COSO Committee of Sponsoring Organizations of the Treadway Commission
Committee of Sponsoring Organizations of the Treadway Commission
Principle 17. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. fn 30
The following points of focus highlight important characteristics relating to this principle:
-
Assesses Results—Management and the board of directors, as appropriate, assess results of ongoing and separate evaluations.
-
Communicates Deficiencies—Deficiencies are communicated to parties responsible for taking corrective action, and to senior management and the board of directors, as appropriate.
-
Monitors Corrective Actions—Management tracks whether deficiencies are remediated on a timely basis.
• Assesses Results
• Communicates Deficiencies
Monitors Corrective Actions
Management develops policies and practices to periodically assess and communicate deficiencies that result from the entity's monitoring activities and other sources. Management establishes a practice where all deficiencies in internal control over external financial reporting, regardless of materiality, are reported to the responsible manager and at least one level of management above, both of whom are positioned to take or oversee corrective action. Management also classifies deficiencies for the further reporting to senior management or the board based on criteria established by standard setters or regulators. fn 31 The criteria could include the following:
-
Nature of the deficiency
-
Source of the deficiency
-
Known magnitude of a misstatement caused by the deficiency to the entity's financial statements
-
The likelihood and potential magnitude of a misstatement caused by the deficiency to the entity's financial statements
-
An aggregation of deficiencies affecting similar areas that could indicate a more serious deficiency
The senior management of Adelie Telecom receives a quarterly report of deficiencies prepared by its internal audit department. On the third-quarter report this year, deficiencies were reported from several sources, including the following:
-
External Source—Customer complaints about overbilling were brought to management's attention and investigated. The subsequent investigation exposed that the billing system was using the wrong tariff rate, which had been incorrectly coded in the system. The problem was traced to an input error that was neither prevented nor detected by control activities.
-
Separate Evaluations—Management directed internal audit to conduct a special evaluation of the sources and quality of information used for Adelie Telecom's payroll reconciliation. The evaluation identified that some of the information used was not appropriate. Specifically, an outdated report with inaccurate information was being used for the reconciliation. Consequently, the payroll reconciliation control activity was updated to use the correct report.
-
Ongoing Evaluations—Adelie Telecom allows a 10% variance in paying installation contractors, and so management developed an automated monitoring control to review the trends in variance activity approvals by payables clerks. One such report identified that Arnie Chinstrap, a payables clerk, was routinely approving variances of 10% for a particular vendor, Bosque & Sons Installers. An investigation confirmed that Mr. Chinstrap had an arrangement with Bosque & Sons for a financial kickback and that Adelie Telecom was overpaying the contractor. To address the deficiency in internal control, management implemented a supervisory review for all payments within the 10% variance.
The management of Skea and Associates, an international insurance services organization, classifies financial reporting control deficiencies identified from its monitoring activities as deficiencies, significant deficiencies, or material weaknesses. The communication structure for reporting deficiencies is based on their potential impact on the organization.
For each level of deficiency, fn 32 the company's internal reporting structure calls for certain reporting procedures:
-
Deficiencies are reported in detail to the manager responsible for the control.
-
Significant deficiencies are reported in detail to the manager responsible for the control and to the senior management team, and on a quarterly basis, in summary, to the audit committee.
-
Material weaknesses are reported in detail to the manager responsible for the control and the senior management team, and on a quarterly basis to the audit committee.
Assesses Results
Communicates Deficiencies
• Monitors Corrective Actions
Management establishes a practice to review the status of corrective actions taken to verify that reported deficiencies are remediated in a timely manner. The corrective action practice may include:
-
Regularly scheduled meetings to review the status of corrective actions
-
An established electronic or hard-copy report in which corrective actions are summarized and collated
-
Delegated oversight to a responsible party, such as an internal audit function
The senior management of Lwiski Manufacturing tracks all control deficiencies identified during monitoring activities and assesses their impact on the organization. These control deficiencies are reported to the management team responsible for the relevant business unit. If necessary, the management team works with internal audit to develop the remediation plan, and internal audit provides oversight to verify deficiencies are remediated in a timely manner.
Specifically, the plan calls for one individual within the business unit to be assigned responsibility for remediating specific control deficiencies. A time frame for remediation is assigned to each control deficiency, based on its ranking. Working together, management and internal audit verify that deficiencies are remediated within the specified time frame.
Mr. James, the chief audit executive of Puna Incorporated, has established a database that tracks management action plans related to issues coming from internal audit reports. Mr. James receives timely updates on the status of actions from business process owners, and also periodically reports to the audit committee summaries of the status of action plans. The reporting includes the percent of action plans implemented on time by business unit.
When sufficient action has not been able to be taken by the business on important internal audit issues by the original reported implementation date, the process owner for the area is invited to attend the audit committee and explain the issues associated with implementation of appropriate actions.
Assesses Results
• Communicates Deficiencies
Monitors Corrective Actions
The board of directors develops a shared expectation with senior management on the types of control deficiencies that get reported to the board. The board of directors understands the facts and circumstances regarding internal control deficiencies that impact external financial reporting and provides oversight on management's conclusions and remediation plans.
Klemmens and Waters provide air transportation services. The management of the company periodically develops a report of significant deficiencies and material weaknesses, a summary of minor deficiencies, and a summary of past deficiencies. The purpose is to track whether deficiencies are being remediated in a timely manner. The reports are presented to the board for review.
Management has also developed with the audit committee a shared expectation, which states that regardless of the previous categorization, management will report all deficiencies resulting from:
-
Illegal or otherwise improper acts
-
A significant loss of assets
-
Intentional errors and omissions in the conduct of external financial reporting
The audit committee is briefed on the cause of the reported deficiencies and provides oversight of management's assessment of the deficiencies and the actions and status of remediation plans.
fn 30 In many cases the board of directors will appoint a committee to oversee the system of internal control depending on the objective. For example the board may appoint an audit committee to oversee system of internal controls for financial reporting.
fn 31 For example, in the United States, the SEC issued "Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934." Section B.1. covers the evaluation of control deficiencies that provides management with guidance on the assessment and reporting of deficiencies.
fn 32 For purposes of this example the deficiency classifications used are those related to external financial reporting in the US as promulgated by the SEC.
| |
Copyright © 2013 – 2016 Committee of Sponsoring Organizations of the Treadway Commission and the American Accounting Association. All Rights Reserved. Use of materials is subject to COSO's Policy of Acceptable Use.
To access this page, please login with your COSO credentials using the button below:
Login to COSOPlease enter your COSO login credentials below
Please contact marybeth.gripshover@aaahq.org with any questions