Committee of Sponsoring Organizations of the Treadway Commission

Accountancy
Key concepts
Accountant · Accounting period · Bookkeeping · Cash and accrual basis · Cash flow management · Chart of accounts · Journal  · Special journals · Constant Item Purchasing Power Accounting · Cost of goods sold · Credit terms · Debits and credits · Double-entry system · Mark-to-market accounting · FIFO & LIFO · GAAP / IFRS · General ledger · Goodwill · Historical cost · Matching principle · Revenue recognition · Trial balance
Fields of accounting
Cost · Financial · Forensic · Fund · Management · Tax
Financial statements
Statement of financial position · Statement of cash flows · Statement of changes in equity · Statement of comprehensive income · Notes · MD&A · XBRL
Auditing
Auditor's report · Financial audit · GAAS / ISA · Internal audit · Sarbanes–Oxley Act
Accounting qualifications
CA · CPA · CCA · CGA · CMA · CAT · CFA  · CIIA  · ACCA  · CIA  · CTP · ICAEW · CIMA  · IPA  · ICAN
This box: view · talk · edit

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a voluntary private-sector organization, established in the United States, dedicated to providing guidance to executive management and governance entities on critical aspects of organizational governance, business ethics, internal control, enterprise risk management, fraud, and financial reporting. COSO has established a common internal control model against which companies and organizations may assess their control systems.

Organizational Overview

COSO was formed in 1985 to sponsor the National Commission on Fraudulent Financial Reporting (the Treadway Commission). The Treadway Commission was originally jointly sponsored and funded by five main professional accounting associations and institutes headquartered in the United States: the American Institute of Certified Public Accountants (AICPA), American Accounting Association (AAA), Financial Executives International (FEI), Institute of Internal Auditors (IIA) and the Institute of Management Accountants (IMA). The Treadway Commission recommended that the organizations sponsoring the Commission work together to develop integrated guidance on internal control. These five organizations formed what is now called the Committee of Sponsoring Organizations of the Treadway Commission.

The original chairman of the Treadway Commission was James C. Treadway, Jr., Executive Vice President and General Counsel, Paine Webber and a former Commissioner of the U.S. Securities and Exchange Commission. Hence, the popular name "Treadway Commission". David L. Landsittel is COSO's current Chairman; he replaced Larry E. Rittenberg.

History

Due to questionable corporate political campaign finance practices and foreign corrupt practices in the mid -1970s, the U.S. Securities and Exchange Commission (SEC) and the U.S. Congress enacted campaign finance law reforms and the 1977 Foreign Corrupt Practices Act (FCPA) which criminalized transnational bribery and required companies to implement internal control programs. In response, the Treadway Commission, a private-sector initiative, was formed in 1985 to inspect, analyze, and make recommendations on fraudulent corporate financial reporting.

The Treadway Commission studied the financial information reporting system over the period from October 1985 to September 1987 and issued a report of findings and recommendations in October 1987, Report of the National Commission on Fraudulent Financial Reporting.^[1] As a result of this initial report, the Committee of Sponsoring Organizations (COSO) was formed and it retained Coopers & Lybrand, a major CPA firm, to study the issues and author a report regarding an integrated framework of internal control.

In September 1992, the four volume report entitled Internal Control— Integrated Framework^[2] was released by COSO and later re-published with minor amendments in 1994. This report presented a common definition of internal control and provided a framework against which internal control systems may be assessed and improved. This report is one standard that U.S. companies use to evaluate their compliance with FCPA. According to a poll by CFO Magazine released in 2006, 82% of respondents claimed they used COSO’s framework for internal controls. Other frameworks used by respondents included COBIT, AS2 (Auditing Standard No. 2, PCAOB), and SAS 55/78 (AICPA).^[3]

Internal Control - Integrated Framework

Key Concepts of The COSO Framework

The COSO framework involves several key concepts:

• Internal control is a process. It is a means to an end, not an end in itself.
• Internal control is affected by people. It’s not merely policy, manuals, and forms, but people at every level of an organization.
• Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board.
• Internal control is geared to the achievement of objectives in one or more separate but overlapping categories.

Definition of Internal Control and Framework Objectives

The COSO framework defines internal control as a process, effected by an entity’s board of directors, management and other personnel, designed to provide "reasonable assurance" regarding the achievement of objectives in the following categories:

• Effectiveness and efficiency of operations
• Reliability of financial reporting
• Compliance with applicable laws and regulations.

The Five Framework Components

The COSO internal control framework consists of five interrelated components derived from the way management runs a business. According to COSO, these components provide an effective framework for describing and analyzing the internal control system implemented in an organization as required by financial regulations (see Securities Exchange Act of 1934,^[4] The five components are the following:

Control environment: The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, management's operating style, delegation of authority systems, as well as the processes for managing and developing people in the organization.

Risk assessment: Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives and thus risk assessment is the identification and analysis of relevant risks to the achievement of assigned objectives. Risk assessment is a prerequisite for determining how the risks should be managed.

Control activities: Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address the risks that may hinder the achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.

Information and communication: Information systems play a key role in internal control systems as they produce reports, including operational, financial and compliance-related information, that make it possible to run and control the business. In a broader sense, effective communication must ensure information flows down, across and up the organization. For example, formalized procedures exist for people to report suspected fraud. Effective communication should also be ensured with external parties, such as customers, suppliers, regulators and shareholders about related policy positions.

Monitoring: Internal control systems need to be monitored—a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities or separate evaluations. Internal control deficiencies detected through these monitoring activities should be reported upstream and corrective actions should be taken to ensure continuous improvement of the system.

Limitations

Internal control involves human action, which introduces the possibility of errors in processing or judgment. Internal control can also be overridden by collusion among employees (see separation of duties) or coercion by top management.

CFO magazine reported that companies are struggling to apply the complex model provided by COSO. “One of the biggest problems: limiting internal audits to one of the three key objectives of the framework. In the COSO model, those objectives are applied to five key components (monitoring, information and communication, control activities, risk assessment, and control environment). Given the number of possible matrices, it's not surprising that the number of audits can get out of hand.”.^[5] CFO magazine continued by stating that many organizations are creating their own risk-and-control matrix by taking the COSO model and altering it to focus on the components that relate directly to Section 404 of the Sarbanes-Oxley Act.

Enterprise Risk Management - Integrated Framework

In 2001, COSO initiated a project, and engaged PricewaterhouseCoopers, to develop a framework that would be readily usable by managements to evaluate and improve their organizations’ enterprise risk management. High-profile business scandals and failures (e.g. Enron, Tyco International, Adelphia, Peregrine Systems and WorldCom) led to calls for enhanced corporate governance and risk management. As a result the Sarbanes-Oxley act was enacted. This law extends the long-standing requirement for public companies to maintain systems of internal control, requiring management to certify and the independent auditor to attest to the effectiveness of those systems. The Internal Control – Integrated Framework continues to serve as the broadly accepted standard for satisfying those reporting requirements; however, in 2004 COSO published Enterprise Risk Management - Integrated Framework.^[6] COSO believes this framework expands on internal control, providing a more robust and extensive focus on the broader subject of enterprise risk management.

Four Categories of Business Objectives

This enterprise risk management framework is still geared to achieving an entity’s objectives; however now includes four categories:

• Strategic: high-level goals, aligned with and supporting its mission
• Operations: effective and efficient use of its resources
• Reporting: reliability of reporting
• Compliance: compliance with applicable laws and regulations

Eight Framework Components

The eight components of enterprise risk management encompass the previous five components of the Internal Control-Integrated Framework while expanding the model to meet the growing demand for risk management:

Internal environment: The internal environment encompasses the tone of an organization, and sets the basis for how risk is viewed and addressed by an entity’s people, including risk management philosophy and risk appetite, integrity and ethical values, and the environment in which they operate.

Objective setting: Objectives must exist before management can identify potential events affecting their achievement. Enterprise risk management ensures that management has in place a process to set objectives and that the chosen objectives support and align with the entity’s mission and are consistent with its risk appetite.

Event identification: Internal and external events affecting achievement of an entity’s objectives must be identified, distinguishing between risks and opportunities. Opportunities are channeled back to management’s strategy or objective-setting processes.

Risk assessment: Risks are analyzed, considering likelihood and impact, as a basis for determining how they should be managed. Risks are assessed on an inherent and a residual basis.

Risk response: Management selects risk responses – avoiding, accepting, reducing, or sharing risk – developing a set of actions to align risks with the entity’s risk tolerances and risk appetite.

Control activities: Policies and procedures are established and implemented to help ensure the risk responses are effectively carried out.

Information and communication: Relevant information is identified, captured, and communicated in a form and time frame that enable people to carry out their responsibilities. Effective communication also occurs in a broader sense, flowing down, across, and up the entity.

Monitoring: The entirety of enterprise risk management is monitored and modifications made as necessary. Monitoring is accomplished through ongoing management activities, separate evaluations, or both.

COSO believes the Enterprise Risk Management – Integrated Framework provides a clearly defined interrelationship between an organization's risk management components and objectives that will fill the need to meet new law, regulation, and listing standards and expects it will become widely accepted by companies and other organizations and interested parties.

Limitations

COSO admits in their report that while enterprise risk management provides important benefits, limitations exist. Enterprise risk management is dependent on human judgment and therefore susceptible to decision making. Human failures such as simple errors or mistakes can lead to inadequate responses to risk. In addition, controls can be circumvented by collusion of two or more people, and management has the ability to override enterprise risk management decisions. These limitations preclude a board and management from having absolute assurance as to achievement of the entity’s objectives.

Although COSO claims their expanded model provides more risk management, companies are not required to switch to the new model if they are using the Internal Control-Integrated Framework.

COSO Guidance on Monitoring Internal Control Systems

Companies have invested heavily in improving the quality of their internal controls; however, COSO noted that many organizations do not fully understand the importance of the monitoring component of the COSO framework and the role it plays in streamlining the assessment process. In January 2009, COSO published its Guidance on Monitoring Internal Control Systemsto clarify the monitoring component of internal control.

Over time effective monitoring can lead to organizational efficiencies and reduced costs associated with public reporting on internal control because problems are identified and addressed in a proactive, rather than reactive, manner.

COSO’s Monitoring Guidance builds on two fundamental principles originally established in COSO’s 2006 Guidance:

• Ongoing and/or separate evaluations enable management to determine whether the other components of internal control continue to function over time, and
• Internal control deficiencies are identified and communicated in a timely manner to those parties responsible for taking corrective action and to management and the board as appropriate.

The monitoring guidance further suggests that these principles are best achieved through monitoring that is based on three broad elements:

• Establishing a foundation for monitoring, including (a) a proper tone at the top; (b) an effective organizational structure that assigns monitoring roles to people with appropriate capabilities, objectivity and authority; and (c) a starting point or “baseline” of known effective internal control from which ongoing monitoring and separate evaluations can be implemented;
• Designing and executing monitoring procedures focused on persuasive information about the operation of key controls that address meaningful risks to organizational objectives; and
• Assessing and reporting results, which includes evaluating the severity of any identified deficiencies and reporting the monitoring results to the appropriate personnel and the board for timely action and follow-up if needed.

The Role of Internal Audit

Internal auditors play an important role in evaluating the effectiveness of control systems. As an independent function reporting to the top management, internal audit is able to assess the internal control systems implemented by the organization and contribute to ongoing effectiveness. As such, internal audit often plays a significant monitoring role. In order to preserve its independence of judgment Internal Audit should not take any direct responsibility in designing, establishing, or maintaining the controls it is supposed to evaluate. It may only advise on potential improvement to be made.

The Role of External Audit

Under Section 404 of the Sarbanes-Oxley Act, management and the external auditors are required to report on the adequacy of the company’s internal control over financial reporting. Auditing Standard No. 5, published by the Public Company Accounting Oversight Board, requires auditors to “use the same suitable, recognized control framework to perform his or her audit of internal control over financial reporting as management uses for its annual evaluation of the effectiveness of the company's internal control over financial reporting”.^[7]

External links

• COSO

References

1. ^ http://www.coso.org/Publications/NCFFR.pdf, "Report of the National Commission on Fraudulent Financial Reporting", Retrieved March 23, 2011.
2. ^ http://www.coso.org/IC-IntegratedFramework-summary.htm, "Internal Control— Integrated Framework", Retrieved March 23, 2011.
3. ^ http://www.cfo.com/article.cfm/5598405/c_2984409/?f=archives, "The Trouble with COSO", March 15, 2006, Retrieved March 23, 2011.
4. ^ http://edocket.access.gpo.gov/cfr_2006/aprqtr/pdf/17cfr240.15d-15.pdf, Section 240 15d-15, Retrieved March 23, 2011.
5. ^ http://www.cfo.com/article.cfm/5598405/2/c_5620756, CFO Magazine, Retrieved March 23, 2011.
6. ^ http://www.coso.org/Publications/ERM/COSO_ERM_ExecutiveSummary.pdf, "Enterprise Risk Management - Integrated Framework", Retrieved March 23, 2011.
7. ^ http://www.pcaobus.org/Rules/Docket_021/2007-05-24_Release_No_2007-005.pdf, (AS No. 5.5), Retrieved March 23, 2011.