CHAPTER 6

• Business Continuity Plan


  A set of predetermined policies and procedures that the company will implement to ensure continuity of business operations and continuous processing of business transactions
• Communication


  A continual, iterative process of providing, sharing, and obtaining necessary information
• Control Activities


  Specific actions established through policies and procedures that help ensure that management's directives to mitigate risks to the achievement of objectives are carried out
• Control Environment


  The foundation of internal control and is often referred to as "tone at the top." This is comprised of standards, processes, and structures that provide the basis for carrying out internal control. Included in the control environment is the attitudes, awareness, and actions of top management and the board of directors regarding the importance of internal control in the organization
• COSO


  The Committee of Sponsoring Organizations comprised of the American Institute of Certified Public Accountants (AlCPA), American Accounting Association (AAA), Institute of Management Accountants (IMA), Institute of Internal Auditors (lIA), and the Financial Executives International (FEI). COSO published the original internal control framework in 1992
• Impact


  Pertains to the significance, consequence, or magnitude of the identified risk to the company
• Internal Communication


  The means by which information is disseminated throughout the organization, flowing up, down, and across the entity
• Internal Control


  Process effected by the board of directors, management, and other personnel designed to provide reasonable assurance regarding the achievements of business objectives
• Internal Controls Over Financial Reporting (ICFR)


  Controls and procedures involved in the recording process and up to the generation of reliable financial statements
• Likelihood


  Pertains to the probability of the occurrence of a negative event
• Management Override


  One of the inherent limitations of internal control whereby people who are in positions of power may intervene and break internal control policies
• Physical Controls


  Pertains to internal controls that have tangible characteristics such as cash vaults, physical fences, CCTV cameras, biometric devices, and inventory storage facilities, among others
• Risk Assessment


  An iterative process for identifying and assessing those risks that may prevent the achievement of enterprise objectives
• Risk Identification


  The sub-process of identifying events that could pose a threat to company objectives
• Segregation Of Incompatible Duties


  The separation of functions among company personnel to prevent fraud irregularity. This included segregating the duties of recording business transactions and custodianship of cash
• Significant Risks


  Are risks that have high-risk scores for both likelihood and impact
• Window Dressing


  Refers to the accounting practice of manipulating financial statements in order to hide financial problems or poor management performance from investors. This is also called fraudulent financial reporting
• COSO member organizations

  • American Institute of Certified Public Accountants (AlCPA)
  • American Accounting Association (AAA)
  • Institute of Management Accountants (IMA)
  • Institute of Internal Auditors (lIA)
  • Financial Executives International (FEI)
• Efficient Operations

  Achieved when the company is able to minimize the operating costs and avoid operational inefficiencies
• Performance reviews


  Comparison of actual performance against budgets and forecasts
• Information processing


  Controls that check the accuracy, completeness, and authorization of transactions
• Physical controls


  Activities that assure the physical security of assets and records
• Segregation of duties


  Separation of the functions of transaction authorization, record-keeping, and custody
• Whistleblower reporting mechanism


  An employee may report fraud or irregularity through a hotline system
• External communication


  Is two-fold; it enables inbound communication of relevant external information and provides information to external parties in response to requirements and expectations
• Ongoing monitoring


  Built into business processes at different levels of the entity, provide timely-information
• Separate evaluations


  Are conducted periodically, will vary in scope and frequency depending on assessment of risks, effectiveness of ongoing evéluaticms, and other management considerations
• "present"


  The five components exist in the design and implementation of the system of internal control to achieve business objectives
• "Functioning"


  Means that the components continue to exist and are being implemented over time