The Coso Internal Control Framework

Control Environment- Although there were controls in place at CIT; it was a common practice to override the establishes controls. This component of COSO includes the ‘tone at the top”. If there had been a set rigid rule established by the top-level management then Niakan would not have had any excuse to override the controls.

The control structure is the means used to ensure that organization members are doing what they are supposed to do; it describes the nature of and methods for communication in an organization. Due to lack of a structural job design and absence of coordination within departments and lack of autonomy employees are irresponsible and do not perform the task to

“The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.” The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control–Integrated Framework in 1992. As summarized above one can see the importance of the implementation of an effective control environment, as it sets the foundation for the other 4 components of internal control. The control environment is made up fundamental smaller components. The ones that were particularly relevant to BMIS are the use of board of directors and audit committee, management philosophy and operating style, and human resource policies and practices. If management doesn’t prioritize control, then the rest of the organization will not put precedence on following policies and procedures either. This was clearly evident at Bernard L. Madoff Investment Securities LLC (BMIS), and ultimately led to their downfall.

The design and implementation and objectives of company controls are not adequate to meet the control objectives. The control environment control objective is ineffective. This control objective lacks a written policy on ethical conduct, is lacking oversight from the board of directors and audit committee, lacks a consistent style and philosophy from management, and lacks a strong commitment to competence. The risk assessment control objective is effective but lacks any antifraud program and controls. The information and communication control is ineffective. A virus has been detected and is affecting the files of the company. This control is lacking a strong IT department. The general controls financial reporting control objective is effective but is weak in detecting or preventing material misstatement. The monitoring control objective is ineffective; this control has need of an internal auditor.

Overall Strength: in general, the article provides structure to a concept that is very intangible by: (a) describing the nature and the functions of control; (b) segregating the MCS into categories: core control system, organizational structure, and organizational culture; (c) illustrating how to apply the control model (satisfied my approach) (d) provides a basis for designing and evaluating the system. The manner, in which the model is presented, with its use of figures, further emphasizes the structure of the model. See below on further emphasis on parts (a) -(c).

1. To have a strong internal control system, a business must have good administrative controls. Administrative controls include: A. B. C. D. the reconciliation of the bank statement. the accuracy of the recording procedures. assessing compliance with company policies. maintenance of accurate inventory records.

Internal control is one of the integral parts of an organization. It is a system which controls different types of risks,

The first component mentions, control environment sets the tone of an organization, influencing the control consciousness of its people, (Cleverly, Song, & Cleverly, 2011). The authors mention of this rule being the foundation for all the components providing discipline and structure for all other internal control components. The next interrelated internal control is risk assessment is the entity’s identification and analysis of relevant risks to achievement of its objectives, forming a basis for determining how the risks should be managed, (Cleverly, Song, & Cleverly, 2011). Then, there is the information and communication are the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities, (Cleverly, Song, & Cleverly, 2011). This is very helpful for health care organizations to implement and follow through carefully in their departments and especially billing and coding. The last internal control rule states, monitoring is a process that assesses the quality of internal control performance overtime, (Cleverly, Song, & Cleverly, 2011). These internal controls related to the corporate compliance program are all impertinent to health care

of internal controls are (1) to safeguard assets and (2) to ensure reliability of the financial

Section 404 of SOX requires that evaluation of internal controls by management must be established on well-known control framework that was created by knowledgeable professionals who use “due process”. SOX does specifically mention and promote the use of COSO’s Internal Control-Integrated Framework. SOX supports COSO’s framework, its definition of internal control, in general and recommends its use to stay in compliance with SOX and SEC regulations and rules. (PwC, 2005)

Internal controls prevent errors and irregularities from happening. If errors or irregularities do happen to occur internal controls will help ensure that they are detected in a timely manner. Internal controls also encourage adherence to prescribe policies and procedures. Internal control are also put into place in order to protect employees by outlining tasks and responsibilities, providing checks and balances, and also from being accused of misappropriations, errors and irregularities.

Control Weakness: CEO conceals information from the Audit Committee. The Director of Internal Audit also does not feel that the Audit Committee is friendly. Internal Audit has been steered away from the manufacturing process and the reconciliation process by the CEO. Although there is a code of conduct, a monthly newsletter and an open door policy according to the CEO, these efforts do not appear to be successful because of management override. Employees interviewed lack of awareness of these programs. All of these issues are signals of a deficiency of the Control Environment aspect of the COSO framework.

My understanding of this article is that the monitoring of internal control is performed through application of ongoing evaluations and separate evaluations. Over time, these evaluations make sure that other components of internal control continue to function. In addition, another principle is that the evaluations assist the progress identification of internal control deficiencies and communicate them to the parties responsible for taking corrective actions.

The control environment is what sets the tone for an organization and is the foundation for all other components of internal control. It provides discipline and structure and reflects the ethical values, integrity and competencies of the organization. The control environment is very important to effective internal control over financial reporting to an audit client like WorldCom, because good designs can prevent and detect frauds and errors. But because WorldCom had such a poor control environment, the company would require more testing for an audit. This shows that the board did not exercise oversight responsibilities over financial reporting or internal controls.

Effective internal controls protect a company’s assets, maintain compliance, improve operations, prevent fraud, and promote accuracy in financial reporting. In 1992 the