Question

Using Principle 11 in COSO, discuss at least 8 controls with technological significance that can assist as internal controls in an Accounting Information Systems.

Hint : Describe the principle and its associated focus points, then discuss appropriate governance such as procedures, IT governance, infrastructure, IT general controls and so forth with elaborations and examples.

Answer 1

Internal Control over Financial Reporting are the controls specifically designed to address the risks of intentional or unintentional misstatements in the financial statements, lack of segregation of duties, lack of transparency, ineffective board oversights etc., These risks are ever increasing due to rapid globalization and complex business activities.

The full form of COSO is “The Committee of Sponsoring Organizations of the Treadway Commission”

As per COSO, 17 internal control principles are stated and associated with the five core components of internal control.

Of this let us see atleast 8 controls that are associated with technological significance in accounting information systems;

Control Environment:

1. The board of directors is independent of the management and exercises control over the development and performance of internal control.

• The board should not be passive but take cognizance of the internal control system and understands the operation effectiveness.
• Board should have final approval authority in the selection and implementation of the controls.

2. Management establishes the structure, composition of reporting lines, with the oversight of the board.

• Management may design the structure of the control system as approved by the Board, with clear establishment of reporting hierarchy.

3. The organization specifies objectives with clarity so that it is understood by the individuals across the entity without any ambiguity.

4. The activities in furtherance of the objectives are selected by the organization in such a way that it mitigates risk in the achievement of the objectives.

• While choosing the activities, care should be taken that in the normal course of the activities, the implemented controls identifies errors and eliminates the scope for potential frauds.
• Technology plays crucial role in achieving this principle, as the system designed should augment the control effectiveness.

5. The entity prefers to develop and implement general controls over technology to support the objectives.

• In addition to technical controls, it is desirable that a parallelly operating general controls is necessary.
• This is necessary in some extreme events or collusion, system controls may prove to be ineffective and can be manipulated to give misleading results.

6. Relevant, Quality & sufficient is generated and used in order to achieve the effective functioning of internal control.

• Necessary MIS systems should be designed and regular reports should be analyzed to ensure that systems are operating as intended.

7. The organization develops necessary evaluation systems to ascertain the functioning of the internal control.

• This is self explanatory, as for any system to operate effectively, there needs to be an evaluation mechanism, whereby the operation is reviewed and ensure that it is functioning as intended and deficiencies are high lighted and rectified.

8. Internal control deficiencies are communicated in a timely manner to parties that are responsible for taking corrective actions, including the management and the board of directors.

• it is very important that control deficiencies are brought to the notice of the concerned stakeholders who are entrusted with the responsibility of taking corrective actions. Also such deficiences should be informed to the management and the Board.