According to the Association of Certified Fraud Examiners, weak internal controls are responsible for almost half of all fraud. So, how do you ensure your system isn`t making your organization an easy target for fraud? You can use an expert-designed model to design and implement your internal controls. The Committee of Sponsoring Organizations of the Treadway Commission wrote one of the most commonly used frameworks. The COSO board develops guidance documents that help organizations with risk assessment, internal controls, and fraud prevention.
The original COSO framework was developed in 1992, with the most recent version published in 2013. According to the COSO, internal control Focuses on achieving objectives in operations, reporting and compliance. It is an ongoing process that Depends on people`s actions, not merely written policies and procedures. It Ensures senior management of security to a reasonable degree. It can be adapted to the needs of the whole organization and each department, unit, or process. The COSO framework divides internal control objectives into operations, reporting, and compliance. Operations objectives, such as performance goals and securing the organization`s assets against fraud, focus on the effectiveness and efficiency of your business operations. Reporting objectives, including internal and external financial reporting and non-financial reporting, relate to transparency, timeliness and reliability of the organization`s reporting habits. Compliance objectives are internal control goals based on adhering to laws and regulations that the organization must comply with. The COSO framework further teaches that there are five components to an internal control system. First, the control environment is the “set of standards, processes, and structures that provide the basis for carrying out internal controls across the organization.” This component includes you:
Ethical values Organizational structure Commitment to employing competent employees Human resources policies Next, risk assessment involves your organization`s analysis of the risks posed by internal and external changes, the ability to establish objectives and determine their suitability for your business and the process for weighing risks versus risk tolerances. Control activities are the tasks and activities (laid out by organizational policies and procedures) that help you achieve your internal control objectives. These include actions such as “authorizations and approvals, verifications, reconciliations, and business performance reviews.” The information and communication component recognizes these as essential to any internal control system. COSO stresses the importance of relevant and high-quality information to control functions. Internal messages emphasizing the importance of control responsibilities and clear communication of expectations with external parties are critical to a robust system. Finally, monitoring your internal controls is just as important as establishing them. Use ongoing evaluations built into your business processes and regular separate assessments, which will vary based on your level of risk, system effectiveness and regulation requirements. COSO and SOX see the need for stronger internal controls from different perspectives. COSO provides a framework that administrators can use to design control environments. In the 2013 COSO Vision Update, the Commission expanded the framework to include 17 principles and 87 key points to consider when assessing the control environment. On the other hand, the SOX Act does not contain guidelines regarding internal controls. This law introduced an effective control environment as a statutory requirement for all SOEs. The SOX Act went further by holding CEOs and CFOs criminally liable for failing to control risks associated with financial reporting.
Leveraging the COSO framework to benchmark your current control environment against the five components and 17 principles can create valuable benefits for companies of all sizes.
Improved Governance: Poor governance and oversight of business performance have led to countless business failures and lower shareowner value. A fundamental goal of COSO is to improve the corporate governance function within organizations that monitor security, risk, and compliance programs to ensure adherence to policies, goals, and laws.
Improved Risk Assessments: Most incidents occur due to employee negligence or mistakes. However, most workplace incidents occur due to insufficient management controls. Prior risk assessment and improved fraud detection and prevention can prevent most accidents. The COSO platform can help organizations improve fraud risk management. This structure also allows organizations to have controls to prevent fraud in the first place, detect fraud as soon as it occurs, and respond effectively when it happens.
Enhanced Application Security: Companies face an onslaught of fraudulent activity, security threats, and other application risks. The COSO framework provides guidelines for organizations to assess and improve their application control environment to detect and prevent cyber threats.
Significant Cost Savings: If organizations implement the COSO framework correctly, they will streamline processes, establish more effective internal controls, and better manage risk and compliance costs.
More Positive Attention from Investors: Investors are scrutinizing public companies' performance more than ever. If your company adopts the COSO framework, it will have a more effective set of risk management controls, making it more attractive to potential investors and better prepared for an IPO.