Review of Control
Environment
ACCT 1163
OPERATIONS AUDITING
Committee of the Sponsoring Organizations (COSO)
in their publication
Internal Control—Integrated Framework
The control environment sets the tone of an organisation influencing
the control consciousness of its people. It is the foundation for all
other components of internal control, providing discipline and
structure. Control environment factors include the integrity, ethical
values and competence of the entity’s people; management’s
philosophy and operating style; the way management assigns authority
and responsibility, and organises and develops its people; and the
attention and direction provided by the board of directors.)
CONTROL OBJECTIVES FOR A
REVIEW OF THE CONTROL
ENVIRONMENT
1. To ensure that management conveys the message that integrity, ethical values
and commitment to competence cannot be compromised, and that employees
receive and understand that message.
2. To ensure that management continually demonstrates, by word and action,
commitment to high ethical and competence standards.
RISK AND CONTROL ISSUES FOR A REVIEW
OF THE CONTROL ENVIRONMENT
Key Issues
1.1 Are there in place satisfactory Codes of Conduct and other policies which
define acceptable business practice, conflicts of interest and expected standards of
integrity and ethical behaviour?
1.2 Do management (from the top of the business downwards to all levels)
clearly conduct business on a high ethical plane, and are departures appropriately
remedied?
1.3 Is the philosophy and operating style of management consistent with the highest
ethical standards?
1.4 Do the human resource policies of the business adequately reinforce its commitment to
high standards of business integrity, ethics and competence?
1.5 Has the level of competence needed been specified for particular jobs,
and does evidence exist to indicate that employees have the requisite
knowledge and skills?
1.6 Are the board and its committees sufficiently informed and independent of
management such that necessary, even if difficult and probing, questions can
be explored effectively?
1.7 Is the organisation structure such that (a) all fully understand their responsibilities and
authorities, and (b) the enterprise’s activities can be adequately monitored?
2 Detailed Issues
2.1 Are Codes of Conduct comprehensive, addressing conflicts of interest, illegal or other
improper payments, anti-competitive guidelines and insider trading?
2.2 Are Codes of Conduct understood by and periodically subscribed to by all employees?
2.3 Do senior managers frequently visit outlying locations for which they
are responsible?
2.4 Is it the impression that employees feel peer pressure “to do the right thing”?
2.5 Is there sufficient evidence that management moves carefully in assessing potential
benefits of ventures?
2.6 Does management adequately deal with signs that problems exist (e.g.
hazardous by-products) even when the cost of identification and remedy could be high?
2.7 Are sufficient efforts made to deal honestly and fairly with business partners
(e.g. employees, suppliers, etc.)?
2.8 Is disciplinary action sufficiently taken and communicated in the case of violations?
2.9 Is management override of controls appropriate when it occurs, and sufficiently
authorised, documented and explained?
2.10 Are there job descriptions (which adequately define key managers’ responsibilities)
and performance appraisals with follow-up action to remedy deficiencies?
2.11 Is management and staff turnover reasonable, i.e. not excessive?
2.12 Are staffing levels adequate but not excessive?
2.13 Do staff recruitment procedures sufficiently enhance the enterprise’s commitment to
high standards of integrity, ethics and competence?
2.14 Do training programmes sufficiently enhance the enterprise’s commitment to
high standards of integrity, ethics and competence?
2.15 Do sufficient lines of communication exist to obviate the temptation of
“whistleblowing”?
FRAUD
Fraud is an intentional, deceitful act for gain with concealment.
it is more than theft
We may classify fraud as:
• management fraud, for instance fraudulent financial reporting
• employee fraud
• outsider fraud
• collusive fraud.
Pressure-Opportunity-Justification/Rationalization
Thank
you!!!
