COSO Committee of Sponsoring Organizations of the Treadway Commission
Committee of Sponsoring Organizations of the Treadway Commission
| Prev | Next | |
This section considers some unique aspects of applying the Framework in the context of external financial reporting, especially the preparation of financial statements for external purposes.
External financial reporting objectives are consistent with accounting principles suitable and available for an entity and appropriate in the circumstances. External financial reporting objectives address the preparation of financial reports, including financial statements for external purposes and other external financial reporting derived from an entity's financial and accounting books and records.
Financial statements for external purposes are prepared in accordance with applicable accounting standards, rules, and regulations. fn 2 These financial statements may include annual and interim financial statements, condensed financial statements, and selected financial information derived from such statements. These statements may, for instance, be publicly filed with a regulator or distributed through annual meetings, an entity's website, or other electronic media.
Another form of financial statements prepared for external purposes may be financial reports prepared in accordance with a special purpose framework, such as those established by taxing authorities or regulatory agencies, or those required through contracts and agreements. These financial reports are typically distributed to specified external users (e.g., reporting to a bank on financial covenants established in a loan agreement, reporting to a taxing authority in connection with filing tax returns, reporting on financial information to an energy regulatory commission).
Other external financial reporting derived from an entity's financial and accounting books and records rather than from its financial statements for external purposes may include earnings releases, selected financial information posted to an entity's website, and selected amounts reported in regulatory filings. External financial reporting objectives relating to such other financial information may not be driven directly by regulators and standard setters, but typically stakeholders expect them to align with such standards and regulations.
Regulators and accounting standard setters establish laws, rules, regulations and standards relating to the preparation of financial statements for external purposes. These form the basis upon which management specifies suitable objectives for the entity and its subunits. Regulators, standard-setting bodies, and other relevant third parties also establish criteria for defining the severity of, evaluating, and reporting internal control deficiencies. The Framework recognizes and accommodates their authority and responsibility as established through laws, rules, regulations, and standards.
In the case of an entity applying a law, rule, regulation, or standard, management should use only the relevant criteria contained in those documents when classifying the severity of internal control deficiencies, rather than the classifications set out in the Framework. The Framework recognizes that if a deficiency results in a system of internal control not being effective under such classification criteria then management cannot conclude that the entity has met the requirements for effective internal control as set forth in the Framework.
For example, a company that must comply with the classification criteria established by the United States Securities Exchange Commission (SEC) would use only the definitions and guidance set out for classifying internal control deficiencies as a material weakness, significant deficiency, or control deficiency. fn 3 If an internal control deficiency is determined to rise to the level of a material weakness, the organization would not be able to conclude that the entity's system of internal control over financial reporting has met the requirements for effective internal control as set out in the Framework. If an internal control deficiency does not rise to the level of material weakness the entity could achieve effective internal control over financial reporting.
Within the boundaries established by laws, rules, regulations, and standards, management exercises judgment to assess the severity of an internal control deficiency, or combination of deficiencies, in determining whether components are present, functioning, and operating together, and ultimately in concluding that the entity's system of internal control is effective.
In specifying the suitability of external reporting objectives relating to the preparation of financial statements for external purposes, management considers the accounting standards that apply to that entity and its subunits. Management then assesses and affirms the accounting principles that are appropriate in the circumstances. For example, management may set an entity-level external financial reporting objective as follows: "Our company prepares reliable financial statements reflecting transactions and events in accordance with generally accepted accounting principles." fn 4
Management specifies suitable sub-objectives for the entity's divisions, subsidiaries, operating units, and functions with sufficient clarity to support entity-level objectives.
For example, a US company applies accounting principles generally accepted in the United States of America (US GAAP) to all subunits in preparing its consolidated financial statements; its subsidiaries also apply International Financial Reporting Standards (IFRS) to submit their subsidiary financial statements in various statutory filings in local jurisdictions.
Further, management assesses and affirms the suitability of the accounting principles to apply to transactions and events of the entity. For example, management specifies that FASB Accounting Standard Codification Topic 605 Revenue Recognition and SAB 101A Revenue Recognition in Financial Statements (US GAAP) or IAS 18 Revenue Recognition (IFRS) applies to all sales transactions as applicable to achieve the entity or subunits’ respective external financial reporting objective.
In specifying and using applicable accounting principles, management exercises judgment, particularly relating to subjective measurements and complex transactions. For instance, management judgment is essential for making assumptions and using data in developing accounting estimates, in applying accounting principles to complex transactions and events, and in preparing reliable and transparent presentations and disclosures. In addition, management regularly updates the specified accounting principles for any changes in objectives established through law, rules, regulations and standards.
Financial statement materiality sets the threshold for determining whether a financial amount is relevant. Entities must consider suitable laws, rules, regulations, and standards promulgated by regulators and standard setters. fn 5
External financial reporting must reflect the entity's transactions and events. When preparing financial statements, management implicitly or explicitly considers suitable sub-objectives categorized into a set of assertions (e.g., existence and completeness of transactions) underlying the financial statements. Accounting standard setters may set forth these assertions as well as relevant qualitative characteristics for external financial reporting.
Management makes assertions regarding the recognition, measurement, presentation, and disclosure of accounts, transactions, and events included in the entity's financial statements. For example, one grouping of assertions fn 6 relating to financial statements is summarized as follows:
-
Existence or Occurrence—Assets, liabilities, and ownership interests exist at a specific date, and recorded transactions represent events that actually occurred during a certain period.
-
Completeness—All transactions and other events and circumstances that occurred during a specific period, and that should have been recognized in that period, have in fact been recorded.
-
Rights and Obligations—Assets are the rights and liabilities are the obligations of the entity at a given date.
-
Valuation or Allocation—Asset, liability, revenue, and expense components are recorded at appropriate amounts in conformity with relevant and appropriate accounting principles. Transactions are mathematically correct and appropriately summarized and recorded in the entity's books and records.
-
Presentation and Disclosure—Items in the statements are properly described, sorted, and classified.
For example, management specifies sub-objectives for sales transactions that address relevant financial statement assertions such as:
-
All sales transactions that occur are recorded on a timely basis.
-
Sales transactions are recorded at correct amounts in the right accounts.
-
Sales transactions are accurately and completely summarized in the entity's books and records.
-
Presentation and disclosures relating to sales are properly described, sorted, and classified.
Management specifies suitable objectives and sub-objectives with sufficient clarity to be able to identify and analyze risks to the achievement of those objectives. Financial statements for external purposes are not considered reliable or fairly presented if material omissions or misstatements exist in one or more of the amounts or disclosures. In preparing financial statements, management should identify those risks that could, individually or in combination, result in a material omission within or misstatement of the financial statements.
Management's assessment of such risks involves a dynamic and iterative process. The initial assessment undertaken by management likely requires a comprehensive effort to identify and analyze the risk of not preventing or detecting, in a timely manner, a material omission within or misstatement of the entity's financial statements. The nature and frequency of performing ongoing and periodic risk assessments vary among entities, based on individual facts and circumstances.
Even though every entity requires a process to identify and assess the external and internal factors that contribute to the risk of achieving its objectives, specific changes and rates of changes in these factors (including those that could significantly impact internal control over external financial reporting) vary from entity to entity. For example, different entities and subunits may:
-
Operate in many industries, markets, geographic territories
-
Operate in multiple regulatory environments that promulgate different laws, rules, regulations, and standards
-
Execute a multitude of contracts with customers, vendors, and others transacting business with the entity
-
Acquire, divest, and restructure operations
-
Deploy new and evolving technologies and information systems
-
Experience turnover of management and other personnel involved in the system of internal control
Additionally, the size and complexity of the entity play a part in determining the nature and frequency of the risk assessment process. Large, complex organizations may require dedicated cross-functional and cross-territorial management and other personnel with necessary expertise to perform comprehensive risk assessments. Management of smaller entities may be able to perform its risk assessment through direct supervision and day-to-day involvement in operations.
Fraudulent reporting can occur when an entity's reports are wilfully prepared with material omissions of misstatements. This may occur by the use of unauthorized receipts or expenditures, financial misconduct, or other disclosure irregularities. A system of internal control over external financial reporting is designed and implemented to prevent or detect, in a timely manner, any material omissions within or misstatements of the financial statements due to error or fraud.
When assessing risks to the achievement of external financial reporting objectives, organizations typically consider the potential for fraud in the following areas:
-
Fraudulent External Financial Reporting—An intentional act designed to deceive users of external financial reports and that results in a material omission within or misstatement of the external financial reports
-
Misappropriation of Assets—Theft of the entity's assets where the effect may cause a material omission within and misstatement of the external financial reports
As part of the risk assessment process, the organization identifies the various ways that fraudulent financial reporting can occur, considering:
-
Management bias in exercising judgment, for instance in selecting and using applicable accounting principles and developing significant estimates
-
Degree of estimates and judgments underlying the accounting for and disclosure of transactions and events
-
Fraud schemes and scenarios common to the industry sectors and markets in which the entity operates
-
Geographic regions where the entity does business
-
Incentives that may motivate fraudulent behavior
-
Attitudes and rationalizations by individuals engaging in or justifying inappropriate actions
-
Nature of technology and management's ability to manipulate technology and information
-
Unusual or complex transactions subject to significant management influence
-
Vulnerability to management override and potential schemes to circumvent controls
Also, as part of the risk assessment process, the organization identifies risks pertaining to the completeness and accuracy of recording any material misappropriation of assets. Misstatements may arise from failing to record the material loss of assets or manipulating the financial statements to conceal such a loss.
"Management override" refers to actions taken by management in an attempt to override the entity's controls for an illegitimate purpose such as personal gain or to enhance the presentation or disclosure of the entity's financial condition or results of operation. As part of its assessment of fraud risk, management considers the risk of management override of internal control. The board of directors or subset of the board (e.g., audit committee) oversees this assessment and challenges management when warranted. The entity's control environment can significantly influence the risk of management override. The risk of management override is especially relevant for smaller entities where senior management is typically selecting, developing, and deploying controls to effect principles.
Management override should not be confused with management intervention, which represents action that departs from controls designed for legitimate purposes. At times, management intervention is necessary to deal with non-recurring and non-standard transactions or events that otherwise might be handled inappropriately. Providing for management intervention is necessary because controls cannot be designed to anticipate and mitigate every risk. Management's actions to intervene are generally overt and subject to policies and procedures or otherwise disclosed to appropriate personnel.
Illegal acts are violations of laws or governmental regulations that could have a material direct or indirect impact on the external financial report. Management considers various indicators to help identify risks relating to potential illegal acts, such as:
-
Results of investigations by a governmental agency, an enforcement proceeding, or the payment of unusual fines or penalties
-
Violations of laws or regulations cited in reports of examinations by regulatory agencies
-
Large payments for unspecified services to consultants, affiliates, or employees
-
Sales commissions or agents’ fees that appear excessive in relation to those normally paid or the services actually received
-
Unusually large payments in cash, purchases of bank cashiers’ checks in large amounts payable to bearer, transfers to numbered bank accounts, or similar transactions
-
Unexplained payments made to government officials, employees, or third parties
-
Failure to file tax returns or pay government duties or similar fees
-
Allegations by whistle-blowers or former employees
Management also considers possible corruption occurring within the entity. Corruption is generally relevant to the compliance category of objectives but could influence the control environment that affects achievement of the entity's external financial reporting objectives. This includes considering the incentives and pressures across the organization to achieve the entity's external financial reporting objectives while demonstrating adherence to the expected standards of conduct and the effect of the control environment, specifically actions linked to Principle 4 (Demonstrates Commitment to Competence) and Principle 5 (Enforces Accountability). Aspects of corruption typically relate to illegal acts that are considered in government statutes relevant to external financial reporting.
In assessing possible corruption, the entity is not expected to directly manage the actions of personnel within external parties, including those relating to outsourced service providers and other parties interacting with the entity. However, depending on the level of risk assessed, management may stipulate the expected level of performance and standards of conduct through contractual relations, and develop controls that maintain oversight of third-party actions. Where necessary, management responds to detected unusual actions of others.
When preparing financial statements for external purposes management exercises judgment in complying with external financial reporting requirements. Management considers how risks of material omission and misstatement should be managed across the entity. Management selects, develops, and deploys controls to effect principles within each component to respond to assessed risks. Accordingly, management judgment is necessary in developing appropriate responses to risks of material omissions or misstatements, considering:
-
Laws, rules, regulations, and standards that apply to the entity
-
Nature of the entity's business and the markets in which it operates
-
Scope and nature of the management operating model
-
Competency of the personnel responsible for internal control over external financial reporting
-
Use of and dependence on technology
Management's alternatives to respond to risks relating to external financial reporting objectives may be limited compared with some other categories of objectives. That is, management is less likely to accept a risk than to reduce the risk when considering the preparation of financial statements for external purposes. For instance, management may decide to outsource transaction processing to a third party that is better suited to perform the business process. However, management always retains responsibility for designing, implementing, and conducting its system of internal control even when outsourcing to a third party. For external financial reporting objectives, risk acceptance should occur only when identified risks could not, individually or in aggregate, exceed the risk threshold and result in a material omission or misstatement.
Management exercises judgment when selecting, developing, and deploying controls to mitigate risks. Accordingly, management's responses and actions depend on its assessed risks of material omission and misstatement, perceptions of benefits and costs of effective controls, and other facts and circumstances unique to the entity (e.g., management operating model, use of technology, competency of management and other personnel).
Further, management may enhance the efficiency in the design, implementation, and conduct of a system of internal control over external financial reporting by, for instance, acknowledging the following;
-
Understanding the importance of specifying suitable objectives may focus management's attention on those risks and controls that are most important to achieving these objectives.
-
Focusing on those areas of risk that exceed acceptance levels and need to be managed across the entity may reduce efforts spent mitigating risks in areas of lesser significance.
-
Coordinating efforts for managing risks across multiple objectives may reduce the number of discrete, layered-on controls.
-
Selecting, developing, and deploying controls to effect multiple principles may reduce the number of discrete, layered-on controls.
-
Applying a common language—the Framework—encompassing operations, reporting, and compliance processes and controls may lessen the number of languages used to describe internal control across the entity.
The principles underlying the components of internal control apply to entities of all types and sizes. However, smaller entities may apply these principles using different approaches. For example, all public companies have boards of directors or other similar governing bodies with oversight responsibilities relating to the entity's external financial reporting. A smaller entity may have a less complex business model, organizational and legal structure, and operations, and more frequent communication with directors, enabling greater reliance on board oversight for achieving effective internal control.
The approaches contained within the Compendium are designed to be universal in nature and apply to any entity type or size. The examples, however, derived from actual situations, may include specific facts and circumstances that relate more to a larger entity. In most cases though, the examples translate well to applications for both smaller and larger entities.
Two levels of documentation should be considered in relation to financial statements for external purposes:
-
In cases where management asserts to regulators, shareholders, or other third parties on the design and operating effectiveness of its system of internal control, management has a higher degree of responsibility. Typically this will require documentation to support the assertion that all components of internal control are present and functioning. The nature and extent of the documentation may be influenced by the entity's regulatory requirements. This does not necessarily mean that all documentation will or should be more formal, but that sufficient evidence that the components and relevant principles are present and functioning and components are operating together is available and suitable to satisfy the entity's objectives.
-
In cases where an external auditor attests to the effectiveness of the system of internal control, management will likely be expected to provide the auditor with support for its assertion on the effectiveness of internal control. That support would include evidence that the system of internal control is effective, as defined in the Framework or as established by regulators, standard-setting bodies, or other third parties. In considering the nature and extent of documentation needed, management should also remember that the documentation to support the assertion will likely be used by the external auditor as part of his or her audit evidence, including the sufficiency of such documentation for those assertions. Management may also document significant judgments, how such decisions were considered, and the final decisions reached.
fn 2 Applicable accounting standards, rules, and regulations may include accounting principles generally accepted in the US (US GAAP), International Financial Reporting Standards (IFRS), Securities and Exchange Commission rules for disclosure, and others.
fn 3 For the purposes of the Compendium, approaches and examples use the term "material weakness" as defined by the Securities Exchange Commission in the United States in the Securities Exchange Act of 1934 Rule 12b-2 [17 CFR 240.12b-2]. "Material weakness" means a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis.
fn 4 The United States Securities and Exchange Commission (SEC) "Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934" states that "Management is responsible for maintaining a system of internal control over financial reporting (‘ICFR’) that provides reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles."
fn 5 For example, the SEC issued Topic 1M of the Staff Accounting Bulletins to provide guidance on assessing materiality and immaterial misstatements that are intentional. The International Accounting Standards Board provides a definition of materiality in paragraph QC11 of the "Conceptual framework for financial reporting 2010."
fn 6 These financial statement assertions are substantially consistent with those described in the standards of the American Institute of Certified Public Accountants, the Public Company Accounting Oversight Board, and the International Auditing and Assurance Standards Board.
| Prev | Up | Next |
| Home | ||
| | ||
| |
Copyright © 2013 – 2016 Committee of Sponsoring Organizations of the Treadway Commission and the American Accounting Association. All Rights Reserved. Use of materials is subject to COSO's Policy of Acceptable Use.
To access this page, please login with your COSO credentials using the button below:
Login to COSOPlease enter your COSO login credentials below
Please contact marybeth.gripshover@aaahq.org with any questions