practices and fraud.

When management formally

CHAPTER5 communicates its principles and values, it will
influence the organizational culture and permeate
CONTROLFRAMEWORK
the entire organization.
, a commission was established to Organizational culture is the collection of learned
address fraudulent acts in financial statements. beliefs, traditions, and guides for behavior shared
among members of the organization.
The National Commission on Fraudulent
Financial Reporting, chaired by James C.
Treadway, identified the lack of a comprehensive
internal controls framework.

was formed .
in 1985 to sponsor the commission.

COSO goal was to improve financial reporting

quality through corporate governance, ethical
.
practices, and internal control, with a focus on
Ethics is also closely linked to quality, as
ERM and fraud deterrence.
evidenced in the Volkswagen emissions
violations scandal. An auditor who fails to meet
The 2013 COSO IC-IF contains 17 principles,
accounting standards can cause great damage
stating that an entity can achieve effective
to the firm and the client, as observed in the
internal control by applying all principles to
operations, reporting, and compliance objectives. Xerox and KPMG cases.

CONTROLENVIRONMENT
The control environment includes activities
The workplace environment refers to the related to the competence and development of
structure, leadership style, and ethical practices personnel, the assignment of authority and
of an organization. It includes the tone at the top, responsibility, and the organizational structure.
which is set and promoted by the board of Employee reporting lines and accountability
directors and senior management. requirements are also shaped by reporting lines,
and these play an important role in the
This tone drives ethical conduct within the effectiveness of internal controls.
organization and helps prevent unethical
 Management establishes a risk management
philosophy and the entity's risk appetite, forms a
risk culture, and integrates ERM with related
initiatives. Many managers have come to realize Internal audits can be beneficial by
that the control environment is critical to the partnering with Human Resources, Legal, IT, and
overall corporate image. Loss Prevention to teach employees about
internal audits in other settings.

Form over Substance

Talking about and acting ethically carries The control environment is crucial for an
financial benefits. organization's success, ensuring integrity, ethical
values, independence from management, and a
commitment to attracting, developing, and
retaining competent individuals.

The board of directors plays a vital role in

maintaining internal control quality, setting
expectations, and ensuring smooth information
flow.

The organization should also demonstrate a

commitment to attracting, developing, and
retaining competent individuals, ensuring their
Understanding and addressing unethical behavior selection, safeguarding, and proper deployment.
is essential for auditors to ensure the integrity By addressing these issues, organizations can
and fairness of the organization. Examples of ensure their objectives are met, mitigate risks,
unethical behavior include an unreasonable and increase the likelihood of achieving them.
emphasis on bottom-line performance,
high-pressure sales tactics, kickbacks or bribes, Entity Level Controls

and the failure to comply with laws and

Entity level controls are essential in assessing an
regulations.
organization's values, systems, policies, and
Communication, Consistency, and Belief in the processes to prevent fraud and encourage proper
Message conduct.

,
as inconsistencies can lead to employees
viewing management as hypocritical. A code of
ethics, code of conduct, and conflict of interest Key areas of
statement are essential for establishing ethical focus include controls over management override,
conduct. These documents guide employees in risk assessment methodology, centralized
ethical decision-making, motivating them to processing, monitoring results of operations, and
conduct themselves ethically. Training should be financial and operational reporting. Internal
provided upon hire and annually to reinforce the auditors and business leaders can identify
importance of these topics. strengths and weaknesses in their entity level
controls by examining factors such as the
organization's code of conduct, disciplinary Larry Rittenberg, COSO's Chair Emeritus,
action, organizational structure, documentation, emphasizes the importance of understanding the
compliance requirements, data and information link between objectives, risks, and controls.
availability, and coordination within the
organization's second and third lines of defense. If objectives are not articulated, a deficiency in
the control environment should be brought to the
Internal auditors must understand that behavior attention of senior management and the board.
is influenced by their environment and competing Focusing more on control activities cannot
forces, and must work with management to compensate for a breakdown between senior
establish clear performance standards, management and board oversight. Once
communicate rewards and sanctions, and ensure identified, risks should be linked throughout the
effective employee management. Organizations organization, providing a chaining mechanism to
should create a positive environment through trace risks up and down the organization.
socialization, education, formal/informal systems,
and reinforcement, but should not tolerate Risk assessment is a crucial process for
unethical behavior. organizations to identify, analyze, and respond to
potential risks related to their objectives.
Tone in the Middle

Choosing the right managers is crucial as

employees judge an organization's ethical .
conduct based on their boss's actions. Managers
influence workplace dynamics, values, and Management specifies objectives within three
customer satisfaction. categories: reporting, compliance, and operations.

The "tone in the middle" dictates workplace Reporting considerations are arranged in four
conditions, leading to satisfaction, turnover, broad categories: internal/external and
profits, and goal achievement. financial/nonfinancial.

Compliance requirements relate to adherence to

laws and regulations, including contractual terms
and conditions, service level agreements, and
voluntary agreements.
RISKASSESSMENT
Operations pertain to the effectiveness and
efficiency of the organization's operations,
The COSO framework focuses on identifying,
including operational and financial performance
quantifying, analyzing, and managing
goals, safeguarding assets against loss, damage
organizational risks.
or obsolescence, and making sure resources are
Risks are events that can threaten an obtained economically.
organization's ability to achieve its
Management must consider, specify, and analyze
objectives.
the degree to which objectives are aligned with
their strategic priorities to ensure congruence
Risks are assessed based on
and coordination between these objectives.
likelihood and impact. Before risk assessment, it
is crucial to

Examples include an
employee's objectives focused on cost reduction, personnel that threatens the ability to achieve
a sales department's performance measured on business objectives.
sales volume, and a manufacturing manager's
goals weighted heavily on lowering unit costs. Product or service failure risk involves the failure
of products or services to meet customer
Lack of alignment with established laws, rules, expectations, leading to customer complaints,
regulations, and standards can lead to trouble warranty claims, returns, field repairs, product
and long-term consequences. Large-scale liability claims, litigation, lost revenues, lower
problems often invite regulator involvement and market share, and damage to the business's
media attention, which can become distracting reputation.
and expensive over time. Any discussion about
risk must consider that every entity faces a Product development risk involves ineffective
variety of risks from internal to external sources. product development that threatens the
organization's ability to meet or exceed customer
expectations consistently over the long term.

Business and Process Risk Cycle time risk is the unnecessary activities that
threaten the organization's capacity to develop,
The risk management process of an organization produce, market, and deliver goods and services
involves various risks, including capacity, in a timely manner.
execution, supply chain, business interruption,
human resources, product or service failure, Health and safety risk involves the failure to
product development risk, cycle time risk, health provide a safe working environment for workers
and safety risk, leadership risk, outsourcing risk,
competitor risk, catastrophic loss risk, industry Outsourcing risk involves outsourcing activities
risk, planning risk, organization structure risk, that do not align with the organization's
integrity and fraud risk, reputation risk, data strategies, objectives, values, and behavioral
integrity, infrastructure risk, commerce risk, standards and expectations.
access risk, and availability risk.
Technological and Information Technology

Capacity risk refers to the inability to meet Risks

demand in the short and long term

Execution risk involves the inability to produce

consistently without compromising quality.

Supply chain risk refers to the inability to These risks include data and system availability
maintain a steady stream of supplies when risk, data integrity risk, system capacity risk, data
needed. integrity, infrastructure risk, commerce risk,
access risk, and availability risk.
Business interruption risk stems from the
unavailability of raw materials, IT, skilled labor, Data and system availability risk involves the
facilities, or other resources that threaten the uptime of systems and tools to support the needs
organization's ability to continue operations. of workers, customers, suppliers, and
stakeholders.
Human resources risk refers to the lack of
knowledge, skills, and experiences among key
Data integrity risk involves the accuracy and Political risks involve the effects that political
consistency of data stored, processed, retrieved, decisions, events, or conditions can cause when
and destroyed. they affect the profitability of a business or the
ability to operate freely. Examples include
System capacity risk involves optimizing storage regulations and legislation risk, public policy risk,
and computing capabilities. and instability risk.

Infrastructure risk refers to the outdated or lack Social risks involve dynamics where an issue
of IT infrastructure needed to support information affects stakeholders who can form negative
requirements. perceptions that can cause damage to the
organization. Examples of social risks include
Commerce risk involves events that compromise
demographics risk, privacy risk, CSR
financial and data flows.
requirements, and mobility.
Access risk involves unauthorized use of
Risk assessment requires management to
confidential information or limited personnel
consider the impact of possible changes in the
performance.
external environment and within their own
Availability risk threatens the continuity of business model that could make internal control
operations and processes. ineffective. This includes clearly articulating
objectives relating to operations, reporting, and
compliance so any risks to those objectives can
be identified and assessed.
are conditions that limit an
organization's ability to obtain, deploy, and retain Effectiveness relates to the achievement of
suitable numbers of qualified and motivated objectives and the degree to which these are
workers. achieved.

These risks include availability risk, competence Identifying business goals is essential for internal
risk, judgment risk, malfeasance risk, motivation auditors, as it involves obtaining these from
risk, financial risks, environmental risks, political process owners during the planning phase.
risks, social risks, and political risks.
The IIA Standards state that internal auditors
These risks can result in poor cash flows, must consider the objectives of the activity being
currency and interest rate fluctuations, and an reviewed, the means by which the activity
inability to move funds quickly and without loss controls its performance, and the significant risks
of value. Examples of financial risks include to the activity, its objectives, resources, and
resources risk, commodity prices risk, foreign operations. If goals have been defined but are
currency risk, liquidity risk, market risk, and inadequate, internal auditors should engage
political risks. management to develop improvements.

Environmental risks involve the actual or The SMARTER model

potential threat of negative effects on the
environment by emissions, wastes, and resource
depletion. Examples include energy and other
resources risk, natural disaster risk, pollution risk, It helps to remember the elements of
transportation risk, and pandemic risk. well-developed goals, which are specific,
measurable, achievable, relevant, time-bound, and
evaluated. Specific goals make it easier for
managers and employees to focus their energy, into them, showing how the work satisfies the
resources, and priorities on accomplishing them. needs of organizational stakeholders.
Measurable goals are easier to link their
completion to performance monitoring and Millennials are idealistic and want to understand
rewards mechanisms, as they help to measure the big picture, so managers should reward the
the degree of success accomplishing the related successful completion of tasks and the effort put
goal. into them. Internal auditors should link audit tests
to business objectives, linking everything they do
Achievable goals are more motivating and to a risk, which in turn is linked to a business
aligned with the mission and strategy of the objective. This helps mitigate the potential
organization, the process, and the individual. likelihood and impact of these risks.
They build confidence and serve to motivate
those involved to pursue something great. Goals Internal auditors should examine the functioning
should have milestones and checkpoints that of programs and processes to ensure that the
allow the person responsible for their completion design and performance of these activities are as
to witness progress. Relevant goals should be expected and make recommendations for
aligned with the organization's mission and improvement. Anomalies detected during audit
strategy, and should be relevant to the testing should be presented in that context, as
employee's career or job description. they allow risks to materialize, which jeopardize
the successful accomplishment of a particular
Time-bound goals require commitment from both objective.
the individual and the person overseeing the goal.
Goals should precipitate a plan to accomplish the The topic of fraud and corruption has gained
goal, creating a sense of urgency and time attention over the past few years, with alarming
pressure. The combination of goals, plans, and statistics about fraud. The IIA's Standards include
deadlines brings out the talents in people and specific reference to fraud, emphasizing the
can be leveraged among all involved. importance of internal auditors having sufficient
knowledge to evaluate the risk of fraud and how
Goals must be evaluated to determine if they it can be committed. Areas of focus related to
meet the SMARTER elements and if they meet fraud include material omission or misstatement
ethical and ecological considerations. Unethical of reporting, inadequate safeguarding of assets,
actions justified by the manager or others are and corruption.
commonplace in some locales, and ignoring the
environmental impact of business actions is also Assessing risk on a formal and informal basis is
unfortunate and is increasingly shown essential for organizational success, and internal
disapproval by stakeholders. By using the auditors can help raise awareness by highlighting
SMARTER model, internal auditors can help some exposures.
managers perceive the value of their work and
improve overall performance.
External
factors like demographic shifts, technological
advances, and low interest rates can help achieve
business objectives. The Millennial generation,
Rewards should be commensurate who are comfortable with technology and adapt
with the effort put into the task and the outcome to change, can be a valuable asset.
achieved. Managers should also reward the Technological advances like cloud computing
successful completion of tasks and the effort put
and broadband enable remote work, reducing Internal auditors are generally tasked with
costs, and generating revenues. verifying that processes, programs, and their
related controls have been designed
ControlActivities appropriately and that those controls are
operating as intended.
Controls are actions established through policies
and procedures to mitigate the likelihood and/or
impact of risks. They are performed at all levels Ensuring that controls are
of an organization, at various stages within designed effectively and implemented effectively
processes and over the technological is crucial for maintaining organizational
infrastructure. Controls can be manual, effectiveness.
performed by individuals using tangible items, or
automated, performed by computer and Information and Communication
electronic systems without direct human
interaction. Some controls are a combination of The fourth component of the COSO IC/IF model
manual and automated, requiring both a system focuses on the flow of information within an
component and human follow-through. organization. It involves clear, consistent, timely,
and purposeful directions from the top, feedback
The rate of dependence on IT has increased from employees, and lateral flows of information
substantially over the past few decades, and between individuals and units. Communication is
most activities involve the use of computers to crucial for effective functioning, decision-making,
some degree or another. Organizations often problem-solving, and change-management
struggle with the lack of consistency in the processes. It provides workers with important
performance of control activities due to the information about their jobs, the organization,
implementation process not aligning with and each other, improving motivation, building
performance evaluation measures, supervision, trust, and engendering engagement. Internal
training, disciplinary actions, and rewards. communication occurs on multiple levels,
including interpersonal, group-level, and
Control activities can be categorized as organizational-level. Information is necessary for
preventive, detective, directive, and internal control activities, such as reconciliations,
compensating. inventory counts, and inventory counts.
Communication should be continuous, iterative,
Preventive controls act before errors or
and share necessary information to maximize its
omissions can occur and reduce the likelihood
utility. Internal and external communications can
and/or impact of the event.
follow various patterns, and organizations should
Detective controls identify errors or anomalies support management efforts to increase the
after they have occurred and alert the need for production, analysis, dissemination, and use of
corrective action. information for better decision-making and
organizational effectiveness. The free flow of
Directive controls are temporary controls information is essential for understanding new or
implemented to redirect employee actions, changed events in the operating environment and
sometimes referred to as corrective controls, preventing management from operating in a
when an undesirable action has occurred. vacuum.

Compensating controls are put in place when a Organizations face increasing risks and
control is not where it is expected as proper modifications to their internal control systems
design would stipulate.
due to changing business dynamics. Outsourced Monitoring activities are ongoing evaluations
service providers, financial institutions, and used to assess the functioning of internal control
intermediaries provide diverse and complex components. These evaluations can be cyclical
information sources, which can disrupt or ongoing, depending on the risk assessment
operations and reduce revenues. Social media and previous evaluations. The criteria used
has become an essential part of organizations' during these reviews are based on internal
communications infrastructure, connecting requirements and external criteria. Monitoring
employees, customers, vendors, supporters, and should be viewed holistically, considering other
detractors. As data flows expand beyond pairs components such as the control environment,
and involve intermediaries, organizations must risk assessment, and information and
ensure the compatibility, quality, speed, and communication. Employee surveys can help
reliability of all information. assess the state of ethics, risk assessment, and
information and communication. Monitoring
Outsourcing can create operational risks, helps management understand how all
strategic risks, and composite risks. Outsourcing components of internal control are being applied
organizations must manage these risks and and enhances organizational effectiveness.
ensure clients are protected and financial
statements are correct. To ensure acceptable risk IT plays a crucial role in organizational success,
levels, organizations can have their own internal and organizations should consider IT as a
or external auditor review the service provider or business service partner rather than just a
provide reports to clients. Organizations also back-end support unit. The Information Systems
have numerous third-party intermediaries that Audit and Control Association (ISACA) has
play a crucial role in their business operations addressed the gap in IT considerations through
and interactions with governments. Companies the COBIT framework, which includes strategic
must conduct due diligence and investigate their direction, project management, purchases, and
third parties before contracting them, training end users. The COBIT framework
understanding their roles, responsibilities, and addresses more than technical subjects and
potential risks. includes critical managerial and
accounting/financial activities.
The hiring organization must manage third-party
monitoring and use technology to assist in this ISO, an independent nongovernmental
process. Service providers can provide organization, provides world-class specifications
standardized audit reports for customers to use for products, services, and systems to ensure
in risk assessment. The Statement on Standards quality, safety, and efficiency. It has published
for Attestation Engagements (SSAE) No. 16, over 19,000 international standards and related
Reporting on Controls at a Service Organization, documents, covering various industries. ISO 9000
replaced SAS 70 in 2010. There are three types of and ISO 31000 are popular standards for quality
SOC reports: SOC 1 (Report on Controls at a management and risk management, providing
Service Organization Relevant to User Entities' guidance and tools for organizations to ensure
Internal Control over Financial Reporting), SOC 2 consistent meeting of customer requirements
(Report on Controls at a Service Organization and continuous improvement.
Relevant to Security, Availability, Processing
Integrity, Confidentiality, or Privacy), and SOC 3 ISO also facilitates communication and the
(Trust Services Report for Service Organizations). setting of expectations between organizations,
complementing COSO's components and helping
Monitoring Activities internal auditors supplement their audit programs.
 By understanding and implementing these
standards, organizations can ensure their IT
operations align with their business needs and CHAPTER 6
achieve long-term success.
Histograms

ITIL is a comprehensive framework for IT service

are charts that display the frequency distribution
management that focuses on organizational
of numerical data using rectangles representing
structure, skill requirements, and standard
intervals. They represent the probability
management procedures. It provides templates,
distribution of a continuous variable and are used
checklists, and downloads for quick
to assess the distribution of data. Histograms
implementation and helps organizations achieve
provide a fluid view of transactions, helping
predictable service levels. ITIL v3 was published
auditors understand the dynamics affecting the
in 2007 and updated in 2011. It addresses
process under review. They can be used to plot
service strategy, design, transition, operation,
sales revenues, vehicle serviced, and more,
event and incident management, request
providing a more comprehensive understanding
fulfillment, and continual service improvement.
of the data.
Successful companies that have implemented
ITIL include Procter & Gamble, Caterpillar, Control Chart
Nationwide Insurance, and Capital One. Key goals
include streamlining service delivery, developing Process owners are responsible for setting the
repeatable procedures, reducing service incidents, structure of their processes and programs,
implementing standards, ensuring future establishing goals, identifying risks, and
capacity, defining clear service targets, and designing controls to mitigate them. Monitoring
accurately allocating costs. these controls provides valuable information
about their strengths and weaknesses, and helps
The CMMI is a process improvement appraisal management identify anomalies that require
program developed by Carnegie Mellon University, intervention. Control charts are a tool used to
used in various areas such as project document this monitoring, plotting and studying
management, software development, and how a process changes over time. They are one
performance improvement. It has five maturity of the seven basic tools of quality and are often
levels: Initial, Repeatable, Defined, Managed, and less used by internal auditors. Control charts help
Optimized. Internal control frameworks, such as auditors determine if a process is stable and
COSO and COBIT, are used for planning, analysis, under control, predict future performance, and
decision-making, and monitoring. Planning is a identify the source of problems. By setting upper
crucial aspect of classical management, and lower control limits and observing patterns,
involving formulating detailed plans to achieve internal auditors can increase the sophistication
the optimum balance between needs and of their data analytics and support their findings
resources. COSO and COBIT frameworks provide with measurable data.
guidance and a roadmap for organizations to
structure and run effectively. Managers should be The Pareto principle, also known as the 80/20
taught about these frameworks and have their rule, suggests that 80% of events' effects are
performance measured based on the quality of caused by 20% of their causes. Pareto diagrams
internal controls in their areas of responsibility. organize data and prioritize improvement efforts
This would reinforce the importance of internal by focusing on major root causes. They organize
controls and reduce compensation for data by constructing bars and ranking items in
non-performance. importance.
FISH BONE A force field analysis is a tool used to analyze the
influence of change on an organization. It
The fishbone diagram, also known as the cause involves writing driving forces that support the
and effect diagram or Ishikawa diagram, is a change initiative, such as lower costs, faster
useful tool for internal auditors to identify the root speed, and increased customer satisfaction, and
causes of problems. This method, which is binary restraining forces that prevent it. Factors such as
in nature, helps auditors treat issues from a implementation costs, complexity, and conflicting
binary perspective, focusing on what should have priorities can be scored based on their influence.
been done, verifying consistency, reporting no The strategy employed can either strengthen the
findings, and recommending future practices. support forces or manage the opposing forces.
However, when dealing with operational issues,
the answer may not be straightforward. Many Force Field Analysis is a useful tool for auditors
operational issues are caused by a combination to understand client priorities, challenges, and
of people, process, and technology issues, so concerns. It helps prepare arguments to address
auditors should attempt to identify the root objections, demonstrating understanding and
causes of these conditions. The six categories removing objections. This tool can be used as a
used are people, methods, machines, materials, visual aid during presentations, promoting
measurements, and environment. The diagram engagement and addressing misunderstandings.
can be categorized based on the type of
organization or environment being analyzed.
When preparing the fishbone diagram, it
Flowcharts are a useful tool for auditors to
becomes clearer why the problem exists and how
understand and analyze processes. They
a number of root causes impact multiple
represent workflows in visual form, allowing
categories. The top two or three items that have
auditors to identify defects such as bottlenecks,
the biggest influence on the effect are identified,
rework, delays, and underutilized personnel.
similar to the 80/20 rule. The fishbone diagram is
a useful tool for identifying root causes and
exploring solutions to problems. It aids in
problem-solving and can be used in conjunction
with the CCCER model for documenting internal
audit findings.

Flowcharts are diagrams that represent the

Internal auditors often face pushback from movement of documents from left to right, with
clients when recommending corrective actions, symbols such as rectangular boxes, diamonds,
which can be due to insufficient testing or arrows, and ellipses. They are typically horizontal
communication. Force field analysis can help and can be drawn top-down. Cross-functional
prevent this by identifying the forces for and flowcharts show the steps and actors performing
against a course of action, evaluating the pros activities, allowing auditors to identify
and cons of a decision, and understanding the responsibility and decision-making.
client's perspective. This tool can help resolve
conflict of opinions, compare pros and cons, and They can help identify
evaluate the strength and weaknesses of an idea, efficiencies, handoffs, and control points, making
product, or project. To use force field analysis, them easier to identify and understand.
write a T at the top of a piece of paper.
Microsoft Visio, SmartDraw, Flowcharter, Edraw, An As Is map is crucial for auditors to understand
and RF Flow are popular flowchart software the current process and identify the desired
packages. They offer user-friendly features like output or outcome.
automatic connection points, drag and drop, snap-
to tools, and grid lines. Flowcharting software . Automation can provide time and
also allows for customization, such as text font, labor savings, while simplifying tasks can
size, and color. While auditors may initially find it improve efficiency.
time-consuming, over time, the process becomes
faster and more accurate. Performance standards help shape priorities and
measure the success of the process. Outputs are
The As Is diagram is a tool used by auditors to measured in terms of volume, while outcomes
document the current state of a process, are measured in the short, medium, and long term.
including time, bottlenecks, production volume, Organizations should focus more on outcomes
and delays. It in the twenty-first century, focusing on customer
satisfaction, retention, and image. This approach
helps organizations improve their processes and
and lead to employee frustration. It also helps overall business performance.
auditors understand the context of the program
or process, identifying higher risk areas, and
ensuring transactions are completed promptly.
This helps in identifying potential issues and When reviewing processes, it is essential to
addressing them effectively. identify areas for improvement. Backlogs, which
are uncompleted work, can pose challenges
The As Is map is a useful tool for understanding when meeting deadlines or ensuring customer
and assessing the performance of a process. It satisfaction. Cycle time, the total time from the
helps identify anomalies and corrective measures, start to the end of a process, is a general
allowing internal auditors and management to expectation. It includes process time specific to
compare before and after results. To draw an each activity and waiting time between boxes.
effective As Is map, determine the boundaries of
the process, identify steps through consensus,
walk the process chronologically, use appropriate
symbols, test for completeness, look for problem
areas as a team, and show details.
Stop watches document the time it takes to
process various steps in a flowchart, while
systems data capture user ID, date, and time
every time a user accesses a transaction record.
Samples allow auditors to test financial and
compliance controls, checking for accuracy,
completeness, authorization, and
business-relatedness.