COSO Committee of Sponsoring Organizations of the Treadway Commission
Committee of Sponsoring Organizations of the Treadway Commission
An electronic version of this template can be downloaded from www.cpa2biz.com/COSOEvalTools.
| Component Evaluation — Control Environment | ||||
|---|---|---|---|---|
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 1. Demonstrates Commitment to Integrity and Ethical Values—The organization demonstrates a commitment to integrity and ethical values. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 2. Exercises Oversight Responsibility—The board of directors demonstrates independence from management and exercises oversight for the development and performance of internal control. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 3. Establishes Structure, Authority, and Responsibility—Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 4. Demonstrates Commitment to Competence—The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 5. Enforces Accountability—The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Explanation/Conclusion | ||||
| Evaluate deficiencies across the component:* Evaluate if any internal control deficiencies or combination of internal control deficiencies, when considered across the component, represent a major deficiency** | ||||
| Evaluate the component using judgment and based on the principles and the deficiencies** | Yes/No | Explanation/Conclusion | ||
| Is the component present? | ||||
| Is the component functioning? | ||||
| * Note: Record deficiencies in Summary of Deficiencies Template. | ||||
| ** If it is determined that there is a major deficiency, management must conclude that the component is not present and functioning and the system of internal control is not effective. | ||||
| Component Evaluation — Risk Assessment | ||||
|---|---|---|---|---|
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 6. Specifies Suitable Objectives—The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 7. Identifies and Analyzes Risks—The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 8. Assesses Fraud Risk—The organization considers the potential for fraud in assessing risks to the achievement of objectives. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 9. Identifies and Analyzes Significant Change—The organization identifies and assesses changes that could significantly impact the system of internal control. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Explanation/Conclusion | ||||
| Evaluate deficiencies across the component:* Evaluate if any internal control deficiencies or combination of internal control deficiencies, when considered across the component, represent a major deficiency** | ||||
| Evaluate the component using judgment and based on the principles and the deficiencies** | Yes/No | Explanation/Conclusion | ||
| Is the component present? | ||||
| Is the component functioning? | ||||
| * Note: Record deficiencies in Summary of Deficiencies Template. | ||||
| ** If it is determined that there is a major deficiency, management must conclude that the component is not present and functioning and the system of internal control is not effective. | ||||
| Component Evaluation — Control Activities | ||||
|---|---|---|---|---|
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 10. Selects and Develops Control Activities—The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 11. Selects and Develops General Controls over Technology—The organization selects and develops general control activities over technology to support the achievement of objectives. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 12. Deploys through Policies and Procedures—The organization deploys control activities through policies that establish what is expected and procedures that put the policies into action | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Explanation/Conclusion | ||||
| Evaluate deficiencies across the component:* Evaluate if any internal control deficiencies or combination of internal control deficiencies, when considered across the component, represent a major deficiency** | ||||
| Evaluate the component using judgment and based on the principles and the deficiencies** | Yes/No | Explanation/Conclusion | ||
| Is the component present? | ||||
| Is the component functioning? | ||||
| * Note: Record deficiencies in Summary of Deficiencies Template. | ||||
| ** If it is determined that there is a major deficiency, management must conclude that the component is not present and functioning and the system of internal control is not effective. | ||||
| Component Evaluation — Information and Communication | ||||
|---|---|---|---|---|
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 13. Uses Relevant Information—The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 14. Communicates Internally—The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 15. Communicates Externally—The organization communicates with external parties regarding matters affecting the functioning of internal control. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity: (Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Explanation/Conclusion | ||||
| Evaluate deficiencies across the component:* Evaluate if any internal control deficiencies or combination of internal control deficiencies, when considered across the component, represent a major deficiency** | ||||
| Evaluate the component using judgment and based on the principles and the deficiencies** | Yes/No | Explanation/Conclusion | ||
| Is the component present? | ||||
| Is the component functioning? | ||||
| * Note: Record deficiencies in Summary of Deficiencies Template. | ||||
| ** If it is determined that there is a major deficiency, management must conclude that the component is not present and functioning and the system of internal control is not effective. | ||||
| Component Evaluation — Monitoring Activities | ||||
|---|---|---|---|---|
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 16. Conducts Ongoing and/or Separate Evaluations—The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity:(Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Present? (Y/N) | Functioning? (Y/N) | Explanation/Conclusion | ||
| 17. Evaluates and Communicates Deficiencies—The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. | ||||
| Identification No. | Internal control deficiency description | Evaluate internal control deficiency severity:(Consider whether controls to effect other principles within and across components compensate for the internal control deficiency.) | List internal control deficiencies related to another principle that may impact this internal control deficiency | |
| Is internal control deficiency a major deficiency? (Y/N) | Comments/ Compensating Controls | |||
| Explanation/Conclusion | ||||
| Evaluate deficiencies across the component:* Evaluate if any internal control deficiencies or combination of internal control deficiencies, when considered across the component, represent a major deficiency** | ||||
| Evaluate the component using judgment and based on the principles and the deficiencies** | Yes/No | Explanation/Conclusion | ||
| Is the component present? | ||||
| Is the component functioning? | ||||
| * Note: Record deficiencies in Summary of Deficiencies Template. | ||||
| ** If it is determined that there is a major deficiency, management must conclude that the component is not present and functioning and the system of internal control is not effective. | ||||
| Generated November 10, 2014 20:30:53 |