Ey Are Your Internal Controls in Harmony With Your Business Unlocked

Are your internal
controls in
harmony with
your business?
H ow t h e t h r e e line s of d e f e nse ca n w or k in
conce r t t o h e lp y our or g a niz a t ion im p r ov e it s
p e r f or m a nce
Introduction
Who is in
Contents
Today, change is coming faster than ever, and there’s
more of it. Industries have been completely disrupted
through digitalization and outsourcing. The sheer velocity
of change has upended the business environment, and
Introduction 2—7
business models are constantly having to respond at an
Maturity model 8 unprecedented pace. In fact, five years ago, we were talking
control?
about the fast pace of change, but that pace and the amount
Enhancement opportunities 9—29 of change have only increased, with no slowdown in sight.
Conclusion 30 The pace of change has also affected organizations’ internal

controls. Risk events such as cybersecurity breaches, fraud
and Foreign Corrupt Practices Act (FCPA) violations seem
more frequent and more public than ever because the
internet and social media require an organization to respond
quickly to protect its reputation. We have seen regulatory
activities increase over the last several years in response
to the events in the marketplace. Additionally, there are
internal control matters that, while not publicly discussed,
may require significant time and investment to remediate.
So why then have many internal control programs not kept

up with the times? Many companies have not materially
modified the way they manage their system of internal
controls since the inception of their internal control
over financial reporting (ICFR) programs as part of their
Sarbanes-Oxley Act (SOX) implementation. A review of
an organization’s internal control program may not only
identify areas requiring control enhancements in response
to changes in the business and regulatory environment,
but also suggest ways to improve the efficiency of the
ICFR program.
Organizations have an opportunity to clarify or reinforce

the roles and responsibilities for their internal control
environment, stressing that management has responsibility
for internal controls. They may also be able to increase
collaboration among the business, IT, internal audit (IA) and
compliance functions; enhance communication with external
auditors; and improve the effectiveness and efficiency of
their internal controls.
Introduction Maturity model Enhancement Conclusion

2 opportunities 3
I nt r od uct ion
Controls need to Rapidly changing business landscape

Cor p or a t e f a ilur e s in t h e e a r ly 2 0 0 0 s b r oug h t incr e a se d
H ow h a v e ch a ng e s t o t h e b usine ss a f f e ct e d
respond to the r e g ula t or y ov e r sig h t a nd t h e ne e d f or com p a nie s t o a d op t
a more compliance-focused mindset. During the financial
cont r ols ov e r t im e ?
challenges of ever-
cr isis, t h e f ocus on sur v iv a l w a s p a r a m ount : k e e p us out
of t r oub le a nd st r e a m line int e r na l cont r ols. F or t h e ne x t
se v e r a l y e a r s, le a d ing p e r f or m e r s f ocuse d on m a r k e t r e a ch ,
2005—07 2008—10 2011—13 2014—beyond
changing business op e r a t iona l a g ilit y , cost com p e t it iv e ne ss, st a k e h old e r

confidence, risk management and internal controls. And as
B usine ss p e r f or m a nce
g e ne r a lly im p r ov e d
H ig h r isk
m a na g e m e nt
sp e nd ing d id
L e a d ing p e r f or m e r s f ocuse d
on m a r k e t r e a ch , op e r a t iona l
a g ilit y , cost com p e t it iv e ne ss,
R a p id p a ce of
ch a ng e a nd b usine ss
d isr up t ion
and regulatory
t h e m a r k e t w a s r e cov e r ing , som e com p a nie s m a d e p r og r e ss
not p r e v e nt a and stakeholder confidence
t ow a r d b e t t e r a lig nm e nt of r isk m a na g e m e nt w it h ch a ng e s d ow nt ur n a nd m a na g e m e nt
in b usine ss m od e ls a nd e m e r g ing r isk s.
landscapes. D e sp it e a ll t h e se e f f or t s, m a ny com p a nie s, a s p a r t of t h e ir

com p lia nce w it h S O X r e q uir e m e nt s, h a v e cont inue d t o
Comply, invest
and grow
Survive and
refocus
Transform and
thrive
Rethink and
enhance
identify significant deficiencies and material weaknesses in
• P► ost early 2000s high • Global financial crisis • M ► arket recovery and new • C ► ontinued market recovery
int e r na l cont r ols. profile business failures d r ov e cost r e d uct ions a nd e m e r g ing m a r k e t s a nd st a b iliz a t ion
r e q uir e d f ocus on st a y ing ch a ng e s t o b usine ss m od e l • E ► xpansion and growth • Implementation of the ►
out of t r oub le • V ► alue of control effort and w it h lim it e d ca p it a l 2 0 1 3 CO S O f r a m e w or k
• Cont inue d a t t e nt ion sp e nd ing ch a lle ng e d r e f r e sh ind ica t e s t r e nd t o
COSO update t o S O X r e g ula t ion on • A ► lignment of risk r e t h ink int e r na l cont r ols
• S ► hift from financial to m a na g e m e nt w it h
I n 2 0 1 3 , t h e Com m it t e e of S p onsor ing O r g a niz a t ions of t h e int e r na l cont r ol ov e r f ocus
st r a t e g ic a nd op e r a t iona l ch a ng e s in t h e b usine ss
financial reporting
T r e a d w a y Com m ission ( CO S O ) r e le a se d a n up d a t e d v e r sion r isk m a na g e m e nt m od e l a nd e m e r g ing • C ► ompliance with new
r e q uir e d r isk s r e g ula t or y r e q uir e m e nt s
of it s I nt e r na l Cont r ol — I nt e g r a t e d F r a m e w or k in r e sp onse t o
t h e ch a ng e s t o com p a nie s’ b usine ss m od e ls a nd incr e a se d
e x p e ct a t ions b y r e g ula t or s a nd ot h e r st a k e h old e r s r e g a r d ing
g ov e r na nce , r isk m a na g e m e nt a nd f r a ud p r e v e nt ion.
CO S O ’ s e nh a nce m e nt s in t h e 2 0 1 3 f r a m e w or k w e r e Regulatory response Looking forward
int e nd e d t o: A s a r e sult of t h e ch a ng e s t o t h e b usine ss e nv ir onm e nt In light of the PCAOB’s inspection findings, organizations
• Address significant changes in the business environment ov e r t h e la st se v e r a l y e a r s, r e g ula t or y a ct iv it y h a s p ut sh ould consid e r t h e ne e d t o m or e f ully im p le m e nt t h e 2 0 1 3
a nd a ssocia t e d r isk s m or e p r e ssur e on or g a niz a t ions t o m a int a in st r ong int e r na l CO S O f r a m e w or k . A d d it iona lly , r e g ula t or y d e v e lop m e nt s
cont r ols. F or e x a m p le , in 2 0 0 7 , t h e P ub lic Com p a ny cont inue on a g lob a l sca le , e . g . , t h e I nd ia Com p a nie s A ct ,
• S p e cif y cr it e r ia t o use in t h e d e v e lop m e nt a nd a sse ssm e nt A ccount ing O v e r sig h t B oa r d ( P CA O B ) r e le a se d A ud it ing cr e a t ing a n e v e n g r e a t e r ne e d t o t a k e a h olist ic look a t
of int e r na l cont r ols S t a nd a r d N o. 5 , “ A n A ud it of I nt e r na l Cont r ol ov e r F ina ncia l int e r na l cont r ols. Com p a nie s sh ould d e t e r m ine w h e t h e r
• I ncr e a se t h e f ocus on op e r a t ions, com p lia nce a nd R e p or t ing ” ( A S 5 ) , w h ich sup e r se d e d A ud it ing S t a nd a r d N o. t h e ir int e r na l cont r ols a r e k e e p ing p a ce w it h ch a ng e s in t h e
nonfinancial reporting objectives 2 . I t up d a t e d t h e r e q uir e m e nt s f or p e r f or m ing a nd r e p or t ing r e g ula t or y e nv ir onm e nt in t h e count r ie s w h e r e t h e y op e r a t e .
on a ud it s of int e r na l cont r ol a s r e q uir e d b y S O X . A lt h oug h A s t h e p a ce of ch a ng e is e x p e ct e d t o a cce le r a t e in t h e ne x t
t h e P CA O B ’ s st a nd a r d s a r e d ir e ct e d a t e x t e r na l a ud it or s, se v e r a l y e a r s, now is t h e t im e t o r e t h ink a nd e nh a nce t h e ir
W h ile m a ny com p a nie s w or k e d t o a d op t t h e ne w f r a m e w or k , com p a nie s a r e a f f e ct e d a s t h e e x t e r na l a ud it or s com p le t e int e r na l cont r ols. T h is is a g ood op p or t unit y f or or g a niz a t ions
t h e y m a y h a v e m isse d a n op p or t unit y b e ca use , in som e t h e ir int e r na l cont r ol e v a lua t ions in a ccor d a nce w it h t h e t o t h ink a b out t h e ir int e r na l cont r ol p r og r a m a nd w a y s t o
ca se s, it w a s t r e a t e d a sa m a p p ing or d ocum e nt a t ion st a nd a r d s. op t im iz e t h e ir I CF R p r og r a m . I n sh or t , t h is sh ould b e t h oug h t
e x e r cise inst e a d of a w a y t or e f r e sh a nd op t im iz e t h e ir of a s a v a lue - a d d e d t a sk , not sim p ly a com p lia nce e x e r cise .
int e r na l cont r ols.
W h e n A S 5 w a s a d op t e d , t h e P CA O B a nnounce d it s int e nt ion
t o m onit or t h e im p le m e nt a t ion a s p a r t of it s ong oing
oversight activities. As a result of the findings noted during
it s insp e ct ions, t h e P CA O B r e le a se d S t a f f A ud it P r a ct ice A le r t
N o. 1 1 , “ Consid e r a t ions f or A ud it s of I nt e r na l Cont r ol ov e r
F ina ncia l R e p or t ing , ” t o b r ing a d d it iona l f ocus t o t h e a r e a s of
conce r n.
I nt r od uct ion
Introduction Maturity
M a t ur it y mmodel
od e l E nh a nce m e nt
Enhancement Conclusion
4 op p or t unit ie s
opportunities 5
I nt r od uct ion
Does your Integrated risk and control model

M a na g e m e nt ow ns t h e p r oce sse s of id e nt if y ing , m a na g ing Three Lines of Defense model
organization have a nd m onit or ing ov e r a ll r isk s a nd
t h e t one a t t h e t op a nd f ost e r ing
S t ud ie s h a v e sh ow n t h a t st r ong
int e r na l cont r ols, se t t ing
a r isk - a w a r e cult ur e .
r isk m a na g e m e nt a nd
The three lines of defense need to be identified and
d e p loy e d a s p a r t of t h e or g a niz a t ion’ s ov e r a ll r isk a nd
2 Second line (management assurance)
an effective and
T h is g r oup ( t y p ica lly includ ing r isk m a na g e m e nt , int e r na l
sy st e m s of int e r na l cont r ol h a v e a p osit iv e im p a ct on long - int e r na l cont r ol st r a t e g y . H ow e v e r , no line of d e f e nse
cont r ols, le g a l, com p lia nce , e t c. ) is r e sp onsib le f or t h e
t e r m b usine ss p e r f or m a nce a nd e a r ning s p ot e nt ia l. e x e cut e s t h is st r a t e g y sing le - h a nd e d ly ; t h e y m ust w or k
ong oing m onit or ing of t h e d e sig n a nd op e r a t ion of cont r ols
together. In the context of an integrated LOD model, EY
efficient integrated Establishing a governance structure through the use of a

well-defined and coordinated integrated risk and control
defines the three lines of defense as follows:
implemented by the first line of defense, as well as advising
on a nd f a cilit a t ing r isk m a na g e m e nt a ct iv it ie s.
risk and control

m od e l is t h e cor ne r st one of a st r ong r isk m a na g e m e nt
and ICFR program. Organizations must define clear 1 First line (operations and business units) 3 Third line (independent assurance)
ow ne r sh ip a nd a ccount a b ilit y f or r isk m a na g e m e nt a nd T h is g r oup is com p ose d of t h e line m a na g e r s r e sp onsib le T h e g r oup s t h a t a r e r e sp onsib le f or ind e p e nd e nt a ssur a nce
model? int e r na l cont r ol a ct iv it ie s t o e na b le e f f e ct iv e coor d ina t ion,

com m unica t ion a nd r e p or t ing .
f or id e nt if y ing a nd m a na g ing r isk s d ir e ct ly ( d e sig n a nd
op e r a t ion of cont r ols) ; t h e y r e g a r d r isk m a na g e m e nt a s a
crucial element of their everyday jobs.
ov e r m a na g ing r isk s includ e int e r
a nd som e r e g ula t or s, a s long a s t
t h e ir w or k a lig n w it h t h e or g a niz a
na l a ud it , e x t e r na l a ud it
h e scop e a nd na t ur e of
t ion’ s r isk m a na g e m e nt
W h e n it com e s t o a n int e g r a t e d r isk a nd cont r ol m od e l,
one size does not fit all. Many factors come into play, objectives.
includ ing ind ust r y , siz e , loca t ion, r e g ula t or y r e q uir e m e nt s,
and risk culture. Even though each organization needs
t o d e sig n a nd im p le m e nt a n int e g r a t e d r isk a nd cont r ol
m od e l t h a t a lig ns w it h it s st r a t e g ie s a nd g ov e r na nce
st r uct ur e , som e e le m e nt s a r e com m on a m ong a ll
or g a niz a t ions. Integrated risk and control model
I n it s 2 0 1 3 p osit ion p a p e r , T h e I nst it ut e of I nt e r na l
A ud it or s ( I I A ) d iscusse d t h e T h r e e L ine s of D e f e nse ( L O D )
m od e l. T h is m od e l p r ov id e s a sim p le a nd e f f e ct iv e w a y
t o e nh a nce com m unica t ions on r isk m a na g e m e nt a nd
int e r na l cont r ols b y cla r if y ing r ole s a nd r e sp onsib ilit ie s.
B usine ss d r iv e r s
O ne of t h e ch a lle ng e s f a cing or g a niz a t ions is a nd init ia t iv e s R isk s L ine s of d e f e nse
im p le m e nt ing t h e r ig h t int e g r a t e d r isk a nd cont r ol
m od e l t o a d d r e ss g ov e r na nce , a s w e ll a s p r oce sse s t h a t S t r a t e g ic 1 2 3
e na b le m a na g e m e nt t o g a in com f or t w it h t h e d e sig n a nd B usine ss
op e r a t ing e f f e ct iv e ne ss of t h e ir int e r na l cont r ols. st r a t e g y First line Second line Third line Com b ine d
B oa r d of O p e r a t iona l r e p or t ing
I nt e r na l a ud it ca n p la y a k e y r ole b y p r ov id ing a ssur a nce d ir e ct or s a nd O p e r a t ions a nd M a na g e m e nt I nd e p e nd e nt
f or e a ch
e x e cut iv e b usine ss unit s a ssur a nce a ssur a nce
a r ound t h e p r og r a m a nd e it h e r v a lid a t ing or p e r f or m ing R isk F ina ncia l r isk
m a na g e m e nt ( d e sig n a nd ( ong oing cont r ol ( ov e r r isk
the internal control testing. IA’s independence, objectivity t ole r a nce op e r a t ion of m onit or ing ) m a na g e m e nt )
a nd int e r na l cont r ol k now le d g e ca n a llow m a na g e m e nt cont r ols)
Com p lia nce
a nd t h e e x t e r na l a ud it or s t o p la ce m or e r e lia nce on it s
work. Clearly defined roles and responsibilities that are I m p r ov e cont r ols a nd O p t im iz e r isk m a na g e m e nt
Enhance risk
r e g ula r ly up d a t e d r e g a r d le ss of or g a niz a t iona l st r uct ur e st r a t e g y p r oce ss f unct ions
enable a more efficient and effective ICFR program. Embed and enable risk management
Com m unica t e r isk cov e r a g e
L e a d ing - p r a ct ice a nd r isk a g e nd a com p one nt s
I nt r od uct ion
6 op p or t unit ie s
opportunities 7
M a t ur it y m od e l Enhancement opportunities
Has your ICFR program kept pace Key considerations to enhance your
with changes in the business and internal controls Welcome from EY
regulatory landscapes? At EY, we have helped organizations of different sizes and T h e sur v e y e ncom p a sse d 1 4 7 of our a ud it a nd a d v isor y
a cr oss se ct or s a s t h e y d e v e lop e d a nd im p le m e nt e d t h e ir clie nt s of v a r y ing siz e s a cr oss t h e U S , cov e r ing m a ny
init ia l I CF R p r og r a m s a nd h a v e cont inue d t o w or k w it h ind ust r y se ct or s.
m a ny of t h e m a s t h e y h a v e e v olv e d t h e ir p r og r a m s ov e r
34%
I n lig h t of t h e ch a ng ing b usine ss e nv ir onm e nt , r e g ula t or y
t im e . W e sur v e y e d our int e r na l a ud it p r of e ssiona ls t o g a t h e r
Even though we have been living with SOX O nly
of r e sp ond e nt s
inf or m a t ion a b out I CF R le a d ing p r a ct ice s a nd a r e a s of
findings and our work with clients, we have seen a number
of a r e a s e m e r g e a s le a d ing p r a ct ice s or op p or t unit ie s f or
requirements for over a decade, many companies have ind ica t e d t h e im p r ov e m e nt not e d a s t h e y w or k e d w it h our clie nt s. com p a nie s t o e nh a nce t h e ir int e r na l cont r ols.
int e r na l cont r ol
not matured or optimized their ICFR programs. p r og r a m w a s
m a t ur e * .
Enhancement The topics below are the most common enhancement opportunities we see at our clients. These
ICFR maturity assessment enabler opportunities: topics are discussed in the pages that follow, along with thoughts on the benefits of taking action.
L e a d ing or g a niz a t ions a r e using a m od e l t o a sse ss t h e m a t ur it y of t h e ir int e r na l cont r ol e nv ir onm e nt s.
ICFR maturity assessment: Governance Technology

Key areas:
Evaluates current maturity of the
1 . G ov e r na nce st r uct ur e 1 3 . S y st e m im p le m e nt a t ions
int e r na l cont r ol
D o w e h a v e t h e r ig h t ov e r sig h t ?
A ssist s m a na g e m e nt in d e t e r m ining 2 . I CF R p r og r a m 1 4 . O ut sour ce d sy st e m s a nd b usine ss
t h e f ut ur e st a t e Governance p r oce sse s
P r ov id e s im p le m e nt a t ion a ct ions D o w e h a v e t h e r ig h t r e sour ce s 3 . Ch a ng e s t o a ccount ing st a nd a r d s
t o r e a ch t h e d e sir e d f ut ur e r isk a nd t o d e liv e r a g a inst our 1 5 . S e r v ice O r g a niz a t ion Cont r ols
cont r ol e nv ir onm e nt m a t ur it y goals and objectives? 4. SOX Section 302 certifications ( S O C) r e p or t s
Resources
1 6 . Cont r ols in t h e cloud
D o our m e t h od s,
p r a ct ice s a nd t e ch nolog y Control evaluation 1 7 . S e g r e g a t ion of d ut ie s
sup p or t our b usine ss in t h e
Methods, practices and technology
m ost e f f e ct iv e w a y p ossib le ? 5 . S cop e a nd m ix of cont r ol t e st ing 1 8 . Cy b e r r isk
6 . M a na g e m e nt r e v ie w cont r ols
Sample of assessment factors: Maturity levels: Tools and techniques
Governance Level Definition 7 . I nf or m a t ion p r od uce d b y t h e e nt it y
• I nt e r na l cont r ol g ov e r na nce m od e l Very minimal or basic level in relation to the individual component of the
(IPE) 1 9 . D a t a a na ly t ics
1 Basic m a t ur it y m od e l. T h e r e is a cr it ica l ne e d f or e nh a nce m e nt s.
• Clear definition of the internal
cont r ols t im e line 8 . P op ula t ion com p le t e ne ss 2 0 . L e v e r a g ing t e ch nolog y a nd t ools
T h e com p one nt e x ist s in p a r t b ut is inconsist e nt ly a p p lie d or not w e ll-
2 Evolving und e r st ood b y m a na g e m e nt a nd r e le v a nt e m p loy e e s in a num b e r of
Resources business areas. There is a significant need for enhancement. 9 . Cont r ol p r e cision
• Clear definition of roles and
r e sp onsib ilit ie s
• O v e r sig h t of t h ir d - p a r t y p r ov id e r s
A ct iv it ie s a r e e st a b lish e d , b ut t h e r e is a ne e d f or e nh a nce m e nt t o b e com e
3 Established more effective and efficient. 1 0 . R e la t e d p a r t ie s
• I nd e p e nd e nt a ud it or r e lia nce on
m a na g e m e nt ’ s cont r ol t e st ing A ct iv it ie s a r e consist e nt ly a p p lie d a nd w e ll- und e r st ood b y m a na g e m e nt
11. Deficiency impact analysis
4 Advanced a nd r e le v a nt e m p loy e e s a cr oss t h e or g a niz a t ion. T h e r e is lim it e d ne e d f or
Methods, practices and technology e nh a nce m e nt t o int r od uce le a d ing p r a ct ice s in ce r t a in k e y a r e a s.
12. Remediation of deficiencies
• Cont r ol d e sig n a nd d ocum e nt a t ion
A ct iv it ie s a r e e st a b lish e d , consist e nt ly a p p lie d , int e g r a t e d , r e g ula r ly
• Reporting of financial and non- 5 Leading r e v ie w e d , a lig ne d a nd coor d ina t e d a cr oss t h e or g a niz a t ion. T h e p r a ct ice s
financial control effectiveness a r e r e sp e ct e d a s le a d ing p r a ct ice a nd a r e v ie w e d e x t e r na lly b y ot h e r
• T e ch nolog y e na b le m e nt or g a niz a t ions a s st r ong e x a m p le s.
I nt r od uct ion
8 *EY ICFR Leading Practice survey op p or t unit ie s
opportunities 9
1 2
G ov e r na nce st r uct ur e I CF R p r og r a m
Does your A sp
a nd
a rt
or g
of our sur v e y , w e a sk e d q ue st ions a b out r e p or t ing line s
a niz a t iona l st r uct ur e in a n e f f or t t o und e r st a nd t h e Do you regularly In 2004, many companies were issuing their first reports
on I CF R . H ow e v e r , cont r ols t h a t w e r e a p p r op r ia t e a t
cur r e nt t r e nd s. W e f ound t h a t no one m od e l e m e r g e d a s t h e t h e t im e of im p le m e nt a t ion m a y no long e r b e e f f e ct iv e
governance le a d ing or m ost com m on.
T h e or g a niz a t ion’ s m a na g e m e nt is r e sp onsib le f or e st a b lish ing
update your g iv e n t h e f a st p a ce of ch a ng e on t h e g lob a l st a g e . S ince
t h e n, sh if t s in t h e r e g ula t or y e nv ir onm e nt h a v e a f f e ct e d
structure maximize a g ov e r na nce st r uct ur e t h a t m a p s a nd a ssig ns ow ne r sh ip

a nd a ccount a b ilit y f or r isk r e sp onse a ct iv it ie s a cr oss t h e
ICFR program to com p a nie s b r oa d ly , a nd b usine ss m od e ls h a v e ch a ng e d
significantly with technology breakthroughs that have, in
som e inst a nce s, d isr up t e d t h e m a r k e t p la ce .
risk coverage and respond to changes
or g a niz a t ion. W h e t h e r y our or g a niz a t ion use s t h e L O D m od e l
or a m od e l b e t t e r suit e d t o y our or g a niz a t iona l st r uct ur e a nd L e a d ing - p r a ct ice or g a niz a t ions h a v e e st a b lish e d a
cult ur e , com m unica t ing t h e r ole of t h e v a r ious f unct ions, sust a ina b le p r oce ss t o p e r iod ica lly r e f r e sh t h e ir I CF R
resources? includ ing w h o h a s ow ne r sh ip of cont r ol t e st ing , is cr it ica l.
A t t h e e nd of t h e d a y , m a ny p e op le t h r oug h out t h e or g a niz a t ion
in the business p r og r a m t o r e sp ond t o ch a ng e s in t h e m a r k e t p la ce .
F or e x a m p le , CO S O ’ s 2 0 1 3 f r a m e w or k includ e s
and regulatory
a r e ne e d e d t o sust a in a st r ong int e r na l cont r ol e nv ir onm e nt , a nd enhancements intended to (1) address significant
it w or k s b e t t e r w h e n a ll p a r t ie s k now t h e ir r ole s. F or e x a m p le , ch a ng e s in t h e b usine ss e nv ir onm e nt a nd a ssocia t e d
30%
r isk s; ( 2 ) sp e cif y cr it e r ia t o use in t h e d e v e lop m e nt
requirements?
t h e r e sour ce s r e sp onsib le f or m a int a ining I CF R d ocum e nt a t ion
a nd t h ose r e sp onsib le f or t e st ing a nd m onit or ing cont r ol d if f e r a nd a sse ssm e nt of int e r na l cont r ols; a nd ( 3 ) incr e a se
of sur v e y r e sp ond e nt s ind ica t e d a cr oss or g a niz a t ions. T h e r e is no one cle a r a nsw e r , b ut w h a t is the focus on operations, compliance and nonfinancial
t h a t int e r na l cont r ol ow ne r clear is that companies need to have these roles defined so that reporting objectives. This is just one example of how our
clie nt s h a v e d one a m or e in- d e p t h r e f r e sh of t h e ir I CF R
87%
p e r f or m a nce r a t ing s a r e link e d t o t h ing s d on’ t f a ll t h r oug h t h e cr a ck s.
t h e e f f e ct iv e ne ss of t h e cont r ols p r og r a m a nd use d it a s a p la t f or m t o m a k e m or e h olist ic
ch a ng e s a nd im p r ov e m e nt s.
f or w h ich t h e y a r e r e sp onsib le
of sur v e y r e sp ond e nt s
ind ica t e d t h a t t h e I CF R
p r og r a m is a lig ne d w it h CO S O
2 0 1 3 .
57% W h ile it m ig h t se e m lik e a n unim p or t a nt t a sk a f t e r 1 0 y e a r s

of com p ly ing w it h S O X r e q uir e m e nt s, m a ny com p a nie s
of sur v e y r e sp ond e nt s ind ica t e d Questions to consider Benefits of taking action Timing
a r e t a k ing a st e p b a ck a nd d ocum e nt ing t h e ir I CF R
t h a t a f or m a l int e r na l cont r ol
p r og r a m ch a r t e r a nd r olling t h is out a s p a r t of t h e ir t r a ining • H a v e y ou a lig ne d y our int e r na l cont r ol f r a m e w or k w it h • Clarifies roles and • A t le a st a nnua lly
ov e r sig h t com m it t e e w a s in p la ce
p r og r a m s. W e se e t h is a s a le a d ing p r a ct ice . CO S O 2 0 1 3 ? r e sp onsib ilit ie s a cr oss t h e a nd m onit or e d
• Do you have a process to identify significant t h r e e line s of d e f e nse f or ch a ng e s on a
ch a ng e s in t h e b usine ss a nd r e g ula t or y e nv ir onm e nt • Ca n b e use d t o a lig n int e r na l r e g ula r b a sis
a nd a sse ss r e sult ing r isk s t o t h e or g a niz a t ion? control definitions and risk
Questions to consider Benefits of taking action • D o y ou p e r iod ica lly r e f r e sh t h e cr it e r ia use d t o d e v e lop a sse ssm e nt cr it e r ia
Timing
• D oe s y our or g a niz a t ion p e r iod ica lly r e a sse ss it s a nd a sse ss cont r ols? • Encourages involvement by
• M a y d r iv e b e t t e r v a lue w it h • A t le a st a nnua lly
int e r na l cont r ol g ov e r na nce m od e l? • H a v e y ou incr e a se d t h e f ocus on op e r a t ions, t h e C- suit e
t h e b usine ss b y a lig ning t h e
• D oe s y our or g a niz a t ion p e r f or m a cont r ols r isk s t h a t m a t t e r compliance and nonfinancial reporting objectives? • Enables alignment with the
op t im iz a t ion e x e r cise p e r iod ica lly ? or g a niz a t ion’ s st r a t e g ic
• M a y r e d uce t h e cost of
• I s a n a sse ssm e nt of r isk cov e r a g e p e r f or m e d ? objectives
cont r ols
• A r e cur r e nt sk ill se t s p e r iod ica lly r e a sse sse d t o • M a y r e sult in incr e a se d
determine whether they are sufficient to address SOX r e lia nce b y t h e e x t e r na l
r e q uir e m e nt s? a ud it or s
27%
• D o y ou a sse ss t h e a m ount of r e lia nce t h e e x t e r na l
a ud it or s p la ce on t h e com p a ny ’ s w or k a nd w h e t h e r
modifications could enhance such reliance?
of sur v e y r e sp ond e nt s
ind ica t e d t h a t t h e int e r na l
cont r ol f unct ion w a sv e r y
m a t ur e or le a d ing - p r a ct ice .
I nt r od uct ion
1 0 op p or t unit ie s
opportunities 1 1
3 4
Ch a ng e s t o a ccount ing st a nd a r d s SOX Section 302 certifications
Are changes A s t h e r a t e of ch a ng e w it h in t h e b usine ss a nd r e g ula t or y

la nd sca p e s cont inue s t o a cce le r a t e , st a y ing on t op Is your SOX F r om
im p le
w h a t w e h a v e se e n ov e r t h e la st se v e r a l y e a r s,
m e nt ing t h e r ig h t p r oce sse s t o e na b le e x e cut iv e
of a ccount ing ch a ng e s a nd h ow t h e y a p p ly t o a n le a d e r sh ip t o g a in com f or t w it h t h e d e sig n a nd
to accounting or g a niz a t ion’ s b usine ss m od e l w ill r e m a in a n ong oing
ch a lle ng e . M a ny com p a nie s t y p ica lly a ssig n r e sp onsib ilit y
Section 302 op e r a
of t h e
t ing e f f e ct iv e ne ss of t h e ir int e r na l cont r ols is one
ch a lle ng e s f a cing or g a niz a t ions a s t h e y a d d r e ss
standards identified f or t e ch nica l a ccount ing int e r p r e t a t ion t o t h e ir e x t e r na l

r e p or t ing f unct ion. R e sp onsib le p a r t ie s t h e n t y p ica lly certification process com p lia nce r e q uir e m e nt s.
You can take these steps to enhance your SOX Section
sub scr ib e t o m a iling list ( s) a nd m onit or w e b sit e up d a t e s
and implications to the f r om t h e F ina ncia l A ccount ing S t a nd a r d s B oa r d ( F A S B ) ,
I nt e r na t iona l A ccount ing S t a nd a r d s B oa r d ( I A S B ) a nd
conducted with the 302 certification process:
• Select a SOX Section 302 certification program leader
business addressed on Securities and Exchange Commission (SEC), in addition

t o w or k ing w it h t h e ir e x t e r na l a ud it or s. G iv e n t h e appropriate level of r e sp onsib le f or r e v ie w ing t h e list ing of 3 0 2 p a r t icip a nt s
a nd r e v ie w e r s, d ist r ib ut ing t h e q ua r t e r ly q ue st ionna ir e s,
f r e q ue ncy of “ up d a t e s, ” t h e incr e a sing com p le x it y a nd
a timely basis?
g a t h e r ing r e sp onse s f r om t h e f unct iona l le a d e r s a nd
diligence?
4 4
ch a ng e s t o or g a niz a t iona l b usine ss m od e ls, t h e r isk e x ist s communicating the results to the CEO and CFO
t h a t st a nd a r d s m a y b e m isint e r p r e t e d a nd d isclosur e
r e q uir e m e nt s w it h in q ua r t e r ly r e p or t ing m a y b e m isse d . • I d e nt if y f unct iona l le a d e r s t h a t w ill colle ct a nd r e v ie w
A ccount ing ch a ng e is m or e t h a n a ccount ing a nd m or e t h e ir a r e a ’ s q ue st ionna ir e s a nd a ct a s ind e p e nd e nt
t h a n ch a ng e . Com p a nie s t h a t h a nd le t h e t r a nsit ions w e ll r e v ie w e r s, ch a lle ng ing t h e st a t us q uo a nd p ush ing t h e
will find themselves in a position of improved performance CEO and CFO to make certain they are comfortable with
f r om I T t o p r oce sse s a nd r e la t e d g ov e r na nce a nd cont r ols. t h e r e sp onse s
• Create a questionnaire that certifiers will need to
complete; the type of questions each certifier receives
Questions to consider Benefits of taking action Timing m a y d e p e nd on a num b e r of f a ct or s, includ ing t h e
• Enables compliance with • O ng oing t o r e sp ond t o certifier’s role in the organization and the business unit
• D o y ou k now w h e r e t o ob t a in a ssist a nce w it h
r e g ula t or y r e q uir e m e nt s ch a ng e s on a t im e ly to which the 302 certifier belongs
int e r p r e t a t ion w h e n ne e d e d ? W h ile m a ny com p a nie s m a y f e e l t h e y h a v e a g ood
• F a cilit a t e s a p p r op r ia t e b a sis SOX Section 302 certification process, some may • S e nd a ny q ue st ionna ir e s w it h not e d issue s t o t h e
• Are internal controls evaluated to confirm that they are
up - f r ont int e r p r e t a t ion h a v e b e com e com p la ce nt , g oing a s f a r a s r ub b e r - f unct iona l le a d e r s im m e d ia t e ly
a d e q ua t e ly d e sig ne d t o a d d r e ss t h e se ch a ng e s?
a nd a p p lica t ion of stamping certifications, introducing even more risk to • S e le ct a t ool t h a t w ill b e use d t o a d m inist e r t h e
• H ow a r e ch a ng e s t o a ccount ing st a nd a r d s t h e ir or g a niz a t ion.
a ccount ing st a nd a r d s t o questionnaire and approval/certification process
com m unica t e d t o t h ose r e sp onsib le f or t h e r e la t e d
y our b usine ss
int e r na l cont r ols? • Confirm that control objects are processed and
• Enables open lines of d ocum e nt e d a p p r op r ia t e ly t h r oug h t h e use of y our
• H a v e y ou e v a lua t e d t h e im p a ct of a ccount ing ch a ng e
com m unica t ion a cr oss com p a ny ’ s ca le nd a r f unct ions f or r e m ind e r s, e sca la t ions
not only on t h e a ct ua l a ccount ing b ut a lso on
t h e or g a niz a t ion and notifications
g ov e r na nce , p e op le , p r oce ss, t e ch nolog y a nd r e la t e d
int e r na l cont r ols?
Questions to consider Benefits of taking action Timing
A w e ll- d ocum e nt e d a nd w e ll- und e r st ood ong oing • H a s y our or g a niz a t ion na m e d som e one a s t h e S O X • Enables compliance with • Q ua r t e r ly a nd
p r oce ss is cr it ica l t o st a y ing a b r e a st of a ccount ing S e ct ion 3 0 2 p r og r a m le a d e r ? r e g ula t or y r e q uir e m e nt s a s ne e d e d
st a nd a r d s ch a ng e s. • D oe s y our or g a niz a t ion use q ue st ionna ir e s a nd se t • P r ov id e s m or e v isib ilit y int o a nd a s cont r ol
r e m ind e r s t o f a cilit a t e t h e p r oce ss? ov e r sig h t of t h e or g a niz a t ion’ s e nv ir onm e nt s
int e r na l cont r ol e nv ir onm e nt ch a ng e
• H a s y our or g a niz a t ion im p le m e nt e d a t ool t o
a d m inist e r t h e p r og r a m ? • Enables identification of issues
• Has your organization identified the functional leaders, t h r oug h out t h e y e a r r a t h e r t h a n
a nd d o t h e y und e r st a nd w h a t is e x p e ct e d of t h e m ? a t y e a r - e nd
• H a v e y ou consid e r e d st r e a m lining t h e S O X S e ct ion • P r ov id e s m or e com p r e h e nsiv e

3 0 2 p r oce ss b y e m b e d d ing it int o t h e d isclosur e inf or m a t ion f or t h e p r e se nt a t ion
com m it t e e p r oce ss? of quarterly findings
I nt r od uct ion
opportunities 1 3
5 6
S cop e a nd m ix of cont r ols t e st ing M a na g e m e nt r e v ie w cont r ols
How do you Are

M a ny w ould a g r e e t h a t a t op - d ow n, r isk - b a se d m od e l w it h M a na g e m e nt r e v ie w cont r ols a r e d e t e ct a nd cor r e ct
a focus on financial statement assertions and disclosures is cont r ols t h a t a r e p e r f or m e d b y ind iv id ua ls, g e ne r a lly in
t h e a p p r op r ia t e m e t h od olog y ; h ow e v e r , w e a r e st ill se e ing m a na g e m e nt p osit ions, w it h t h e a p p r op r ia t e com p e t e nce
select and ch a lle ng e s w it h scop ing . I t is a lso no sur p r ise t h a t t h e
m ix of cont r ols is a le v e r t h a t ca n b e p ulle d t o h e lp cr e a t e
management and authority, who, as part of their job responsibilities,
review financial statements, account balances, account
monitor the right scope review controls

efficiencies. Controls optimization — e.g., coordination of a na ly se s, e st im a t e s, r e concilia t ions or ot h e r d a t a . F or
a ct iv it ie s a cr oss v a r ious f unct ions, t h e use of a ut om a t ion e x a m p le :
a nd ce nt r a liz a t ion of cont r ols, a nd t h e p e r iod ic up d a t e of
and mix of controls? designed and executed
• I nt e r na l cont r ols d e sig ne d t o d e t e r m ine t h a t im p or t a nt
t h e cont r ols m ix in r e sp onse t o ch a ng e s in t h e e st im a t e s a r e com p le t e a nd a ccur a t e a nd t h a t p ot e nt ia l
b usine ss — is not a ne w conce p t . I n f a ct , w e h a v e b e e n
e r r or s a r e d e t e ct e d a nd cor r e ct e d , e . g . , g ood w ill
t a lk ing a b out it f or y e a r s. B ut cont r ols op t im iz a t ion sh ould
not b e a one t im e e x e r cise — it sh ould b e d one p e r iod ica lly appropriately? im p a ir m e nt , b usine ss com b ina t ions a nd incom e ta x e s
t o k e e p p a ce w it h ch a ng e s in t h e b usine ss a nd r e g ula t or y • I nt e r na l cont r ols d e sig ne d t o d e t e r m ine t h a t ot h e r
e nv ir onm e nt s. int e r na l cont r ols cont inue t o f unct ion a s d e sig ne d ,
includ ing r e v ie w of a ccount r e concilia t ions
• D ir e ct e nt it y - le v e l cont r ols d e sig ne d t o id e nt if y unusua l
trends or inaccuracies in financial reporting, e.g.,
quarterly balance sheet fluctuation analyses
What is the right scope? Who should monitor?

Top-down, • U se r e m ot e , of f sh or e or out sour ce d
Enhanced
• U se a t op - d ow n, r isk - b a se d m od e l risk-based
scoping resource r e sour ce s a s a p p r op r ia t e Typical areas of management review controls
• Focus on financial statement assertions model
a nd d isclosur e s • Consid e r using v a r ia b le or se a sona l
r e sour ce s Significant unusual or non-routine
• U nd e r st a nd t h e im p lica t ions of ch a ng e s cla sse s of t r a nsa ct ions
in t h e b usine ss • Select resources that are objective
a nd h a v e t h e ne ce ssa r y sk ills a nd
com p e t e nce Fraud or other significant risks G r oup w id e cont r ols
What is the right mix of controls? How do you monitor? Key

• O p t im iz e cont r ols, e . g . , a ut om a t ion • U se r isk - b a se d cont r ol t e st ing management
a nd ce nt r a liz a t ion, a nd p r e v e nt v s. • Establish a variable testing model H ig h e r - r isk e st im a t ion p r oce ss review Com p e nsa t ing cont r ols t h a t a r e b e ing
d e t e ct g r oup w id e cont r ols Optimized controls relied on to mitigate deficiencies
risk and • Establish an approach for rollforward and
• L e v e r a g e m onit or ing cont r ols w h e r e Efficient
controls testing r e m e d ia t ion t e st ing
a p p r op r ia t e
strategies • Define a deficiency identification and
• U p d a t e cont r ols m ix f or ch a ng e s in a g g r e g a t ion p r oce ss
b usine ss a nd sy st e m s
Questions to consider Benefits of taking action Timing Questions to consider Benefits of taking action Timing
• H a v e y ou p e r f or m e d a n int e r na l cont r ols op t im iz a t ion • M a y im p r ov e ov e r a ll • W h e n cont r ols a r e • D oe s m a na g e m e nt und e r st a nd t h e p ur p ose of t h e • Enables the organization to • O ng oing t o r e sp ond
e x e r cise e v a lua t ing t h e m ix of cont r ols? efficiencies in the execution e x e cut e d r e v ie w a nd t h e r isk it is int e nd e d t o a d d r e ss? e f f e ct iv e ly a d d r e ss t o ch a ng e s on a
• H a v e y ou e v a lua t e d y our int e r na l a ud it a nd int e r na l of t h e I CF R p r og r a m • D o cont r ol ow ne r s und e r st a nd t h e r e q uir e d b usine ss r isk t im e ly b a sis
• A t le a st
cont r ol f unct ion r isk cov e r a g e f or op t im iz a t ion • M a y r e d uce t h e cost of a nnua lly — cont r ol d ocum e nt a t ion t o sup p or t e x e cut ion of t h e cont r ols? • M a y r e d uce t h e r isk • A t le a st a nnua lly —
op p or t unit ie s? cont r ols t h r oug h t h e use of ow ne r t r a ining • D oe s m a na g e m e nt r e ce iv e p e r iod ic inf or m a t ion of financial reporting m a na g e m e nt t r a ining
• H a v e y ou consid e r e d a lt e r na t iv e m onit or ing a ut om a t ion up d a t e s a nd t r a ining on m a na g e m e nt r e v ie w cont r ol m isst a t e m e nt s or
ca p a b ilit ie s, e . g . , of f sh or e , b y t h ir d p a r t ie s or b y • M a y r e d uce t h e r isk r e q uir e m e nt s? r e st a t e m e nt s
d if f e r e nt p a r t ie s in- h ouse ? of financial reporting • H a v e y ou e v a lua t e d t h e t h r e sh old s y ou a r e using a nd • Enhances awareness and
• Have you evaluated the relevant IPE and IT general m isst a t e m e nt s or ob t a ine d a lig nm e nt w it h a ll st a k e h old e r s? a ccount a b ilit y a m ong cont r ol
cont r ols in y our I CF R p r og r a m ? r e st a t e m e nt s ow ne r s
• H a v e t h e cont r ol ow ne r s r e ce iv e d t r a ining on t h e • M a y im p r ov e a w a r e ne ss a nd
importance of IPE and IT general controls? a ccount a b ilit y a m ong cont r ol
ow ne r s
I nt r od uct ion
opportunities 1 5
7 8
IPE P op ula t ion com p le t e ne ss
Are you IPE is any information provided by the entity using the
e nt it y ’ s I T a p p lica t ions, e nd - use r com p ut ing t ools or ot h e r When is You may find that data previously provided as population
e v id e nce t o t h e a ud it or s is now b e ing q ue st ione d w it h r e sp e ct
m e a ns. I t is use d b y m a na g e m e nt , b e it in e le ct r onic or t o com p le t e ne ss. I t is im p or t a nt t h a t no d a t a is ina d v e r t e nt ly
considering p r int e d f or m , in t h e p e r f or m a nce of cont r ols. I ne f f e ct iv e
cont r ols ov e r sy st e m - g e ne r a t e d d a t a or r e p or t s cont inue
population om it t e d or e x clud e d , t h us m isr e p r e se nt ing t h e p op ula t ion.
O ne w a y t o r e d uce t h e b ur d e n of g a t h e r ing a nd r e t a ining t h e
the completeness to be a common finding related to ICFR.

completeness e v id e nce of com p le t e ne ss f or r e p or t s is t o b e nch m a r k t h e
r e p or t p r og r a m a nd se cur e it s a cce ss so t h a t use r s ca nnot
m od if y it or e x clud e cont e nt once it is e x t r a ct e d f r om t h e
and accuracy of IPE Every review control that relies on end-user
com p ut ing sh ould b e a ccom p a nie d b y e v id e nce of
important? sy st e m . I f t h e r e p or t s a r e cont r olle d t h is w a y a nd I T g e ne r a l
cont r ols a r e e f f e ct iv e f or t h e sy st e m t h a t p r od uce d t h e
in your controls? IPE completeness and accuracy to give management

confidence that data used to make critical decisions
r e p or t s, t h e e v id e nce of com p le t e ne ss m a y b e ne e d e d only
once d ur ing t h e y e a r .
is a p p r op r ia t e .

R e p or t s use d a s p op ula t ion in t h e t e st ing of I T a nd
• Are the risks related to IPE properly addressed? • M a y im p r ov e a w a r e ne ss a nd • W h e n cont r ols a r e
b usine ss p r oce ss cont r ols sh ould b e a ccom p a nie d b y
• Have you evaluated the relevant IPE and IT general a ccount a b ilit y a m ong cont r ol e x e cut e d evidence that the reported data completely reflects
cont r ols in y our I CF R p r og r a m ? ow ne r s • O ng oing t h e inf or m a t ion cont a ine d in t h e sy st e m a nd t h a t it
• H a v e t h e cont r ol ow ne r s r e ce iv e d t r a ining on t h e • M a y e na b le r e lia nce b y t h e • A t le a st was not inappropriately limited or modified when the
e x t e r na l a ud it or s r e p or t s w e r e g e ne r a t e d .
importance of IPE and IT general controls, and are a nnua lly — cont r ol
t h e y a w a r e t h a t cont r ols ne e d t o b e e x e cut e d w it h • M a y r e d uce t h e r isk of ow ne r t r a ining
com p le t e a nd a ccur a t e inf or m a t ion? financial reporting mis-
st a t e m e nt s or r e st a t e m e nt s

• Have you confirmed your understanding of • Enables timely • A t t h e b e g inning
d ocum e nt a t ion r e q uir e m e nt s f or p op ula t ion com m unica t ion of of t h e a ud it cy cle
W h e n com p
of t h e d e sig
a nie s int e r na lly
n a nd op e r a t ing
g a
e f
th
fe
e r e v id e nce
ct iv e ne ss of
Use the 5 W’s + How com p le t e ne ss w it h y our e x t e r na l a ud it or ?
• H a v e y ou consid e r e d a ut om a t ing y our com p le t e ne ss
r e q uir e m e nt s t o cont r ol
ow ne r s t o e st a b lish
• D ur ing st a t us
m e e t ing s w it h t h e
to document evidence
cont r ols, t h e y sh ould consid e r a nd d ocum e nt t h e e v id e nce ? a w a r e ne ss a nd e nh a nce e x t e r na l a ud it or s
com p le t e ne ss a nd a ccur a cy of t h e e v id e nce .
Where does data come from? com p lia nce
• D ur ing cont r ol
• D e m onst r a t e s p r oa ct iv e r e d e sig n e f f or t s
Who performs the review? st a nd on cont r ols a nd
• D ur ing sy st e m
colla b or a t ion
up g r a d e s
When is data received?
What procedures does the process owner
perform for reliance of IPE?
Why is the IPE utilized in the control?

How is data compiled or generated from the
system?
I nt r od uct ion
opportunities 1 7
9 10
Cont r ol p r e cision R e la t e d p a r t ie s
Are your M a na g e m e nt e st im a t e s, includ ing t h e ir p r e cision, h a v e

become a growing area of focus due to their subjectivity Do you know W h
1 8
e n t h ink
(A S 1 8 )
ing a b out P CA O B A ud it ing S t a nd a r d N o.
, r e la t e d - p a r t y t r a nsa ct ions com e t o m ind ;
and, in some cases, financial significance. Common h ow e v e r, t h e st a nd a r d g oe s b e y ond t h e se t r a nsa ct ions
controls precise findings include the absence of controls testing over the
d e v e lop m e nt of a n e st im a t e a nd t h e a b se nce of e v a lua t ion
who your a nd includ e s:
enough to detect of t h e r e a sona b le ne ss of t h e a ssum p t ions und e r ly ing t h e

e st im a t e . related parties are? • R e la t ionsh ip s a nd t r a nsa ct ions w it h r e la t e d p a r t ie s
• Significant unusual transactions
significant issues?
S im ila r t o m a na g e m e nt r e v ie w cont r ols, t h e f ollow ing • F ina ncia l r e la t ionsh ip s a nd t r a nsa ct ions w it h e x e cut iv e
it e m s sh ould b e t op of m ind w h e n a sse ssing m a na g e m e nt ’ s officers
cont r ols r e g a r d ing k e y e st im a t e s:
• Determine the method, significant assumptions and Com p a nie s sh ould r e v isit t h e cont r ols t h e y h a v e T h e P CA O B d e v e lop e d t h e st a nd a r d t o f ocus t h e a ud it or ’ s
com p le t e ne ss a nd a ccur a cy of inf or m a t ion use d in p la ce t o id e nt if y , a ccount f or a nd d isclose a t t e nt ion on a r e a s t h a t h a v e b e e n a ssocia t e d w it h r isk s of
• G a t h e r a nd e v a lua t e inf or m a t ion, includ ing a v a ila b le t r a nsa ct ions w it h r e la t e d p a r t ie s a nd e x e cut iv e s, a nd fraudulent financial reporting and error. To address these
T h e ov e r a ll g oa l of m a na g e m e nt e st im a t e t e st ing is t o
significant unusual transactions. r isk s, com p a nie s sh ould a lso f ocus on t h e se t r a nsa ct ions.
v a lid a t e t h a t t h e issue r ’ s a ssum p t ions a nd e st im a t e s cont r a r y inf or m a t ion, a nd a p p ly it in d e t e r m ining t h e
und e r ly ing t h e v a lua t ion of a sse t s a nd lia b ilit ie s a r e a m ount s t o b e r e cor d e d or d isclose d
r e a sona b le . • Evaluate which key assumptions drive the estimate
• A na ly z e w h e t h e r m a na g e m e nt ’ s r e v ie w of t h ose Questions to consider Benefits of taking action Timing
a ssum p t ions is r e a sona b le g iv e n t h e sup p or t
• Does your organization have a confirmation process • M a y e x p e d it e t h e d isclosur e • Q ua r t e r ly
f or t h e e st im a t e s
t h a t includ e s k e y st a k e h old e r s t o e v a lua t e e x ist ing a nd p r oce ss confirmation
ne w r e la t ionsh ip s? • M a y r e d uce a ud it f a t ig ue p r oce ss
• H ow d o y ou ob t a in com p le t e ne ss in r e p or t ing of • Enhances risk management
r e la t e d p a r t ie s a nd t h e ir t r a nsa ct ions in a t im e ly a ct iv it ie s
Questions to consider Benefits of taking action Timing m a nne r ?
• D oe s m a na g e m e nt h a v e a n und e r st a nd ing of t h e • Ca n h a v e a p osit iv e e f f e ct on • O ng oing t o r e sp ond
r e q uir e m e nt s f or it s r e v ie w of int e r na l cont r ols — e . g . , b usine ss p e r f or m a nce t o ch a ng e s on a
is t h e r e a nnua l r e f r e sh t r a ining on cont r ol ow ne r • M a y r e sult in a r e d uct ion t im e ly b a sis
r e q uir e m e nt s? of financial reporting • A t le a st Companies should maintain the following
• Are controls evaluated periodically to confirm that m isst a t e m e nt s or a nnua lly — documentation:
t h e y a r e d e sig ne d t o a d d r e ss e m e r g ing a r e a s of f ocus? r e st a t e m e nt s m a na g e m e nt • T h e na m e s of t h e com p a ny ’ s r e la t e d p a r t ie s
• Is control precision evaluated for areas of significant • P r ov id e s b e t t e r a w a r e ne ss t r a ining a nd t h e b usine ss p ur p ose f or e nt e r ing int o t h e
e st im a t ion, includ ing f a ir v a lue m e a sur e m e nt s, a nd a ccount a b ilit y a m ong t h e t r a nsa ct ion
im p a ir m e nt s, r e se r v e s a nd incom e t a x e s? cont r ol ow ne r s • B a ck g r ound inf or m a t ion on t h e r e la t e d p a r t ie s
( f or e x a m p le , p h y sica l loca t ion, ind ust r y , siz e
a nd e x t e nt of op e r a t ions)
• T h e na t ur e of a ny r e la t ionsh ip s, includ ing
ow ne r sh ip st r uct ur e , b e t w e e n t h e com p a ny a nd
it s r e la t e d p a r t ie s
• The transactions entered into, modified
or t e r m ina t e d , w it h it s r e la t e d p a r t ie s a nd
t h e t e r m s a nd b usine ss p ur p ose s of such
t r a nsa ct ions
I nt r od uct ion
opportunities 1 9
11 12
Deficiency impact analysis Remediation of deficiencies
Does your When deficiencies are identified during the fiscal year
a nd int e r na l cont r ols a r e d e e m e d ine f f e ct iv e , com p lia nce Can M a na g e m e nt m a y not b e a w a r e of t h e conse q ue nce s
of postponing remediation of identified deficiencies or
t e a m s ca n h e lp m a na g e m e nt im p le m e nt a ct ion p la ns t h a t may have no plans to remediate the deficiencies. Some
organization r e d uce t h e r isk t o t h e or g a niz a t ion a nd m a y p r e v e nt t h e
ne e d f or e x p a nd e d e x t e r na l a ud it p r oce d ur e s. F or e x a m p le ,
delaying deficiencies are more challenging or may take longer to
r e m e d ia t e d ue t o p e op le or p r oce ss com p le x it y or d ue
conduct an impact if there were segregation of duties (SOD) conflict violation

deficiencies — such that programmers had access to remediation of t o sy st e m lim it a t ions. F or e x a m p le , m a na g e m e nt m ig h t
decide to replace an entire system rather than fix a
production — performing an impact analysis could confirm m ult it ud e of issue s. S om e t im e s, t h e sy st e m r e p la ce m e nt
analysis once a t h a t no una ut h or iz e d ch a ng e s w e r e m a d e . T h is a na ly sis
sh ould includ e ob t a ining a com p le t e p op ula t ion of ch a ng e s
deficiencies today is a p a r t of t h e I T a r ch it e ct ur e r oa d m a p — a conse q ue nce
of t h e com p a ny ’ s g r ow t h a nd m ov e m e nt t o ne w e r
deficiency is identified? m a d e t o t h e sy st e m w h e r e t h e S O D v iola t ion occur r e d a nd

reviewing them to confirm that all were approved, tested turn into significant com p ut ing p la t f or m s. T h e se cir cum st a nce s m a y le a d t o
multiple system and business process deficiencies that
a nd a p p r op r ia t e . T h is st e p cle a r ly g oe s b e y ond sim p le a r e not r e m e d ia t e d f or a p r olong e d p e r iod .
r e m e d ia t ion. R e m ov ing p r og r a m m e r a cce ss t o p r od uct ion
addresses the SOD violation and prevents the deficiency
deficiencies in the Whether deficiencies repeated over multiple audit years
will trigger a significant deficiency or material weakness
When deficiencies related to business processes or

f r om cont inuing , b ut it d oe s not a d d r e ss t h e r isk t h a t
inappropriate access was exploited when the deficiency future? conclusion in any given fiscal year is a management and
e x t e r na l a ud it or d e cision, a nd e v e r y cir cum st a nce d if f e r s
key financial systems and controls are identified, existed. A targeted impact analysis confirms that the d e p e nd ing on w h e t h e r m a na g e m e nt p la ns t o a d d r e ss
p e r f or m ing a d d it iona l p r oce d ur e s t o d e t e r m ine b usine ss p r oce ss or sy st e m ca n b e r e lie d up on t o p r oce ss t h e issue s w it h in a r e a sona b le t im e f r a m e . H ow e v e r , t h e
w h e t h e r a ny t h ing “ b a d ” h a p p e ne d is t h e ne x t st e p . financial transactions accurately despite the SOD deficiency. company should have sufficient compensating controls
Management should define and implement specific in p la ce w h ile t h e issue e x ist s.
remediation plans for all deficiencies. If the plans
a r e in p la ce b ut sp a n m ult ip le y e a r s, t e m p or a r y
com p e nsa t ing cont r ols m a y ne e d t o b e im p le m e nt e d
t o m it ig a t e r isk s.

• D oe s y our or g a niz a t ion consist e nt ly p e r f or m a r isk a nd • O b t a ins e v id e nce t h a t t h e • I m m e d ia t e ly a f t e r
impact assessment when deficiencies are identified? deficiencies were not exploited the deficiencies Questions to consider Benefits of taking action Timing
• D oe s y our or g a niz a t ion r e v ie w e v id e nce , log s a nd • P r ov id e s e v id e nce t o are identified • When individual deficiencies are evaluated in the • M a y m it ig a t e t h e r isk • A s p a r t of
changes to confirm that deficiencies were not p ot e nt ia lly p r e v e nt a d d it iona l • Prior to finalizing aggregate, could this lead to a significant deficiency or of financial reporting t h e q ua r t e r ly
e x p loit e d ? a ud it p r oce d ur e s or r e d uce m a na g e m e nt ’ s m a t e r ia l w e a k ne ss conclusion? m isst a t e m e nt s certification process
a ud it f ollow - up s S O X S e ct ion 4 0 4 • D oe s y our or g a niz a t ion h a v e a p r oce ss t o f or m a lly • D e m onst r a t e s a p r oa ct iv e • A t le a st a nnua lly
• M inim iz e s t h e e f f e ct of cont r ol conclusions revisit prior year deficiencies to determine whether a p p r oa ch t o int e r na l cont r ols • Prior to finalizing
deficiencies t h e y h a v e b e e n r e m e d ia t e d or a d e q ua t e a ct ion p la ns • A v oid s t h e ne e d t o m a na g e m e nt ’ s
a r e in p la ce ? carry over deficiencies by S O X S e ct ion 4 0 4
d e t e r m ining a nd a d d r e ssing conclusion
t h e r oot ca use of t h e
deficiency
I nt r od uct ion
opportunities 2 1
13 14
S y st e m im p le m e nt a t ions O ut sour ce d sy st e m s a nd b usine ss
p r oce sse s
How do W h e n I T a p p lica t ions use d t o p r oce ss t r a nsa ct ions t h a t a r e

reflected in financial statements undergo major changes, Where does T h ir d - p a r t y se r v ice or g a niz a t ions op e r a t ing inf or m a t ion
sy st e m s a nd p r ov id ing b usine ss p r oce ss se r v ice s sup p or t ing
com p lia nce t e a m s a nd int e r na l a ud it or s h a v e a uniq ue financial reporting have grown increasingly interconnected
system op p or t unit y t o h e lp m a na g e m e nt a ch ie v e a succe ssf ul
im p le m e nt a t ion. T h e se ch a ng e s m a y inv olv e t e ch nolog y -
responsibility w it h t h e ir cust om e r s ( use r e nt it ie s) . T h is ca n le a d t o a n
a ssum p t ion t h a t t h e se r v ice or g a niz a t ion is sole ly r e sp onsib le
implementations affect e na b le d b usine ss t r a nsf or m a t ions, I T se r v ice p r ov id e r

ch a ng e s, sy st e m up g r a d e s, inf r a st r uct ur e m ig r a t ions a nd and oversight for f or h a v ing a n e f f e ct iv e int e r na l cont r ol e nv ir onm e nt on
b e h a lf of m a na g e m e nt . H ow e v e r , m a na g e m e nt is r e sp onsib le
a ny t h ing f a lling int o t h e ca t e g or y of “ m ov e t o t h e cloud . ” f or a sse ssing t h e e f f e ct of t h e se r v ice s p r ov id e d b y t h e
the internal control I T a p p lica t ion im p le m e nt a t ions of t e n int r od uce ne w outsourced systems se r v ice or g a niz a t ion on I CF R , includ ing t h e r isk s of m a t e r ia l
m isst a t e m e nt . A s a r e sult , use r e nt it ie s a r e r e q uir ing m or e
cont r ol ca p a b ilit ie s t h a t a llow t h e or g a niz a t ion t o
environment? better leverage its significant IT investment and
r e d uce r isk b y t a k ing g r e a t e r a d v a nt a g e of a ut om a t e d
and business processes inf or m a t ion a nd a ssur a nce a b out int e r na l cont r ols f r om
t h ir d - p a r t y se r v ice or g a niz a t ions. T o r e sp ond t o t h is d e m a nd ,
a t h ir d - p a r t y se r v ice or g a niz a t ion m a y p r ov id e a S e r v ice
cont r ols w it h in t h e b usine ss p r oce sse s. H ow e v e r , I T
a p p lica t ion im p le m e nt a t ions a lso int r od uce ne w r isk s, reside in your O r g a niz a t ion Cont r ols ( S O C) r e p or t t o it s use r e nt it ie s.
such a s incr e a se d r isk of f a ilur e t o m a k e t h e ne ce ssa r y M a na g e m e nt is r e sp onsib le f or a sse ssing t h e S O C r e p or t
cust om iz a t ions t o t h e sy st e m , cor r e ct k now n p r e -
im p le m e nt a t ion e r r or s, com p le t e ly a nd a ccur a t e ly conv e r t
organization? t o d e t e r m ine t h a t it cov e r s t h e r e le v a nt scop e ( t h e sy st e m
includ ing t h e I T a p p lica t ions, p olicie s a nd p r oce d ur e s,
or t r a nsf e r d a t a or a p p r op r ia t e ly r e st r ict a cce ss t o a nd se r v ice or g a niz a t ion loca t ions) a nd t im e p e r iod , a nd
se nsit iv e t r a nsa ct ions, a f f e ct ing t h e I T a p p lica t ion’ s a b ilit y O ut sour cing sy st e m s a nd b usine ss p r oce sse s d oe s contains a sufficient and appropriate level of communication
t o sup p or t e f f e ct iv e int e r na l cont r ol t h a t e na b le s a ccur a t e not a b solv e use r e nt it ie s of t h e ir r e sp onsib ilit y f or a n conce r ning t h e d e sig n, im p le m e nt a t ion a nd op e r a t ing
financial reporting. e f f e ct iv e int e r na l cont r ol e nv ir onm e nt . e f f e ct iv e ne ss of cont r ols t o a d d r e ss t h e r isk s of m a t e r ia l
m isst a t e m e nt . Com p lia nce t e a m s a nd int e r na l a ud it or s m a y
a ssist w it h a sse ssing t h e S O C r e p or t , a s w e ll a s cont r ols
im p le m e nt e d b y m a na g e m e nt t o a d d r e ss t h e com p le m e nt a r y
T h e d e sig n a nd im p le m e nt a t ion of int e r na l Report type SOC 1 SOC 2 user entity controls (CUEC) identified by the third-party
cont r ols a r e k e y t o a succe ssf ul sy st e m O p inion on cont r ols O p inion on cont r ols a t se r v ice or g a niz a t ion a s ne ce ssa r y t o a ch ie v e ce r t a in cont r ol
im p le m e nt a t ion. a t a se r v ice a se r v ice or g a niz a t ion objectives or criteria included in the SOC report. Compliance
Com m unica t ion or g a niz a t ion r e le v a nt t o se cur it y , t e a m s a nd int e r na l a ud it or s ca n a lso a ssist m a na g e m e nt
p ur p ose r e le v a nt t o use r a v a ila b ilit y , w it h a n a sse ssm e nt of t h e im p a ct of d e v ia t ions in t h e d e sig n,
e nt it ie s’ cont r ol ov e r p r oce ssing int e g r it y ,
im p le m e nt a t ion or op e r a t ing e f f e ct iv e ne ss of cont r ols a t t h e
financial reporting confidentiality or
Questions to consider Benefits of taking action Timing p r iv a cy
service organization identified in the SOC report.
• H a s m a na g e m e nt e m b e d d e d cont r ol consid e r a t ions • Reduces the risk of financial • T h e p la nning A d d it iona lly , t h e se r v ice or g a niz a t ion m a y out sour ce ce r t a in
into their system development process for financially t r a nsa ct ion m isst a t e m e nt s p h a se of sy st e m U se r e nt it y a nd M a na g e m e nt of se r v ice s t o a sub se r v ice or g a niz a t ion a nd ca r v e out t h ose
I nt e nd e d
d ue t o e r r one ous sy st e m im p le m e nt a t ions a n a ud it or of it s se r v ice or g a niz a t ion, se r v ice s f r om it s S O C r e p or t . A sub se r v ice or g a niz a t ion m a y
significant IT applications? a ud ie nce
financial statements use r e nt it ie s a nd not p r ov id e a S O C r e p or t t o use r e nt it ie s; h ow e v e r , cont r ols
• D o b usine ss a nd I T r e p r e se nt a t iv e s a ct iv e ly p a r t icip a t e f unct iona lit y • P la nning a nd t e st ing other specified a t t h e sub se r v ice or g a niz a t ion m a y b e r e le v a nt t o t h e use r
in defining relevant risk and control considerations? • R e d uce s t h e r isk of p r ior t o g o- liv e k now le d g e a b le e nt it y ’ s int e r na l cont r ol e nv ir onm e nt . Com p lia nce t e a m s a nd
ina p p r op r ia t e ch a ng e s t o k e y t o h e lp r e d uce p a r t ie s int e r na l a ud it or s h a v e a n op p or t unit y t o a ssist m a na g e m e nt
sy st e m s p ost - im p le m e nt a t ion w it h a sse ssing a nd m inim iz ing r isk s inh e r e nt in out sour cing
• A v oid s sy st e m out a g e s a nd issue s sy st e m s a nd b usine ss p r oce sse s w h ile m a na g ing cost s of
e f f e ct iv e int e r na l cont r ol.
op e r a t iona l p r ob le m s a f t e r
g o- liv e
• P r om ot e s und e r st a nd ing Questions to consider
w it h in t h e b usine ss a s Benefits of taking action Timing
• H a v e f or m a l r ole s a nd r e sp onsib ilit ie s b e e n e st a b lish e d
t o h ow sy st e m ch a ng e s • P r oa ct iv e ly m onit or s • D ur ing t h e p la nning
f or a ll out sour ce d p r oce sse s?
could op t im iz e t h e cont r ol p e r f or m a nce of sy st e m a nd cont r a ct ing
e nv ir onm e nt • What specific services, including control objectives, se r v ice p r ov id e r s p h a se s
cont r ols a nd a p p lica t ions, a r e b e ing p r ov id e d b y t h ir d
• D r iv e s com m unica t ion a nd • A v oid s sur p r ise s r e g a r d ing • Cont r ols sh ould b e
p a r t ie s?
f ur t h e r link s I T a nd b usine ss CUECs in op e r a t ion f or t h e
p r oce ss t og e t h e r w it h in t h e • A r e e x p e ct e d cont r ols includ e d in S O C r e p or t s a nd fiscal period
• M a y p r e v e nt la t e
or g a niz a t ion tested properly and for a sufficient period of time?
identification of deficiencies
• Do you proactively address CUECs through existing
cont r ols t o r e d uce ov e r a ll I CF R cost s?
I nt r od uct ion
opportunities 2 3
15 16
S O C r e p or t s Cont r ols in t h e cloud
What can you O cca siona lly , a com p a ny m a y h a v e a t h ir d - p a r t y se r v ice

or g a niz a t ion t h a t op e r a t e s inf or m a t ion sy st e m s a nd When Cloud com p ut ing is m or e t h a n a b uz z p h r a se ; it h a s
b e com e a f or ce in t h e m a r k e t p la ce . I n f a ct , m ov ing “ int o
provides business process services supporting financial t h e cloud ” h a s b e com e com m on a s com p a nie s se e k t o
do if a SOC r e p or t ing y e t d oe s not h a v e a S O C r e p or t a v a ila b le . O r
t h e r e p or t d oe s not cov e r t h e r e le v a nt scop e ( t h e sy st e m
systems r e d uce cost s, st r e a m line op e r a t ions a nd r e f ocus t h e ir
r e sour ce s on cor e com p e t e ncie s. A s cloud p r ov id e r s
report is not available? includ ing I T a p p lica t ions, p olicie s a nd p r oce d ur e s a nd

se r v ice or g a niz a t ion loca t ions) or t im e p e r iod . T h e r e a r e move into the cloud, can p r olif e r a t e , m a ny sm a lle r I T se r v ice p r ov id e r s of f e r m inim a l
or no ind e p e nd e nt a sse ssm e nt of t h e ir se r v ice s a nd m a y
t w o t y p e s of S O C r e p or t s. A T y p e I r e p or t p r ov id e s a n not h a v e a n a p p r op r ia t e int e r na l cont r ol e nv ir onm e nt or
op inion on a n e x a m ina t ion of a d e scr ip t ion of a se r v ice
or g a niz a t ion’ s sy st e m a nd t h e suit a b ilit y of t h e d e sig n of
you expect controls to se cur it y inf r a st r uct ur e t o p r ot e ct y our cr it ica l
b usine ss d a t a .
controls to achieve the stated control objectives as of a
ce r t a in d a t e . A T y p e I I r e p or t p r ov id e s a n e x a m ina t ion follow? T h e cloud is e v olv ing r a p id ly , g iv ing com p a nie s a v a r ie t y
of a d e scr ip t ion of a se r v ice or g a niz a t ion’ s sy st e m a nd of ch oice s. B ut lik e m ost t e ch nolog y ch a ng e s, t h e cloud
t h e suit a b ilit y of t h e d e sig n a nd op e r a t ing e f f e ct iv e ne ss p r e se nt s it s sh a r e of r isk s a nd ch a lle ng e s t h a t a r e of t e n
of controls to achieve the stated control objectives ov e r look e d or not f ully und e r st ood . F or e x a m p le :
ov e r a p e r iod of t im e , t y p ica lly 6 t o 1 2 m ont h s. I f a n
U nd e r st a nd ing t h e a v a ila b ilit y a nd cont e nt of t h e a p p r op r ia t e S O C r e p or t is not a v a ila b le , m a na g e m e nt , • Infrastructure and architectural risks. T h e se h a r d
w it h t h e a ssist a nce f r om com p lia nce t e a m s a nd int e r na l B uy e r b e w a r e : w h e n e nt ir e sy st e m s or t h e ir r e t ur n r isk s a r ise if p r ov id e r s d o not a ch ie v e p e r f or m a nce
S O C r e p or t s p r e v e nt s t h e e x p e nse of a d d it iona l a ud it
a ud it or s, sh ould d e t e r m ine w h e t h e r r e le v a nt cont r ols e x ist com p one nt s a r e m ov e d int o v e nd or - m a na g e d r e q uir e m e nt s t h a t or g a niz a t ions a nd t h e p r ov id e r s a g r e e
p r oce d ur e s.
a t t h e use r e nt it y ( a nd a r e includ e d in t h e e nt it y ’ s I CF R solut ions, d ue d ilig e nce r e la t e d t o cont r ols w ill p a y to and define in the service-level agreements at the
a sse ssm e nt ) ov e r t h e se r v ice s p r ov id e d b y t h e se r v ice of f b ig . out se t of t h e cont r a ct .
or g a niz a t ion t o m it ig a t e t h e r isk s of m a t e r ia l m isst a t e m e nt • Standards and interoperability risks. I t is v it a l t h a t t h e
t h a t m a y a r ise f r om t h e t r a nsa ct ions p r oce sse d a nd or g a niz a t ion’ s sy st e m s a nd t h ose of t h e p r ov id e r ca n
services provided by the service organization. If sufficient com m unica t e w it h one a not h e r .
cont r ols d o not e x ist a t t h e use r e nt it y , m a na g e m e nt , w it h
a ssist a nce f r om com p lia nce t e a m s a nd int e r na l a ud it or s, • Regulatory and compliance risks. O r g a niz a t ions using
m a y ne e d t o p e r f or m t e st s of cont r ols or sub st a nt iv e cloud com p ut ing se r v ice s, a nd p a r t icula r ly sof t w a r e - a s-
p r oce d ur e s a t t h e se r v ice or g a niz a t ion. M a na g e m e nt a - se r v ice ( S a a S ) , h a v e low e r t r a nsp a r e ncy int o se cur it y
m a y a lso e le ct t o a r r a ng e f or a n ind e p e nd e nt a ud it or t o cont r ols a nd p r oce sse s t h a t p r ov id e r s im p le m e nt .
p e r f or m t e st s of cont r ols or sub st a nt iv e p r oce d ur e s a t t h e • Cloud vendor management and governance. Cont r a ct ua l
se r v ice or g a niz a t ion, if ne ce ssa r y . r isk s st e m p r im a r ily f r om t h e t y p e s of cont r a ct s t h a t
clie nt s e nt e r int o w it h cloud se r v ice p r ov id e r s ( CS P s) .
• Business continuity risks. Cloud use r s a r e d e p e nd ing
on t h e ir CS P s’ b usine ss cont inuit y p r og r a m a nd d isa st e r
Questions to consider Benefits of taking action Timing r e cov e r y ca p a b ilit ie s.
• D oe s y our or g a niz a t ion consid e r t h e v e nd or ’ s a b ilit y • May avoid deficiencies • D ur ing t h e p la nning
t o p r ov id e S O C r e p or t s w h e n e v a lua t ing p ot e nt ia l • I ncr e a se s t r a nsp a r e ncy of a nd cont r a ct ing Questions to consider Benefits of taking action Timing
v e nd or s? cont r ol e x e cut ion b y t h ir d - p h a se s • P r om ot e s a n e f f e ct iv e • D iscuss t h e ne e d
• D id t h e or g a niz a t ion consid e r a se r v ice p r ov id e r ’ s
• D o y ou e v a lua t e t h e cont r ol e nv ir onm e nt a t t h ir d - p a r t y p a r t ie s • D ur ing p e r iod ic m a t ur it y b e f or e e nt e r ing int o a cont r a ct ? cont r ol e nv ir onm e nt f or cont r ols w it h
p r ov id e r s b e f or e e nt e r ing int o a cont r a ct , e sp e cia lly f or com m unica t ions p r ocur e m e nt in t h e
• M a y r e d uce a ud it cost s • H a s a “ r ig h t t o a ud it ” cla use b e e n includ e d in t h e • M a y p r e v e nt op e r a t iona l
p r oce sse s t h a t sup p or t st r a t e g ic b usine ss ca p a b ilit ie s? w it h p r ocur e m e nt p la nning st a g e s of t h e
• Enables better service cont r a ct ? difficulties sourcing project
• I s t h e “ r ig h t t o a ud it ” cla use inse r t e d in y our p r ov id e r a ccount a b ilit y • A s p a r t of d e sig ning • May prevent deficiencies
• H a s y our or g a niz a t ion a sk e d f or a S O C2 T y p e ll r e p or t • R e v ie w a v a ila b le
or g a niz a t ion’ s k e y cont r a ct s? y our v e nd or
if it is a n I CF R - r e le v a nt sy st e m ? v e nd or d ocum e nt a t ion
m a na g e m e nt
• H a s I T m a na g e m e nt b e e n a d v ise d a b out t h e a nd r e q ue st S O C
ov e r sig h t f unct ion
a lt e r na t iv e s f or m it ig a t ing r isk s if no r e p or t is a v a ila b le r e p or t s d ur ing t h e
or t h e se r v ice or g a niz a t ion d oe s not p la n t o p r ov id e r e q ue st f or p r op osa l
( R F P ) p r oce ss
one ?
• Verify that controls
a r e in op e r a t ion
throughout the fiscal
p e r iod
I nt r od uct ion
opportunities 2 5
17 18
S e g r e g a t ion of d ut ie s Cy b e r r isk
Why is I n t od a y ’ s com p le x sy st e m la nd sca p e , se g r e g a t ion of d ut ie s

(SOD) conflicts may exist in a company’s key financial Is cyber risk A s t h e t h r e a t la nd sca p e r a p id ly ch a ng e s a nd r isk s incr e a se ,
com p a nie s ne e d t o ch a ng e t h e ir m ind se t a nd a p p r oa ch
p r oce sse s f or m a ny y e a r s w it h out a ny ne g a t iv e e f f e ct or t ow a r d inf or m a t ion se cur it y a nd p r iv a cy t o a d d r e ss a
segregation d e t e ct ion. H ow e v e r , w h e n issue s a r ise , t h e y m a y h a v e
consequences for financial statement reporting. For example,
given enough ne w nor m a l. T h e y ne e d t o op e r a t e und e r t h e a ssum p t ion
t h a t una ut h or iz e d use r s a r e a cce ssing t h e com p a ny ’ s
of duties a ticking time a d isg r unt le d e m p loy e e w it h e x ce ssiv e a cce ss r ig h t s m a y

“ ina d v e r t e nt ly ” d e le t e a ll of t h e inv e nt or y r e cor d s f or t h e consideration in your inf or m a t ion t e ch nolog y e nv ir onm e nt on a d a ily b a sis — t o
a ssum e “ t h e y ’ r e in. ”
y e a r . F r a ud ule nt t r a nsa ct ions m a y b e p ost e d w it h out b e ing
bomb? detected. Employees may circumvent spending or purchasing
lim it s t h r oug h a com b ina t ion of r ole s. T h e e x ist e nce of
risk management
Although not specific to your ICFR program, the assessment
of cy b e r r isk sh ould b e consid e r e d in a ny w e ll- r ound e d r isk
m a na g e m e nt p r og r a m . O r g a niz a t ions m a y h a v e p e r f or m e d
numerous SOD conflicts often comes to light when a company
d e cid e s t o im p le m e nt a g ov e r na nce , r isk a nd com p lia nce program? a sse ssm e nt s of a sp e ct s of t h e ir se cur it y r isk s, b ut a
com p r e h e nsiv e v ie w of cy b e r se cur it y r e a d ine ss m a y not
(GRC) tool. Given the large number of financial system users b e a v a ila b le w it h in t h e or g a niz a t ion. M e a nw h ile , inv e st or s,
and various ways of configuring and granting access rights, b oa r d s, m e d ia , cust om e r s, v e nd or s a nd ot h e r st a k e h old e r s
Without an automated GRC tool, major enterprise
t h e init ia l r uns of a ut om a t e d p r oce d ur e s t o d e t e ct S O D a r e a sk ing q ue st ions.
r e sour ce p la nning sy st e m s m a y not h a v e a d e q ua t e
conflicts may result in identification of thousands or tens of
controls over SOD conflicts. The American Institute of Certified Public Accountants
thousands of conflicts, some of which are false positives.
Expanding is consid e r ing g uid a nce r e la t e d t o a ne w cy b e r r isk
Com p lia nce f unct ions ca n h e lp t h e com p a ny t o a d d r e ss S O D m a na g e m e nt p r og r a m a t t e st a t ion r e p or t , so y ou sh ould
d e p e nd e nce on
r isk s p r oa ct iv e ly if t h e y p a r t ne r e f f e ct iv e ly w it h d if f e r e nt st a y a b r e a st of ne w d e v e lop m e nt s in t h is a r e a . B ut w h e n it
t e ch nolog y b y
f unct ions w it h in t h e com p a ny . W h ile t h e r e a r e r isk s of S O D com e s t o cy b e r r isk , w a it ing is g e ne r a lly not a g ood a nsw e r
t h e e nt it y
31%
conflicts within IT processes that must be mitigated through N um e r ous a r e a s of
+ =
und e r a ny cir cum st a nce s.
appropriate controls, the majority of a company’s SOD h e ig h t e ne d cy b e r -
cont r ols m ust r e sid e w it h in b usine ss p r oce sse s t o e f f e ct iv e ly r e la t e d r isk s
of r e sp ond e nt s use d a n mitigate the risk of fraud or errors. To avoid significant SOD Conce r ns ov e r t h e
a ut om a t e d solut ion t o e v a lua t e deficiencies, even in the absence of an automated tool, m a t ur it y of a n e nt it y ’ s
S O D a s it r e la t e s t o use r a cce ss. st e p s ca n b e t a k e n t o m inim iz e r isk s. T h e k e y is a p r oa ct iv e cy b e r r isk m a na g e m e nt
a p p r oa ch t h a t a na ly z e s t h e r isk s a nd im p le m e nt s a p p r op r ia t e p r og r a m
cont r ols.
Questions to consider Benefits of taking action Timing Questions to consider Benefits of taking action Timing
D oe s y our or g a niz a t ion: • M a y p r e v e nt f r a ud , e r r or s • M it ig a t ing • H a s y our or g a niz a t ion cond uct e d a com p r e h e nsiv e • M a y p r e v e nt b r e a ch e s a nd • Cont r ols sh ould b e
or financial reporting cont r ols ca n b e cy b e r se cur it y a sse ssm e nt a s p a r t of t h e r isk op e r a t iona l p r ob le m s in op e r a t ion ov e r t h e
• Have a process-specific SOD rule set based on the risk im p le m e nt e d a t
m isst a t e m e nt s m a na g e m e nt p r og r a m ? • Cont r ib ut e s t o a n e f f e ct iv e fiscal period
of m isst a t e m e nt ? y e a r - e nd a nd
• Cr e a t e s a n e f f e ct iv e cont r ol im p a ct a na ly sis • A r e y our or g a niz a t ion’ s p olicie s a nd p r oce d ur e s up t o r isk m a na g e m e nt f r a m e w or k • Annual ERM
• H a v e a p r oce ss f or h a nd ling e x ce p t ions?
f r a m e w or k p e r f or m e d t o d a te ? a ct iv it ie s m a y
• H a v e cont r ols t o e nf or ce t h e r ule s? confirm there sp e a r h e a d incr e a se d
• May prevent deficiencies • H a v e y ou e v a lua t e d cy b e r se cur it y cont r ols a t y our I T
• G a t h e r e v id e nce of a n a nnua l r ule r e v ie w a nd w a s no e f f e ct f ocus on cont r ols
on the financial se r v ice p r ov id e r s?
a p p r ov a l? a r ound cy b e r t h r e a t s
st a t e m e nt s d e sp it e • H a s y our or g a niz a t ion incor p or a t e d cy b e r t op ics int o t h e
• G a t h e r e v id e nce of t h e a sse ssm e nt of S O D v iola t ions t h e p r e se nce of enterprise risk management (ERM) program? • I nt e r na l a ud it s
to show that deficiencies were not exploited? SOD conflicts sh ould b e consid e r e d
• Adjust the control framework to align compensating • Cont r ols sh ould b e d ur ing p la nning a nd
in op e r a t ion ov e r b ud g e t ing cy cle s
controls if SOD conflicts cannot be avoided? the fiscal period
I nt r od uct ion
opportunities 2 7
19 20
D a t a a na ly t ics L e v e r a g ing t e ch nolog y a nd t ools
Have you T h e r e is w id e sp r e a d r e cog nit ion t h a t a ut om a t ion f r e e s up

r e sour ce s t o b e p ut t o b e t t e r use . B y incr e a sing y our use Does your O v e r t h e la st 1 0 y e a r s, com p a nie s h a v e cont inue d t o
make significant investments in transaction processing
of a ut om a t e d cont r ols, y ou ca n d r iv e d ow n t h e num b e r of t e ch nolog y . B ut a d op t ion of f ull sy st e m ca p a b ilit ie s
considered m a nua l t ouch p oint s a nd la b or - int e nsiv e d e t e ct cont r ols in
y our p r oce sse s. S im ila r ly , using d a t a a na ly t ics in t h e I CF R
organization a nd use of cont r ol a nd g ov e r na nce t ools h a v e not k e p t
p a ce . Consid e r t h e f ollow ing sit ua t ions:
how data analytics can cont r ol t e st ing p r oce ss m a y h a v e a n e f f e ct on I CF R cost s.

D a t a a na ly t ics cont inue s t o b e a n unt a p p e d r e sour ce
leverage technology I► n some cases, the tools have been only partially
im p le m e nt e d , e . g . , t h e a d op t ion of t h e use r
help your organization and tools to more

b y m a ny com p lia nce a nd int e r na l a ud it f unct ions. W h ile p r ov isioning m od ule s b ut not t h e b usine ss p r oce ss
som e a d op t ion h a s t a k e n p la ce , t h e sop h ist ica t ion of t ools cont r ol m od ule s w it h in G R C.
g e ne r a lly out p a ce s t h e f und ing a nd a b ilit ie s of a com p a ny ’ s
evaluate controls and effectively manage
I► n other cases, technology tools used by IT groups
int e r na l f unct ions t o a b sor b a nd f ully use t h e m . T h e h a v e not b e e n r e cog niz e d a nd use d a s p ot e nt ia l
com m on a r e a s of im p le m e nt a t ion a r e cont inuous cont r ols I CF R e na b le r s. I n t h a t ca t e g or y a r e sour ce cod e
assess risks more internal controls?

monitoring in conjunction with systems; audit scoping to r e p osit or y a nd r e le a se m a na g e m e nt t ools, w h ich ca n
id e nt if y t h e h ig h e st - r isk a r e a s; a nd im p a ct a na ly sis in t h e e na b le p r op e r cont r ols ov e r ch a ng e s t o p r od uct ion
case of identified control deficiencies.
efficiently?
sy st e m s a nd se g r e g a t ion of sup p or t v s. d e v e lop m e nt
W h ile h a v ing in- h ouse I A k now le d g e of t e ch nolog y g e ne r a lly d ut ie s. A lso in t h a t g r oup is t h e use of com m e r cia l
59%
m a k e s op e r a t iona l se nse , d a t a a na ly t ics m a y b e one a r e a t e st ing sof t w a r e , w h ich e na b le s im p le m e nt a t ion of
w h e r e a st r a t e g ic p a r t ne r sh ip ca n y ie ld b e t t e r r e sult s. of sur v e y r e sp ond e nt s a disciplined approach to financial system change
15%
of r e sp ond e nt s ind ica t e d A cce ss t o t ools a nd le a d ing - p r a ct ice e x p e r ie nce sh ould b e ind ica t e d t h a t a t ool, t e st ing a nd t h e g a t h e r ing of t e st ing a nd a p p r ov a l
t h a t d a t a a na ly t ics is b r oug h t t o t h e t a b le b y y our st r a t e g ic p a r t ne r t o la unch or e . g . , G R C, is use d t o m a int a in t h e e v id e nce .
use d t o sup p or t t h e refine the analytics program in support of your compliance d ocum e nt a t ion a nd t e st ing of R ob ust im p le m e nt a t ion of t h e se t ools a nd t h e ir
e x e cut ion of I CF R e f f or t s. int e r na l cont r ols. inclusion in t h e r isk a nd cont r ol f r a m e w or k s r e d uce
p r og r a m s r e lia nce on m a nua l p r oce d ur e s a nd t h e r e f or e r e d uce
r isk of cont r ol f a ilur e s.
38%
of sur v e y r e sp ond e nt s ind ica t e d
Questions to consider Benefits of taking action Timing a tool with built-in workflow
• D oe s y our or g a niz a t ion h a v e d a t a a na ly t ics p r og r a m s • Cov e r s a la r g e r sa m p le of t h e • W h e n p r e p a r ing f unct iona lit y is use d .
in p la ce ? p op ula t ion a nd p r ov id e s m or e f or t h e a nnua l
ERM activities
• H a v e y ou look e d f or a d d it iona l a r e a s t h a t w ould d if f e r e nt ia l f ocus on r isk s
• W h e n a sk ing
benefit from ongoing analytical assessments? • Identifies trends and all
f or I A a nnua l
• H a v e y ou e v a lua t e d m a nua lly int e nsiv e a ud it a r e a s f or e x ce p t ions in a p op ula t ion f und ing Timing
Questions to consider Benefits of taking
op p or t unit ie s t o le v e r a g e d a t a a na ly t ics? • Uses a more efficient audit • O ng oing action • Consid e r use
• D oe s y our or g a niz a t ion h a v e t h e t e ch nolog y a nd t ools
• H a v e y ou consid e r e d w h e t h e r d a t a a na ly t ics ca n a p p r oa ch of t ools a t t h e
t o e nh a nce t h e e x e cut ion of int e r na l cont r ol t e st ing ? • Ca n a llow com p a nie s t o
a ssist in t h e I CF R scop ing p r oce ss? b e g inning of I CF R
• Has your organization identified tools that would or g a niz e t h e ir p r oce d ur e s
t e st ing e a ch y e a r
m e e t y our r e q uir e m e nt s if not a lr e a d y in p la ce ? a nd m or e e f f e ct iv e ly a nd
efficiently address risks • O ng oing
• M a y r e d uce ov e r a ll cost of
cont r ols a nd m inim iz e t h e
le v e l of e m p loy e e e f f or t
I nt r od uct ion
opportunities 2 9
Conclusion
Refreshing your ICFR ICFR program
program can provide
additional benefits
W e k now of no r e a son t o e x p e ct t h a t t h e v e locit y of ch a ng e Control
w ill slow d ow n a ny t im e soon. N e w p la y e r s w ill e nt e r t h e evaluation Technology
m a r k e t w it h innov a t iv e id e a s t h a t w ill cont inue t o d isr up t
b usine ss m od e ls, r e q uir ing com p a nie s t o r e sp ond q uick ly
t o st a y com p e t it iv e . T e ch nolog y w ill cont inue t o r a p id ly
e v olv e , up e nd ing t h e w a y com p a nie s d o b usine ss a nd
Governance Tools and
m a k ing t h e m m or e v ulne r a b le t o “ b a d a ct or s” look ing
techniques
for ways to infiltrate their systems. The ease of global
com m unica t ion t h r oug h socia l a nd ot h e r m e d ia w ill
cont inue t o ch a lle ng e or g a niz a t ions t o st a y on t op of h ow
t h e y a r e p e r ce iv e d in t h e m a r k e t p la ce . A nd r e g ula t or s w ill
cont inue t o e v olv e t h e ir r e q uir e m e nt s a s t h e y st r iv e t o
p r ot e ct st a k e h old e r s.
R e - e v a lua t ing y our g ov e r na nce f r a m e w or k a nd I CF R

p r og r a m t o d e t e r m ine w h e t h e r t h e y h a v e k e p t up w it h
t h e ch a ng e s a nd m a k ing t h e ne ce ssa r y e nh a nce m e nt s f or
w h a t is k now n t od a y a r e a g ood st a r t . H ow e v e r , p r e p a r ing
f or f ut ur e ch a ng e s is not a one t im e e f f or t or a com p lia nce Three lines of defense
e x e r cise . R a t h e r , it is a n op p or t unit y t o t r a nsf or m y our
or g a niz a t ion’ s int e r na l cont r ol g ov e r na nce st r uct ur e
First line Second line Third line
a nd f r a m e w or k , r e sour ce m od e l a nd use of t e ch nolog y O p e r a t ions a nd M a na g e m e nt I nd e p e nd e nt
b usine ss unit s a ssur a nce a ssur a nce
to be more agile, efficient and effective. Additionally, it
is a n op p or t unit y t o cla r if y a nd r e inf or ce t h e r ole s a nd
r e sp onsib ilit ie s of t h e b usine ss, I T , int e r na l a ud it a nd
financial reporting functions to work together in harmony
to help the organization meet its strategic objectives and
What can you do today to enact change?
im p r ov e b usine ss p e r f or m a nce . • B e p r oa ct iv e a b out a d d r e ssing e m e r g ing t op ics w it h in • R e f r e sh a nd e nh a nce int e r na l cont r ol d ocum e nt a t ion
y our or g a niz a t ion • Evolve the nature, timing and extent of testing
• R e v isit y our g ov e r na nce st r uct ur e a nd op e r a t ing m od e l • U se t e ch nolog y m or e e x t e nsiv e ly a nd cr e a t iv e ly t o
f or int e r na l cont r ols become more efficient and effective
• Colla b or a t e w it h b usine ss a nd I T m a na g e m e nt on • Re-evaluate your staffing model and explore
st r e ng t h e ning t h e cont r ol e nv ir onm e nt a lt e r na t iv e s
I nt r od uct ion
opportunities 3 1
To find out more about how our Risk Advisory services could help EY | Assurance | Tax | Transactions | Advisory
your organization, speak to your local EY professional or a member
About EY
of our g lob a l t e a m , or g o t o e y . com / a d v isor y EY is a global leader in assurance, tax, transaction
O ur A m e r ica s R isk le a d e r s a r e : a nd a d v isor y se r v ice s. T h e insig h t s a nd q ua lit y
services we deliver help build trust and confidence
in t h e ca p it a l m a r k e t s a nd in e conom ie s t h e w or ld
ov e r . W e d e v e lop out st a nd ing le a d e r s w h o t e a m t o
Global Advisory Risk Leader d e liv e r on our p r om ise s t o a ll of our st a k e h old e r s.
I n so d oing , w e p la y a cr it ica l r ole in b uild ing a
A m y B r a ch io + 1 6 1 2 3 7 1 8 5 3 7 a m y . b r a ch io@ e y . com b e t t e r w or k ing w or ld f or our p e op le , f or our clie nt s
a nd f or our com m unit ie s.
Americas Advisory Internal Audit Leader About EY’s Advisory Services
In a world of unprecedented change, EY Advisory
L isa H a r t k op f + 1 3 1 2 8 7 9 2 2 2 6 lisa . h a r t k op f @ e y . com b e lie v e s a b e t t e r w or k ing w or ld m e a ns solv ing
b ig , com p le x ind ust r y issue s a nd ca p it a liz ing on
op p or t unit ie s t o h e lp d e liv e r out com e s t h a t g r ow ,
Americas Advisory Risk Assurance Leader op t im iz e a nd p r ot e ct clie nt s’ b usine sse s.
T h r oug h a colla b or a t iv e , ind ust r y - f ocuse d
J a m e s M a r t in + 1 2 1 6 5 8 3 3 0 0 4 [email protected] approach, EY Advisory combines a wealth of
consult ing ca p a b ilit ie s — st r a t e g y , cust om e r ,
Americas Advisory Region Risk Leaders finance, IT, supply chain, people and organizational
ch a ng e , p r og r a m m a na g e m e nt a nd r isk — w it h
a com p le t e und e r st a nd ing of a clie nt ’ s m ost
Central com p le x issue s a nd op p or t unit ie s, such a s d ig it a l
d isr up t ion, innov a t ion, a na ly t ics, cy b e r se cur it y ,
risk and transformation. EY Advisory’s high-
K e v in J a ne s + 1 3 1 2 8 7 9 5 4 0 0 [email protected] p e r f or m a nce t e a m s a lso d r a w on t h e b r e a d t h of
EY’s Assurance, Tax and Transaction Advisory
S e r v ice s p r of e ssiona ls, a s w e ll a s t h e or g a niz a t ion’ s
Northeast ind ust r y ce nt e r s of e x ce lle nce , t o h e lp clie nt s
d e liv e r sust a ina b le r e sult s.
M a r ce lo B a r t h olo + 1 2 1 5 4 4 8 2 6 3 8 m a r ce lo. b a r t h olo@ e y . com True to EY’s 150-year heritage in finance and
risk, EY Advisory thinks about risk management
w h e n w or k ing on p e r f or m a nce im p r ov e m e nt , a nd
Southeast p e r f or m a nce im p r ov e m e nt is t op of m ind w h e n
providing risk management services. EY Advisory
A J D e sa i + 1 7 0 4 3 3 1 1 9 8 3 [email protected] a lso inf use s a na ly t ics, cy b e r se cur it y a nd d ig it a l int o
e v e r y se r v ice of f e r ing .
Southwest T h e b e t t e r t h e q ue st ion. T h e b e t t e r t h e a nsw e r . T h e
b e t t e r t h e w or ld w or k s.
G e of f B e a t t y + 1 7 1 3 7 5 0 1 4 6 7 g e of f r e y . b e a t t y @ e y . com W it h 4 0 , 0 0 0 consult a nt s a nd ind ust r y p r of e ssiona ls
a cr oss m or e t h a n 1 5 0 count r ie s, w e w or k w it h y ou
t o h e lp a d d r e ss y our m ost com p le x ind ust r y issue s,
West from strategy to execution. To find out more about
h ow our R isk A d v isor y se r v ice s could h e lp y our
S cot t Coolid g e + 1 2 1 3 9 7 7 4 2 0 6 scot t . coolid g e @ e y . com organization, speak to your local EY professional
or a m e m b e r of our g lob a l t e a m , or v ie w e y . com /
a d v isor y
EY refers to the global organization, and may
refer to one or more, of the member firms of
Ernst & Young Global Limited, each of which is a
separate legal entity. Ernst & Young Global Limited,
a U K com p a ny lim it e d b y g ua r a nt e e , d oe s not
p r ov id e se r v ice s t o clie nt s. F or m or e inf or m a t ion
a b out our or g a niz a t ion, p le a se v isit e y . com .
Ernst & Young LLP is a client-serving member firm
of Ernst & Young Global Limited operating in the
U S .
© 2017 Ernst & Young LLP.
A ll R ig h t s R e se r v e d .
1 6 0 9 -2 0 7 0 3 5 6
SCORE No. 00594-171US.
ED None
T h is m a t e r ia l h a s b e e n p r e p a r e d f or g e ne r a l
inf or m a t iona l p ur p ose s only a nd is not int e nd e d
t o b e r e lie d up on a s a ccount ing , t a x or ot h e r
p r of e ssiona l a d v ice . P le a se r e f e r t o y our a d v isor s
for specific advice.
e y . com
3 2

Ey Are Your Internal Controls in Harmony With Your Business Unlocked

Uploaded by

Copyright:

Available Formats

Ey Are Your Internal Controls in Harmony With Your Business Unlocked

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ey Are Your Internal Controls in Harmony With Your Business Unlocked

Uploaded by

Copyright:

Available Formats

Are your internal

Conclusion 30 The pace of change has also affected organizations’ internal

So why then have many internal control programs not kept

Organizations have an opportunity to clarify or reinforce

Introduction Maturity model Enhancement Conclusion

Controls need to Rapidly changing business landscape

changing business op e r a t iona l a g ilit y , cost com p e t it iv e ne ss, st a k e h old e r

landscapes. D e sp it e a ll t h e se e f f or t s, m a ny com p a nie s, a s p a r t of t h e ir

Does your Integrated risk and control model

efficient integrated Establishing a governance structure through the use of a

risk and control

model? int e r na l cont r ol a ct iv it ie s t o e na b le e f f e ct iv e coor d ina t ion,

ICFR maturity assessment: Governance Technology

structure maximize a g ov e r na nce st r uct ur e t h a t m a p s a nd a ssig ns ow ne r sh ip

57% W h ile it m ig h t se e m lik e a n unim p or t a nt t a sk a f t e r 1 0 y e a r s

Are changes A s t h e r a t e of ch a ng e w it h in t h e b usine ss a nd r e g ula t or y

standards identified f or t e ch nica l a ccount ing int e r p r e t a t ion t o t h e ir e x t e r na l

business addressed on Securities and Exchange Commission (SEC), in addition

Questions to consider Benefits of taking action Timing

• H a v e y ou consid e r e d st r e a m lining t h e S O X S e ct ion • P r ov id e s m or e com p r e h e nsiv e

How do you Are

monitor the right scope review controls

What is the right scope? Who should monitor?

What is the right mix of controls? How do you monitor? Key

the completeness to be a common finding related to ICFR.

in your controls? IPE completeness and accuracy to give management

Questions to consider Benefits of taking action Timing

Questions to consider Benefits of taking action Timing

Why is the IPE utilized in the control?

Are your M a na g e m e nt e st im a t e s, includ ing t h e ir p r e cision, h a v e

enough to detect of t h e r e a sona b le ne ss of t h e a ssum p t ions und e r ly ing t h e

conduct an impact if there were segregation of duties (SOD) conflict violation

deficiency is identified? m a d e t o t h e sy st e m w h e r e t h e S O D v iola t ion occur r e d a nd

When deficiencies related to business processes or

Questions to consider Benefits of taking action Timing

How do W h e n I T a p p lica t ions use d t o p r oce ss t r a nsa ct ions t h a t a r e

implementations affect e na b le d b usine ss t r a nsf or m a t ions, I T se r v ice p r ov id e r

What can you O cca siona lly , a com p a ny m a y h a v e a t h ir d - p a r t y se r v ice

report is not available? includ ing I T a p p lica t ions, p olicie s a nd p r oce d ur e s a nd

Why is I n t od a y ’ s com p le x sy st e m la nd sca p e , se g r e g a t ion of d ut ie s

of duties a ticking time a d isg r unt le d e m p loy e e w it h e x ce ssiv e a cce ss r ig h t s m a y

Have you T h e r e is w id e sp r e a d r e cog nit ion t h a t a ut om a t ion f r e e s up

how data analytics can cont r ol t e st ing p r oce ss m a y h a v e a n e f f e ct on I CF R cost s.

help your organization and tools to more

assess risks more internal controls?

R e - e v a lua t ing y our g ov e r na nce f r a m e w or k a nd I CF R

You might also like