Helen Valentine
ACCT 3222 Sec. 01
October 18, 2011

The COSO Framework
Due to questionable corporate political campaign finance practices and foreign corrupt practices in the mid -1970s, the U.S. Securities and Exchange Commission (SEC) and the U.S. Congress enacted campaign finance law reforms and the 1977 Foreign Corrupt Practices Act (FCPA) which criminalized transnational bribery and required companies to implement internal control programs. In response, the Treadway Commission, a private-sector initiative, was formed in 1985 to inspect, analyze, and make recommendations on fraudulent corporate financial reporting. The Treadway Commission studied the financial information reporting system over the period from October 1985 to September 1987 and issued a report of findings and recommendations in October 1987, Report of the National Commission on Fraudulent Financial Reporting. As a result of this initial report, the Committee of Sponsoring Organizations (COSO) was formed and it retained Coopers & Lybrand, a major CPA firm, to study the issues and author a report regarding an integrated framework of internal control. In September 1992, the four volume report entitled Internal Control— Integrated Framework was released by COSO and later re-published with minor amendments in 1994. This report presented a common definition of internal control and provided a framework against which internal control systems may be assessed and improved. This report is one standard that U.S. companies use to evaluate their compliance with FCPA.
COSO was formed in 1985 to sponsor the National Commission on Fraudulent Financial Reporting (the Treadway Commission). The Treadway Commission was originally jointly sponsored and funded by five main professional accounting associations and institutes headquartered in the United States: the American Institute of Certified Public Accountants (AICPA), American Accounting Association (AAA), Financial Executives International (FEI), Institute of Internal Auditors (IIA) and the Institute of Management Accountants (IMA). The Treadway Commission recommended that the organizations sponsoring the Commission work together to develop integrated guidance on internal control. These five organizations formed what is now called the Committee of Sponsoring Organizations of the Treadway Commission.
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a voluntary private-sector organization, established in the United States, dedicated to providing guidance to executive management and governance entities on critical aspects of organizational governance, business ethics, internal control, enterprise risk management, fraud, and financial reporting. COSO has established a common internal control model against which companies and organizations may assess their control systems. It outlines important internal control concepts.
One concept is internal control is a process. It is a means to an end, not an end in itself. Another concept is internal control is affected by people. It is not merely policy, manuals, and forms, but people at every level of an organization. Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board is another concept. The last concept is internal control is geared to the achievement of objectives in one or more separate but overlapping categories.
The COSO framework defines internal control as a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in several categories. The categories are effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations. The COSO internal control framework consists of five interrelated components derived from the way management runs a business. According to COSO, these components provide an effective framework for describing and analyzing the internal control system implemented in an organization as required by financial regulations. The five components are control environment, risk assessment, control activities, information and communication, and monitoring.
The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, management's operating style, delegation of authority systems, as well as the processes for managing and developing people in the organization. Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives and thus risk assessment is the identification and analysis of relevant risks to the achievement of assigned objectives. Risk assessment is a prerequisite for determining how the risks should be managed. Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address the risks that may hinder the achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties. Information systems play a key role in internal control systems as they produce reports, including operational, financial and compliance-related information, that make it possible to run and control the business. In a broader sense, effective communication must ensure information flows down, across and up the organization. For example, formalized procedures exist for people to report suspected fraud. Effective communication should also be ensured with external parties, such as customers, suppliers, regulators and shareholders about related policy positions. Internal control systems need to be monitored—a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities or separate evaluations. Internal control deficiencies detected through these monitoring activities should be reported upstream and corrective actions should be taken to ensure continuous improvement of the system.
In 2001, COSO initiated a project, and engaged PricewaterhouseCoopers, to develop a framework that would be readily usable by managements to evaluate and improve their organizations’ enterprise risk management. High-profile business scandals and failures such as Enron, Tyco International, Adelphia, Peregrine Systems and WorldCom led to calls for enhanced corporate governance and risk management. As a result the Sarbanes-Oxley act was enacted. This law extends the long-standing requirement for public companies to maintain systems of internal control, requiring management to certify and the independent auditor to attest to the effectiveness of those systems. The Internal Control – Integrated Framework continues to serve as the broadly accepted standard for satisfying those reporting requirements. However, in 2004 COSO published Enterprise Risk Management - Integrated Framework. COSO believes this framework expands on internal control, providing a more robust and extensive focus on the broader subject of enterprise risk management.
The Enterprise Risk Management - Integrated Framework is still geared to achieving an entity’s objectives. However, it now includes four categories. One category is strategic – high level goals, aligned with and supporting its mission. Operations – effective and efficient use of its resources is another category. Another category is reporting – reliability of reporting. The last category is compliance – compliance with applicable laws and regulations.
The eight components of enterprise risk management encompass the previous five components of the Internal Control-Integrated Framework while expanding the model to meet the growing demand for risk management. The eight components are internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring.
The internal environment encompasses the tone of an organization, and sets the basis for how risk is viewed and addressed by an entity’s people, including risk management philosophy and risk appetite, integrity and ethical values, and the environment in which they operate. Objectives must exist before management can identify potential events affecting their achievement. Enterprise risk management ensures that management has in place a process to set objectives and that the chosen objectives support and align with the entity’s mission and are consistent with its risk appetite. Internal and external events affecting achievement of an entity’s objectives must be identified, distinguishing between risks and opportunities. Opportunities are channeled back to management’s strategy or objective-setting processes. Risks are analyzed, considering likelihood and impact, as a basis for determining how they should be managed. Risks are assessed on an inherent and a residual basis. Management selects risk responses – avoiding, accepting, reducing, or sharing risk – developing a set of actions to align risks with the entity’s risk tolerances and risk appetite. Policies and procedures are established and implemented to help ensure the risk responses are effectively carried out. Relevant information is identified, captured, and communicated in a form and time frame that enable people to carry out their responsibilities. Effective communication also occurs in a broader sense, flowing down, across, and up the entity. The entirety of enterprise risk management is monitored and modifications made as necessary. Monitoring is accomplished through ongoing management activities, separate evaluations, or both.
COSO admits in their report that while enterprise risk management provides important benefits, limitations exist. Enterprise risk management is dependent on human judgment and therefore susceptible to decision making. Human failures such as simple errors or mistakes can lead to inadequate responses to risk. In addition, controls can be circumvented by collusion of two or more people, and management has the ability to override enterprise risk management decisions. These limitations preclude a board and management from having absolute assurance as to achievement of the entity’s objectives. Although COSO claims their expanded model provides more risk management, companies are not required to switch to the new model if they are using the Internal Control-Integrated Framework. COSO believes the Enterprise Risk Management – Integrated Framework provides a clearly defined interrelationship between an organization's risk management components and objectives that will fill the need to meet new law, regulation, and listing standards and expects it will become widely accepted by companies and other organizations and interested parties.

BIBLIOGRAPY

"Control Framework." coso.org. N.p., n.d. Web. 31 May 2011. <http://compliance.tamu.edu/documents/ControlFramework.pdf>.
"Internal Control Systems."Encyclopedia of Business and Finance.Ed. Allison McClintic Marion. Gale Cengage, 2001. eNotes.com. 2006. 31 May, 2011 <http://www.enotes.com/business-finance-encyclopedia/internal-control-systems>