COSO Committee of Sponsoring Organizations of the Treadway Commission
Principle 3. Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
The following points of focus highlight important characteristics relating to this principle:
-
Considers All Structures of the Entity—Management and the board of directors consider the multiple structures used (including operating units, legal entities, geographic distribution, and outsourced service providers) to support the achievement of objectives.
-
Establishes Reporting Lines—Management designs and evaluates lines of reporting for each entity structure to enable execution of authorities and responsibilities and flow of information to manage the activities of the entity.
-
Defines, Assigns, and Limits Authorities and Responsibilities—Management and the board of directors delegate authority, define responsibilities, use appropriate processes and technology to assign responsibilities, and segregate duties as necessary at the various levels of the organization:
-
Board of Directors—Retains authority over significant decisions and reviews management's assignments and limitations of authorities and responsibilities
-
Senior Management—Establishes directives, guidance, and control to enable management and personnel to understand and carry out their internal control responsibilities
-
Management—Guides and facilitates the execution of senior management directives within the entity and its subunits
-
Personnel—Understands the entity's standard of conduct, assessed risks to objectives, and the related control activities at their respective levels of the entity, the expected information and communication flow, and monitoring activities relevant to their achievement of the objectives
-
Outsourced Service Providers—Adheres to management's definition of the scope of authority and responsibility for all non-employees engaged
• Considers All Structures of the Entity
• Establishes Reporting Lines
• Defines, Assigns, and Limits Authorities and Responsibilities
Senior management prepares organizational charts to document, communicate, and enforce accountability for the achievement of the entity's financial reporting objectives. The organizational charts can be used to:
-
Set forth assignments of authority and responsibility
-
Ensure duties are appropriately segregated
-
Establish reporting lines and communication channels
-
Define the various reporting dimensions relevant to the organization
-
Identify dependencies for roles and responsibilities involved in financial reporting as well as those accountable for external parties
Each unit or department within the entity that is relevant to external financial reporting aligns its roles and responsibilities to processes supporting the financial reporting objectives. Senior management and the board of directors verify that accountability and information flow within each of the various organizational structures (by business segment, geographical location, legal entity, or other) continually support the achievement of the entity's existing financial reporting objectives. Existing structures are periodically assessed for relevance considering changes in the entity or the environment in which it operates to ensure such alignment.
Before Harmony Homes Real Estate became a public company, a wide range of the employees reported to the owner and CEO, Milton Chang, and the business structures in the US and in Asia were loosely connected. During the plans to go public, Mr. Chang, with the board's guidance, took steps to strengthen the organizational structure to better support both operations and financial reporting objectives. Management created three departments to oversee its core business activities: sales and customer service, purchasing/inventory, and production. Geographic governance structures were also established to oversee operations by jurisdiction and facilitate reporting to local regulators and other stakeholders. The managers charged with leading each of these departments and territories, as well as the managers of key staff functions, documented each person's responsibility in the processes. Job descriptions, including internal control responsibilities, were developed to support full understanding of each person's role.
The clear statement of roles helps to ensure responsibilities are carried out in support of the organization's objectives. It also provides the basis for risk assessment, control activities, information and communication, and monitoring activities along different dimensions simultaneously.
Due to significant changes within the company and the industry, Pieter Jenssen, CEO of transportation services provider General Trucking, recognized the need to redefine the role of each position within the company's mid- to high-level management team, especially within the finance and accounting function. His initiative was launched at an off-site meeting where the goals and objectives of the business were reviewed and realigned with managers’ specific roles and responsibilities, including those related to the financial reporting process. Two board members attended the meeting to serve as a sounding board, and all participants reached a shared understanding on how they will function and interact with one another in the future. The results of the meeting were communicated to other managers throughout the organization. The communication included a description of organizational lines by product line, geography, and management structure. It also included associated roles, responsibilities, and communication procedures, incorporated into policies that were made readily accessible on the company's intranet.
Considers All Structures of the Entity
Establishes Reporting Lines
• Defines, Assigns, and Limits Authorities and Responsibilities
The board of directors outlines its oversight authority for financial reporting over senior management through its charter. When assigning authorities and responsibilities, management considers the impact on the control environment and the importance of effectively segregating duties. Policy documents define cascading levels of authority, checks, and balances for authorizing transactions, and accounting and reporting of financial results. Such authority and responsibility is deliberately limited in order to balance the need for the efficient achievement of objectives against the risks that could result from unmonitored inappropriate conduct. Management empowers employees to correct problems or implement improvements in their assigned business process as necessary.
Muell AG, a waste management company maintains policies that detail the monetary commitment and transaction approval authorities of its managers on a per occurrence basis. Managers who exceed their individual transactions authority must obtain approval from the appropriate higher-level management, which in some cases includes the board of directors. These authority and responsibility policies exist for a broad range of the company's business functions, including mergers and acquisitions, sales and marketing, purchasing, risk management, labor, capital expenditures (including landfills), IT expenditures, and leases. The policies are updated when necessary to reflect changes in the business, and any revisions require the approval of the chief accounting officer.
Considers All Structures of the Entity
Establishes Reporting Lines
• Defines, Assigns, and Limits Authorities and Responsibilities
Based on the delegated authority levels, management maintains job descriptions to outline financial reporting responsibilities, and updates them when needed. In addition, management provides sufficient direction to ensure that employees recognize their responsibility for internal control and the importance of applying appropriate diligence and business judgment when they carry out their assigned job responsibilities.
For key financial reporting positions, the board of directors reviews management's descriptions of the related authorities and responsibilities and considers how those positions affect the strength of internal control over external financial reporting.
When applicable, the responsibilities of externally sourced support personnel are outlined through service-level agreements, specifically targeting timeliness and the quality of financial reports generated.
The senior management at MNO Games, a games software developer, has recognized that the company's recent significant growth is causing many of the roles and responsibilities of its management executives to be no longer relevant. Responsibilities of the controller and CFO overlap, systems for product being sold through new channels are not adequately reviewed, and the CEO is not effectively communicating initiatives and agreements across the senior management team.
In response, the senior managers have initiated a project to realign responsibilities among its leadership team. The goals are to adequately support financial reporting objectives, with clear lines of reporting supported by new written job descriptions. The project has already resulted in a new company policy for MNO Games that requires each business unit manager to maintain the updated job descriptions and organizational charts depicting positions and lines of reporting within the unit.
SureSafe provides identify-theft protection and credit management services to credit card companies and has decided to outsource its payroll and 401(k) plan administration to capitalize on cost savings, ease access to relevant specialists for technical and administrative questions, and improve segregation of duties between its key payments and collections processes.
SureSafe identified a small reputable company, J.K. Green and Associates, as one that would meet its processing, reporting, and internal control needs. The service-level agreement signed by both parties specifies each party's expectations and responsibilities for the services provided and internal control over the outsourced business processes.
In companies with formal internal audit functions (which can vary from an individual assigned with internal audit responsibilities to a formal department), the board of directors empowers the internal audit function to carry out its purpose, authority, and responsibilities with direct access to the audit committee and/or the board of directors. The board or audit committee is actively involved in reviewing the company's risk assessment, ensuring that the internal audit plan provides adequate assurance on the adequacy of coverage of key risk areas, and overseeing internal audit compensation to ensure it is structured in a manner that supports the need for objectivity.
Sam Murphy, the chief audit executive officer of Pine Tree Real Estate, annually presents an internal audit plan to the CEO and audit committee for review and approval. The audit plan includes the scope, work plan, staffing, and budget for the coming year, as well as any modifications needed in the charter to define roles and responsibilities.
The audit committee reviews and approves the plan, recognizing that it may need to be revisited periodically to respond to significant changes in the company, such as new product lines, acquisitions, unexpected regulatory issues, etc. The audit committee regularly assesses the independence of the chief audit executive and evaluates the activities of the internal audit function.
|
Copyright © 2013 – 2016 Committee of Sponsoring Organizations of the Treadway Commission and the American Accounting Association. All Rights Reserved. Use of materials is subject to COSO's Policy of Acceptable Use.
To access this page, please login with your COSO credentials using the button below:
Login to COSOPlease enter your COSO login credentials below
Please contact marybeth.gripshover@aaahq.org with any questions