT to Support Complete, Configuring IT to Support Complete,

Accurate, and Valid Processing of Accurate, and Valid Processing of
Transactions and Data Transactions and Data

Applying a System Development Life

Managing Changes to Packaged Software
Cycle over Packaged Software

Applying a System Development Life

Cycle over Software Developed In- Managing Changes to Custom Software
House

115 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Evaluating Financial Close End-User Spreadsheet Control
Activities
Smythe & Smythe International recently evaluated the use of
spreadsheets in its financial close process. In doing so, it identified that
the spreadsheets supporting the calculation of LIFO (last-in, first-out)
adjustment and the fair values of goodwill, intangible assets and debt
were high risk, based on the susceptibility of error and significance to
the financial statements.
Smythe & Smyth also classified the spreadsheets as high in complexity
because they included the use of macros and multiple supporting
spreadsheets to which cells and value were interlinked. The
spreadsheets were used either as a basis for journal entries into the
general ledger (LIFO Reserves) or as financial statement disclosures
(fair value of goodwill, intangible assets, and debt).

116 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Evaluating Financial Close End-User Spreadsheet Control
Activities
The company considered the security, maintenance, and update risks
of the spreadsheets and then selected and developed the following
control activities:
Input Control Input data is reconciled to source documentation to cover
its completeness and accuracy.
Access Control File-level access to the spreadsheets on a central server
is limited to approved users, and a password is required to access the LIFO
reserve spreadsheet.
Version Control Standard naming conventions and directory structures
are in place so only current and approved versions of spreadsheets are
used.
Calculation Testing When changes to formulas are made they are tested
against a manual calculation for accuracy. All spreadsheet formulas are
checked for accuracy at least once a year.
Overall Analytics Analytical business process reviews using pre-
established thresholds based on operating income and working capital
function as a detective control to find errors in any of the spreadsheets.
117 Copyright 2013 Deloitte Development LLC. All rights reserved.
ICEFR Compendium - Example
Configuring IT to Support Complete, Accurate, and Valid
Processing of Transactions and Data
The IT operations staff of ABC Company monitors the batch and real-time
processing of applications (including all financially significant applications)
for errors using automated software. The scheduling software on the
mainframe application checks for various problems with batch jobs,
including data errors or programs that dont complete properly or that run
out of order. The operators are alerted to any of these issues and alert
the appropriate business process owner based on standard documented
procedures. For applications that process in real time, software is also
used to automatically monitor for errors, such as incomplete, inaccurate,
or invalid record transfers between systems. When a possible error is
detected, the software attempts to resend the record without error. If the
error persists, an email alert is sent to an operator who corrects the error
following standard documented procedures. Management is notified of
any errors in a weekly report which is reviewed to determine if any
accounting record adjustments are required due to the system problems.

118 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 12
Deploys through Policies and Procedures

The organization deploys control activities through policies

that establish what is expected and procedures that put
policies into action

The following points of focus highlight important

characteristics relating to this principle:
Points of Focus
Establishes Policies and Procedures to Support Deployment of Managements
Directives
Establishes Responsibility and Accountability for Executing Policies and
Procedures
Performs in a Timely Manner
Takes Corrective Action
Performs Using Competent Personnel
Reassesses Policies and Procedures
119 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 12
Deploys through Policies and Procedures (cont.)

Summary of Enhanced Concepts of Principle 12:

Establishing policies and procedures to support deployment of

managements directives.
Establishing responsibility and accountability for executing policies and
procedures.
Reassessing policies and procedures on a periodic basis to determine their
continued relevance and if revisions are needed.

120 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 12
Deploys through Policies and Procedures (cont.)

ICEFR ICEFR
Approaches Examples

Developing and Documenting Policies Performing Control Activities in a Timely

and Procedures Manner

Deploying Control Activities through Deploying Control Activities through a

Business Unit or Functional Leaders Central Control Function

Conduction Regular and Ad Hoc Regularly Assessing Policies and

Assessments of Control Activities Procedures

121 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Regularly Assessing Policies and Procedures
Central Community Bank maintains a policy checklist on its intranet. The
checklist references all the pertinent company policies and management's
last review date, next reviews date, and board of director review and
approval as applicable. The policies and procedures are reviewed
annually or more frequently, in response to changes in underlying
business processed. The internal audit department assesses compliance
with company policy and procedures in conjunction with its internal audit
reviews.

122 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 8
Information and Communication
Module 8 - Agenda

Information and Communication Overview

Discussion of Principles

Points of Focus

Enhanced Aspects

ICEFR Approaches and Examples

124 Copyright 2013 Deloitte Development LLC. All rights reserved.

Information & Communication

13. 14. 15.

Uses Relevant, Communicates Communicates
Quality Information Internally Externally

Principles of Component

125 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 13
Uses Reliable, Quality Information

The organization obtains or generates and uses relevant,

quality information to support the functioning of internal
control

The following points of focus highlight important

characteristics relating to this principle:

Points of Focus
Identifies Information Requirements
Captures Internal and External Sources of Data
Processes Relevant Data into Information
Maintains Quality throughout Processing
Considers Costs and Benefits

126 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 13
Uses Reliable, Quality Information (cont.)

Summary of Enhanced Concepts of Principle 13:

Identifying information requirements, verifying sources of data, processing

relevant data, maintaining quality through processing, and using OSPs.
Considering the costs and benefits of information as well as the impact of
technology.

Considering reliability and protection of data.

Reevaluating information needs.

Considering how information supports the functioning of internal control.

127 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 13
Uses Reliable, Quality Information (cont.)

Quality of information depends on:

Accessible
Correct
Current
Protected
Retained
Sufficient
Timely
Valid
Verifiable
Management establishes information management policies
with clear responsibility and accountability for the quality of
information
128 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 13
Uses Reliable, Quality Information (cont.)

ICEFR ICEFR
Approaches Examples

Evaluate Business Activities

Creating an Inventory of Information
Maintain data flow diagrams, flow charts,
Requirements
narratives, and procedure manuals

Gathering information from External

Obtaining Information from External Sources
Sources Capturing Information from Electronic Data
Interchange

Conducting quarterly interviews of

Obtaining information from Non-Finance operations and other management
management Obtaining operating information for
financial reporting

129 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 13
Uses Reliable, Quality Information (cont.)

ICEFR ICEFR
Approaches Examples

Creating and Maintaining information Use a data warehouse to facilitate access

Repositories to information

Using an Application to process data Data Capture and processing for the
into information purchasing and payables cycle

Enhancing Information Quality through

Validating data and information
a Data governance program

Identifying and protecting financial data

Identifying, securing, and retaining and information
financial information Identifying and classifying data for financial
reporting
130 Copyright 2013 Deloitte Development LLC. All rights reserved.
ICEFR Compendium - Example
Validating Data and Information

RightChoice Pharmacy, Inc. obtains significant data under-lying

transactions recorded in point-of-sale systems located at each retail
store. This data is immediately sent to the credit card company and to
RightChoices internal data warehouse. A reconciliation is performed
based on reports from this data warehouse to the payments due to the
credit card companies
The CIO and credit/collections manager implemented continuous
transaction monitoring software to support their data and information
quality efforts. This software helps them verify their accounts
receivable balances daily (avoiding time consuming month-end
reconciliations)
Targeted data queries allow the software to identify duplicate entries,
unusual transactions, missing data, and incomplete data transfers
Continuous monitoring software enables data analysis used to support
control activities to detect potential indicators of fraud
131 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 14
Communicates Internally
The organization internally communicates information,
including objectives and responsibilities for internal control,
necessary to support the functioning of internal control
The following points of focus highlight important
characteristics relating to this principle:

Points of Focus:
Communicates Internal Control Information
Communicates with the Board of Directors
Provides Separate Communication Lines
Selects relevant Method of Communication

132 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 14
Communicates Internally

Enhanced Aspects of Principle 14:

Importance of communication between management and the board of
directors such that both have sufficient information to successfully fulfill
their roles
Providing separate channels of communication for anonymous or
confidential communication when normal communication channels are
inoperative or ineffective (e.g., through whistle-blower hotlines).

133 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 14
Communicates Internally (cont.)

ICEFR ICEFR
Approaches Examples

Communicating information regarding Using Communication Programs to Reinforce

Internal Control
External Financial Reporting Objectives Using an Internal Accounting and Finance
and Internal control Conference to Reinforce Policy Changes

Communicating Internal Control Using Governance, Risk, and Compliance

responsibilities Technology to Manage Internal Controls

Facilitating Communication between

Developing guidelines for
Executive Management and the Board of
communication to the Board of Directors
Directors

Reviewing Financial and Internal Preparing Financial and Internal Control

Control information with Board of Reporting Package for Discussion with the
Directors Board

134 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 14
Communicates Internally (cont.)

ICEFR ICEFR
Approaches Examples

Communicating a Whistle-Blower
Employee Ethics Hotline
Program to Company Personnel

Establishing a Mentoring Program to

Communicating through Alternative
Encourage Communicating with
Reporting Channels
Management

Establishing Cross-Functional and Multi-

Establishing a Cross-Functional Internal
directional Internal Control
Control Committee
Communication Processes and forums

135 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Using an Internal Accounting and Finance Conference to
Reinforce Policy Changes

NetComm, Inc., a broadband infrastructure company, holds a semi-annual

meeting led by the CFO and controller. The personnel from the finance
department attend these meeting to obtain updated information on significant new
or changed matters that impact finance activities and financial results. Meeting
topics routinely include:
Key objectives for the next six months
Reinforcement of the companys policies related to ethics and integrity
Expectations regarding findings from internal or external audits related to
financial reporting and control
Changes to the internal control structure
Significant recent or anticipated events such as the sale of a business,
acquisition of assets, restructuring of operations, or introduction of a new
product
Changes to accounting policy and regulatory rules that would impact how the
company processes its financial transactions and produces its financial
reports

136 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 15
Communicates Externally

The organization communicates with external parties

regarding matters affecting the functioning of internal control

The following points of focus highlight important

characteristics relating to this principle:

Points of Focus:
Communicates to External Parties
Enables Inbound Communications
Communicates with the Board of Directors
Provides Separate Communication Lines
Selects Relevant Method of Communication

137 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 15
Communicates Externally

Enhanced Aspects of Principle 15:

Importance of open communication channels to allow input from stakeholders,
including external party assessment results, to the board of directors.
Providing separate channels of communication for anonymous or confidential
communication when normal communication channels are inoperative or ineffective
(e.g., through whistle-blower hotlines).
Considerations related to OSPs.

138 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 15
Communicates Externally (cont.)

ICEFR ICEFR
Approaches Examples
Communicating Internal Control Information to a
Communicating information regarding to Federal Agency
Relevant External Parties Establishing Periodic Communications with
Contractors and Outsource Service Providers

Communications from Regulatory Bodies

Obtaining Information from Outside
Obtaining information from External Sources to
Sources Assist with Accounting Estimates

Surveying External Parties Conducting Discussions with Customers

Communicating the Whistle-Blower Facilitating Communication with External

Program to Outside Parties Parties

Reviewing External Audit Managing and Assessing External Audit

Communications Communications

139 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Establishing Periodic Communications with Contractors and
Outsource Service Providers
Confab Group, a private Telecommunications company, outsources all
of its manufacturing activities to third parties around the world. Confab
is responsible for damage or loss of inventory from the receipt of raw
materials at the third-party manufacturer until completed products are
delivered to freight forwarder for shipment. Therefore the company
retains a significant risk to inventory that is not within its physical
control. Confab has specific policies and procedures for purchasing,
manufacture and preparation of shipments to mitigate its exposure and
to support estimates for inventory reserves. These policies are
communicated to manufacturers along with contract clauses to adhere
to these polices and the right to audit by the company

140 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Establishing Periodic Communications with Contractors and
Outsource Service Providers (cont.)
In order to ensure the policies and procedures are followed, Confab
has implemented the following:
Website to communicate with the contract manufacturers
A link to the policies and procedures which contractors are required
to acknowledge they have read and understood the polices
Periodic reports from the manufactures on the inventory balances
Periodic onsite audits of the contract manufacturers
Confab also performs annual reviews of the contract manufacturers
controls that support the completeness and accuracy of reports
provided throughout the year.

141 Copyright 2013 Deloitte Development LLC. All rights reserved.

Discussion Question
What controls are in place to ensure the quality and integrity
of information produced by the entity?

Has management considered whether monitoring/review type

controls are sufficiently precise to prevent/detect a material
misstatement?

142 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 9
Monitoring
Module 9 - Agenda

Monitoring Overview and Concepts

Discussion of Principles

Points of Focus

Enhanced Aspects

ICEFR Approaches and Examples

COSOs Guidance on Monitoring Internal Control Systems

144 Copyright 2013 Deloitte Development LLC. All rights reserved.

Monitoring Overview

16. Selects, develops

and performs 17. Evaluates and
evaluations to determine communicates IC
if components of IC are deficiencies
present and functioning

Principles of Component

145 Copyright 2013 Deloitte Development LLC. All rights reserved.

Monitoring Activities Overview and Concepts

Monitoring activities assess whether each of the five

components of internal control and relevant principles is
present and functioning

Monitoring is a key input of the organizations assessment

of the effectiveness of internal control
Provides valuable support for assertions of the effectiveness of the system
of internal control

Monitoring activities are selected, developed, and

performed to ascertain whether each component continues
to be present and functioning or if change is needed
Where appropriate, monitoring activities identify and examine expectation
gaps relating to anomalies and abnormalities
When reviewing and investigating expectation gaps, management often
identifies root causes of such gaps
146 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 16
Conducts Ongoing and/or Separate Evaluations

The organization selects, develops, and performs ongoing

and/or separate evaluations to ascertain whether the
components of internal control are present and functioning
The following points of focus highlight important
characteristics relating to this principle:
Points of Focus:
Considers a mix of ongoing and separate evaluations
Considers rate of change
Establishes baseline understanding
Uses knowledgeable personnel
Integrates with business processes
Adjusts scope and frequency
Objectively evaluates
147 Copyright 2013 Deloitte Development LLC. All rights reserved.
Principle 16
Conducts Ongoing and/or Separate Evaluations (cont.)

Enhanced Aspects of Principle 16:

Considering the rate of change when developing monitoring activities.

Using a baseline of understanding of internal control to establish plans for

ongoing and separate evaluations
Considerations regarding monitoring at different levels of an organization and
monitoring of outsourced service providers

Using technology in the context of monitoring

148 Copyright 2013 Deloitte Development LLC. All rights reserved.

Ongoing Monitoring vs. Separate Evaluations

Ongoing Monitoring: Separate Evaluations:

Typically closer to Generally more

operation of controls objective
Offers earliest Validate results of
opportunity to identify ongoing monitoring
weakness
Often performed by an
Often represents internal audit or other
routine supervisory compliance group
activities or a self-
Typically risk-based;
assessment process
e.g. higher risk areas
performed at the
are tested more
business unit level
frequently

149 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 16
Conducts Ongoing and/or Separate Evaluations (cont.)

ICEFR ICEFR
Approaches Examples

Periodically Reviewing the Mix of Changes in Business Operations

Monitoring Activities Changing the Internal Audit Plan

Establishing a Baseline Establishing a Baseline

Using Metrics to Monitor Payroll

Identifying and Using Metrics Using Built-in Operating Measures and Key
Control Indicators

Designing and Implementing a Using Dashboards to Relate Operating

Dashboard Information

150 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 16
Conducts Ongoing and/or Separate Evaluations (cont.)

ICEFR ICEFR
Approaches Examples

Using Technology to Support Monitoring Using Continuous Monitoring

Activities Using Technology to Identify Trends

Investigating and Reporting Whistle-blower

Allegations
Identifying and Protecting Sensitive Financial
Conducting Separate Evaluations Data and Information
Conducting Senior Financial Officer Visits
Using Self- Assessments

Identifying and Analyzing Risk of Material

Using Internal Audit to Conduct Omission of Misstatement Due to Fraud
Separate Evaluations Internal Audit Conducting Separate Evaluations

Understanding Controls at an Reviewing Service Auditors Report for

Outsourced Service Provider Changes in Controls

151 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Example
Changing the Internal Audit Plan

Villiam Financial Services is a publicly held global company. Recently

the industry has experienced significant rate of change because of
increasing focus and complexity of the company's financial products.
In response to these changes, Villams management and board of
directors have reprioritized the activities conducted by its internal audit
department, including:
More active oversight of Villams recently enhanced risk management and
governance process
An iterative risk assessment process that performs a risk review annually
and more often if the business changes
Reviews of financial and operations data to identify risks and adverse
trends, and to respond to them accordingly by conducting targeted audits

152 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Approach
Using Technology to Support Monitoring Activities

Management uses technology to support the monitoring of

the system of internal control in the ordinary course of
business through automated monitoring applications.
Management uses the automated monitoring application to
efficiently and continuously review large volumes of data at
a low cost with a high standard of objectivity (once
programmed and tested). Automated monitoring activities
may include:
Checking transactions against predefined thresholds for anomalies
Monitoring transactions for trends or patterns
Assessing automated performance indicators, metrics, and
measures that may lead to improvements in process and business

153 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 17
Evaluates and Communicates Deficiencies

The organization evaluates and communicates internal

control deficiencies in a timely manner to those parties
responsible for taking corrective action, including senior
management and the board of directors, as appropriate
The following points of focus highlight important
characteristics relating to this principle:

Points of Focus:
Assesses results
Communicates deficiencies
Monitors corrective actions

154 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 17
Evaluates and Communicates Deficiencies (cont)

Enhanced Aspects of Principle 17:

Communicating deficiencies
Monitoring corrective actions

155 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principle 17
Evaluates and Communicates Deficiencies (cont.)

ICEFR ICEFR
Approaches Examples

Identifying Sources of Deficiencies

Assessing and Reporting Deficiencies Reporting Protocols for Identified
Deficiencies

Establishing Reporting Protocols for

Identified Deficiencies [and Monitoring
Monitoring Corrective Action Remediation]
Follow up Reporting on Internal Audit
Issues

Developing Guidelines for Reporting Reporting Deficiencies to the Board

Deficiencies

156 Copyright 2013 Deloitte Development LLC. All rights reserved.

ICEFR Compendium - Approach
Assessing and Reporting Deficiencies

Management develops policies and practices to

periodically assess and communicate deficiencies that
result from the entitys monitoring activities and other
sources.
Management establishes a practice where all deficiencies
in internal control over external financial reporting,
regardless of materiality, are reported to the responsible
manager at least one level of management above, both of
whom are positioned to take or oversee corrective action.
Management also classifies deficiencies for the further
reporting to senior management or the board based on
criteria established by standard setters or regulators.

157 Copyright 2013 Deloitte Development LLC. All rights reserved.

Principles 16 and 17
Practical Application Examples
Diagnostic and maturity model: Establish a risk
intelligent baseline, from which changes can be
identified, and management can establish a monitoring
program.

Continuous controls monitoring: Use automated data

analytics tools and techniques to monitor selected
transactions on a periodic basis based upon relative
risk, or to identify changes and unusual trends. Number of
Frequency Common Data
Illustrative Data Only

Risk
# Touch Est. Entities (Qrtrly, Elements Initial Priority Potential
Report Description Level of # systems Data Public Purpose Assessment
Annual, ( eg. Loans,
points scrutiny Effort Impacted (H/M/L) Groups
Elements Event-Driven, Deposits, (TBD)
Weekly) Derivatives)

Fin Stmt of US non-bank

FR Y-11 H M H M H Y* Subsidiaries Fin. Stmt. Q / A*** Y H
subsidiaries

Fin Stmt of non-US non- 1

FR 2314 H M H M H Y* Subsidiaries Fin. Stmt. Q / A*** Y H

Controls status/deficiency dashboard, and risk and

bank subsidiaries

FR 2900 Deposit Activity L H L L L N Bank Specific W Y M

Assets and Liabilities of

FR 2416 Large Banks
M M H L L N Bank Fin. Stmt. W Y M 2

FFIEC 041 Bank Financial Statements M H M H** H Y Bank Fin. Stmt. Q Y H

control matrices: Use to track the status of controls

Consolidated financial
FR Y-9C H H H H** H Y BHC Fin. Stmt. Q Y H
Statements
3
Parent company only
FR Y-9 LP L M L L M Y BHC Fin. Stmt. Q Y M
Financial Statements

FFIEC 009 Country Exposure H H H L H N BHC / Bank Specific. Q Y M

Affiliate Transactions
FR Y-8 L M M L M N Bank Fin. Stmt. Q Y M
Report

testing, internal audits, or various process evaluations

FR Y-6 BHC Annual report L M M M M Y* BHC LE / Fin Stmt. A N L
4
Equity investments in Non-
FR Y-12 L M M L M Y* BHC Specific Q N L
Financial Cos.

Changes in Legal Entity

FR Y-10 H M M L L Y BHC Legal Entity E N L
Org. Structure

as well as the results of those evaluations (for ease of

tracking of action items and status reporting). Can also
be used for reporting deficiencies to the audit
committee of the board, and comparison to prior period
results.
158 Copyright 2013 Deloitte Development LLC. All rights reserved.
Discussion Questions

What does your company do to monitor outsourced service

providers or other elements of COSO?

What does your company do to monitor non-significant

components (i.e., those components not in scope for
SOX or internal audit) which when aggregated may
become material?

Have you contemplated what changes, if any, will need to

be made to your existing Internal Audit plan(s) given the
planned adoption/implementation of COSOs revised I/C
framework?

159 Copyright 2013 Deloitte Development LLC. All rights reserved.

Activity: Identify Component Controls
Team

Refer to Handout 2, which is the summary of Components, Principles

and Points of Focus.
Identify relevant controls that address the principles within the assigned
component. Consider the points of focus to assist in the identification of
relevant control activities.
Flipchart the:
Relevant controls identified for each principle
Control gaps identified for each principle

Prepare Responses 15 minutes

Debrief Responses 20 minutes

160 Copyright 2013 Deloitte Development LLC. All rights reserved.

Activity #1 Flipchart Example

COMPONENT : Monitoring________
Control Principle# Principle# Principle#
CA#1 X
CA#2 X X
CA#3 X

n/a GAP

161 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 10
Considerations & Next Steps
Module 10 - Agenda

Considerations & Next Steps: The 4-Step Approach

Step 1: Understand and Educate
Step 2: Assess
Step 3: Plan & Implement
Step 4: Communicate

Recap
The Opportunities

163 Copyright 2013 Deloitte Development LLC. All rights reserved.

Considerations and Next Steps: The 4-Step
Approach

Assess Plan &

Implement

Understand &
Educate
Communicate

Companies complying with Section 404 of the Sarbanes-Oxley Act of 2002 will be
required to utilize the 2013 COSO framework by : December 15, 2014

164 Copyright 2013 Deloitte Development LLC. All rights reserved.

1. Understand and Educate
Understand Educate Training
The impact of the 2013 Management will need to Roll out a formal training
Framework on assess their education program within the
managements assessment needs in equipping the core Company
of the effectiveness of team with COSO 2013 Train Management on the
ICEFR will depend on how Framework knowledge. 2013 framework using:
a company applied and Assess training needs and AICPA Toolkit
interpreted the concepts in obtain required education to
the prior Framework. New 2013 COSO
become SMEs in
identifying: 2013 Illustrative tools
To appropriately assess the New concepts and ICEFR Compendium
impact, management will Key changes Conduct and provide
need to read and SOX Compliance training to Managements
understand the 2013 requirements core team
Framework and identify new Train IA function to consider
Formulate goals and
concepts and changes. recognizing other risks,
expectations to be realized
at the completion of training apart from compliance and
financial matters

165 Copyright 2013 Deloitte Development LLC. All rights reserved.

2. Perform Assessment
Gap Assessment Risk Assessment
Identify potential gaps through Assess the process followed and
assessment of current state of revise the frequency, focusing on
processes, control activities and Fraud risk assessment
available internal control
documentation regarding meeting
the 17 principles and related points Evaluate the integrity and quality
of focus in the new framework of information

Monitoring and related oversight of

key activities performed at the
third-party service providers
IA Function: Operations,
Compliance & Reporting
Precision of higher level
Analyze the effectiveness of the IA detective/review type controls
function in meeting the activities
requirements outlined in the
revised Internal Control
framework.
Identify how to leverage the
revised 2013 Internal Control
Framework, specifically related to
internal controls in non-financial
reporting areas, operations and
compliance
166 Copyright 2013 Deloitte Development LLC. All rights reserved.
3. Plan and Implement
Develop and Execute a Transition Plan for SOX Compliance
Xxx 2013 Xxx 2013 December 2014

Company Implementation and 2013 COSO Framework

Planning COSO Transition Utilized

Plan Utilize Implement

Finalize the updated SOX Utilize SMEs and the right talent Document & Evaluate: Update the
compliance methodology and with technical knowledge to format and/or flow of your underlying
approach to be undertaken identify and address the new documentation, aligning it to the new
Define project governance concepts and key changes mapping to 2013 COSO Framework
and decision rights within proposed in COSOs revised I/C
core team framework with respect to its
Validation Testing and Gap
Internal Audit function activities
Develop a detailed project Remediation: Assess design,
and related audit programs
plan with key milestones implement controls, improve control
Identify and assign resources reporting, perform validation testing,
Considering using activities identify gaps, remediate gaps.
Confirm proper disclosure of
performed in 2013 (e.g.,
the framework used during
walkthroughs, testing of relevant
the transition period and at External Review & Testing:
controls, evaluation of
the time the 2013 Framework Communicate with external auditor to
deficiencies) to identify
is adopted assess environment, and test updated
necessary changes and pilot or
SOX compliance program.
field test the application of the
2013 Framework.

167 Copyright 2013 Deloitte Development LLC. All rights reserved.

4. Communicate

Internal
Coordinate and communicate internally with all groups that
are responsible for implementing, monitoring, and
reporting on ICEFR (including Internal Audit)

External
Discuss and coordinate activities with external
auditor.

168 Copyright 2013 Deloitte Development LLC. All rights reserved.

Recap: Considerations and Next Steps
Understand Read 2013 Framework
and Identify new concepts and changes
Educate Consider training and education needs

Assess and evaluate needs regarding control objectives for operations,

compliance, and reporting
Determine impacts on the entitys design and evaluation of ICEFR
Assess Assess coverage of the principles
Assess current processes, activities, and available documentation
regarding meeting the principles
Identify any gaps

Identify the steps that need to be performed to transition to the 2013

Plan and Framework
Implement Formulate a plan to transition by December 15, 2014
Take appropriate steps to implement plan

Communicate internally with all groups responsible for evaluating, monitoring,

and reporting on the organizations internal control
Communicate
Discuss and coordinate activities with internal audit (if applicable) and the
external auditor
169 Copyright 2013 Deloitte Development LLC. All rights reserved.
The Opportunities
The 2013 Framework provides
a good opportunity to create
value for your organization and
refresh your internal control
system.
Improve anti-fraud programs,
new corporate governance
paradigms, IT systems and
risks, outsourcing to third
parties
Refresh and enhance internal
control
Synergies and simplifications
may be available
May also identify gaps to be
addressed
Improve operations,
compliance, and reporting
170 Copyright 2013 Deloitte Development LLC. All rights reserved.
Discussion Questions

How do you plan to communicate the new COSO

Framework to your organization?

Has your organization thought about how they will educate

and train their key people on the new COSO Framework?

Other than the ones we have already discussed in

previous activities, what gaps do you believe your
organization will identify?

172 Copyright 2013 Deloitte Development LLC. All rights reserved.

Module 11
Available Resources
Available Resources

External Resources
COSO Official Site www.coso.org
Read Press Release
Download Executive Summary
Read FAQs
Download PowerPoint Slides
Purchase Framework and Tools
COSO Risk Assessment in Practice Guide*
Monitoring Guidance Available
AICPA
Toolkit
Management Override of Internal Control The Achilles Heal of
Fraud Prevention:
http://www.aicpa.org/ForThePublic/AuditCommitteeEffectiveness/Do
wnloadableDocuments/achilles_heel.pdf

174 Copyright 2013 Deloitte Development LLC. All rights reserved.

Available Resources

Deloitte Publications www.deloitte.com

Heads Up: COSO Enhances its Internal Control Integrated
Framework (6/10/13)
Heads Up: Update on the Project to Enhance COSOs Internal
Control Integrated Framework (8/7/12)
Heads Up: COSO Releases Exposure Draft of Updated Integrated
Framework on Internal Control (2/6/12)

175 Copyright 2013 Deloitte Development LLC. All rights reserved.

 COSO Risk Assessment in
Practice

Focuses on broader
enterprise-wide risk
management (ERM)

Provides an overview of risk

assessment approaches and
techniques that have
emerged as the most useful
and sustainable for decision-
making

Available for download:

http://www.coso.org/guidance.htm

176 Copyright 2013 Deloitte Development LLC. All rights reserved.

 COSO Monitoring Guidance

The 2013 Framework does

not change or supersede the
Monitoring Guidance
Intended to help
organizations improve the
effectiveness and efficiency
of their monitoring
component
Provide practical guidance
that illustrates how
monitoring can be
incorporated into an
organizations business

Available for download:

http://www.coso.org/guidance.htm
177 Copyright 2013 Deloitte Development LLC. All rights reserved.
QUESTIONS