The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control and expected standards of conduct.

There are five principles relating to Control Environment:

1.    The organization demonstrates a commitment to integrity and ethical values.

2.    The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.

3.    Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.

4.    The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

5.    The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

Risk assessment involves a dynamic and iterative process for identifying and analyzing risks to achieving the entity's objectives, forming a basis for determining how risks should be managed. Management considers possible changes in the external environment and within its own business model that may impede its ability to achieve its objectives.

There are four principles relating to Risk Assessment:

6.    The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

7.    The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

8.    The organization considers the potential for fraud in assessing risks to the achievement of objectives.

9.    The organization identifies and assesses changes that could significantly impact the system of internal control.

Control activities are the actions established by policies and procedures to help ensure that management directives to mitigate risks to the achievement of objectives are carried out. Control activities are performed at all levels of the entity and at various stages within business processes, and over the technology environment.

There are three principles relating to Control Activities:

10.    The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

11.    The organization selects and develops general control activities over technology to support the achievement of objectives.

12.    The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.

Information is necessary for the entity to carry out internal control responsibilities in support of achievement of its objectives. Communication occurs both internally and externally and provides the organization with the information needed to carry out day-to-day controls. Communication enables personnel to understand internal control responsibilities and their importance to the achievement of objectives.

There are three principles relating to Information and Communication:

13.    The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.

14.    The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.

15.    The organization communicates with external parties regarding matters affecting the functioning of internal control.

Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning. Findings are evaluated and deficiencies are communicated in a timely manner, with serious matters reported to senior management and to the board.

There are two principles relating to Monitoring Activities:

16.    The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

17.    The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.