Executive's Guide to COSO Internal Controls

ROBERT R. MOELLER, CPA, CISA, CISSP, is an internal audit specialist and project manager with a strong understanding of information systems, corporate governance, and security. He has over twenty-five years of experience in internal auditing, ranging from launching new internal audit functions in several companies to serving as audit director for a Fortune 50 corporation. He held positions with Grant Thornton (National Director of Computer Auditing) and Sears Roebuck (Audit Director). He is the former president of the Institute of Internal Auditors' Chicago chapter and has served on the IIA's International Advanced Technology Committee. He is also the former chair of the AICPA's Computer Audit Subcommittee. Moeller has written six other books.

• Preface ixChapter 1: Importance of the COSO Internal Control Framework 1The Importance of Enterprise Internal Controls 2What Are Enterprise Internal Controls? 3Understanding the COSO Internal Control Framework: How to Use This Book 4Chapter 2: How We Got Here: Internal Control Background 5Early Definitions of Internal Controls: Foreign Corrupt Practices Act of 1977 7The FCPA and Internal Controls Today 8Events Leading Up to the Treadway Commission 9Earlier AICPA Auditing Standards: SAS Nos. 55 and 78 10The Treadway Committee Report 11The Original COSO Internal Control Framework 12The Sarbanes-Oxley Act and Internal Accounting Controls 15Notes 28Chapter 3: COSO Internal Controls: The New Revised Framework 29Understanding Internal Controls 30Revised Framework Business and Operating Environment Changes 32The Revised COSO Internal Control Framework 35COSO Internal Control Principles 37COSO Objectives and Business Operations 38Sources for More Information 40Chapter 4: COSO Internal Control Components: Control Environment 41Importance of the Control Environment 41Control Environment Principle 1: Integrity and Ethical Values 43Control Environment Principle 2: Role of the Board of Directors 48Control Environment Principle 3: The Need for Authority and Responsibility 49Control Environment Principle 4: Human Resource Strengths 51Control Environment Principle 5: Individual Internal Control Responsibilities 54COSO Control Environment in Perspective 56Chapter 5: COSO Internal Control Components: Risk Assessment 59Risk Assessment Component Principles 60Risk Identification and Analysis 62Risk Response Strategies 66Fraud Risk Analysis 69COSO Risk Assessment and the Revised Internal Control Framework 70Notes 71Chapter 6: COSO Internal Control Components: Control Activities 73COSO Control Activity Principles 74COSO Control Activities Today 85Chapter 7: COSO Internal Control Components: Information and Communication 87Information and Communications: What Has Changed? 87Information and Communication Principle 1: Use of Relevant Information 89Information and Communication Principle 2: Internal Communications 96Information and Communication Principle 3: External Communications 100The Importance of COSO Information and Communication 102Notes 103Chapter 8: COSO Internal Control Components: Monitoring Activities 105Importance of COSO Monitoring Internal Control Activities 106COSO Monitoring Principle 1: Conduct Ongoing and Separate Evaluations 108COSO Monitoring Principle 2: Evaluate and Communicate Deficiencies 112COSO Internal Control Monitoring in Perspective 115Note 115Chapter 9: COSO Internal Control GRC Operations Controls 117COSO Operations Objectives 117Planning and Budgeting Operations Controls 119IT Systems Operations Controls 123Operations Procedure Controls and Service Catalogs 133Importance of COSO Operations Controls 135Note 135Chapter 10: COSO Reporting Processes 137COSO Reporting Objectives 137COSO External Financial Reporting Controls 139COSO Internal Financial Reporting Controls 141COSO External Nonfinancial Reporting Controls 149COSO Internal Nonfinancial Reporting Controls 149Importance of COSO Reporting Controls 150Note 151Chapter 11: COSO Legal, Regulatory, and Compliance Objectives 153Importance of Enterprise Compliance Controls 153Regulatory Compliance Control Issues 155Internal Controls and Legal Issues 157Compliance with Professional and Other Standards 158Chapter 12: Internal Control Entity and Organizational GRC Relationships 161Internal Controls from an Organizational GRC Perspective 161Enterprise Governance Overall Concepts 163Business Entity–Level Internal Controls 167Divisional and Functional Unit Internal Controls 175Department- and Unit-Level Internal Controls 178Organization and GRC Controls in Perspective 179Note 179Chapter 13: COSO, Service Management, and Effective IT Controls 181Importance of IT General Controls 181IT Governance General Controls 183IT Management General Controls 184Client-Server and Smaller Systems General IT Controls 188ITIL Service Management Best Practices 191Service Delivery Best Practices 200Notes 201Chapter 14: Cloud Computing, Virtualization, and Wireless Networks 203Internal Controls for IT Wireless Networks 204Cloud Computing and COSO Internal Controls 208Storage Management Virtualization 214COSO Internal Controls and Newer Technologies 215Note 215Chapter 15: Another Framework: COSO ERM 217ERM Definitions and the ERM Portfolio View of Risk 218The COSO ERM Framework Model 222Other Dimensions of the ERM Framework 239COSO ERM and the Revised Internal Control Framework 240Notes 241Chapter 16: Understanding and Using COBIT 243An Executive’s Introduction to COBIT 244Using COBIT to Assess Enterprise Internal Controls 252Mapping COBIT to COSO Internal Controls 256Notes 257Chapter 17: ISO Internal Control and Risk Management Standards 259Background and Importance of ISO Standards in a Global Commerce World 259ISO Standards Overview 262ISO Standards and the COSO Internal Control Framework 269Notes 270Chapter 18: COSO Internal Controls in the Board Room 271Board Decisions and Internal Control Processes 272Board Organization and Governance Rules 275Corporate Charters and the Board Committee Structure 276The Audit Committee and Managing Internal Controls 279Board Member Internal Control Knowledge Requirements 281COSO Internal Controls and Corporate Governance 282Notes 283Chapter 19: Service Organization Control Reports and COSO Internal Controls 285Importance of Service Organization Internal Controls 286Early Steps to Gain Assurance: SAS 70 287Service Organization Control (SOC) Reports 288Right-to-Audit Clauses 290Internal Control Limitations 292Chapter 20: Implementing the Revised COSO Internal Control Framework 293Understanding What Is New in the 2013 Framework 293Transitioning to the New COSO Guidance 295Steps to Begin Implementing the New COSO Internal Control Framework 296Index 297