coso内部控制模型说明

coso内部操纵模型

The COSO Internal Control Model

The COSO internal control framework was first introd uced in 1992, and in 1994 a comprehensive four-section report on internal controls was issued, consisting of a n executive summary, a framework, guidance to public co mpanies on reporting on internal controls to third part ies, and evaluation tools to help a company comprehensi vely assess its current control environment.

The COSO framework is relevant to achieving company objectives in three areas:

Operational goals: The framework relates to the effe ctive and efficient usage of all of a company's resourc es.

Financial reporting goals: The construct gives guida nce on the consistent production of reliable financial reports.

Compliance goals: The guidance creates a topology of the company’s compliance requirements as they relate to industry regulations or legal requirements for publi c entities.

coso内部操纵框架提出三大目标，即运营的效率和效果,财务报告的可靠性,以及遵守适用的法律和规章

五大要素

1。操纵环境

Control Environment

This element is the foundation of the COSO framework. It sets the overall tone of the organization with rega rd to the importance of internal controls. Ethical valu es, leadership resource allocation, staff competence at all levels, the dynamics of authority and responsibili ty within the organization, and management philosophy a re all parts of this critical component.

In a sense, the control environment is the most diff icult component to quantify, because much of it relates to the overall culture of the organization. But there are a number of clear goals that an organization can wo rk toward to ensure that the framework rests on a found ation exemplifying market leadership.

Board and leadership involvement is the most crucial element in an organization seeking market leadership. As the board and leadership set expectations and measur

e progress against them, business units or department h eads begin to assign internal controls the priority the y require. The specific strategies that can be employed to move to a market-leader position within an industry include the following:

?Conveying the importance of ethical values道德价值by setting an example and “walking the talk.” This i ncludes relating stories of integrity and ethical value s through presentations, newsletter stories, and any ot her means of getting the message to everyone that these values are important to the organization. Public compa nies are now required to have a code of conduct for the board under the requirements laid out by SOX. Nonprofi ts and private companies can also benefit from a code o f conduct. The organization cannot tolerate violations of this standard. There are financial benefits to this approach as well. One research study performed by the I nstitute of Business Ethics (“Does Business Ethics Pa

y?,” April 2003) f ound that companies displaying a cle ar commitment to ethical conduct consistently outperfor m companies that do not display ethical conduct.

?Developing clear organizational guidelines relatin g to responsibility and authority with accountability c hecks is another clear hallmark of an market leader. Wi thin the organization, leadership typically follows a d istributed model, with individuals understanding the ov erall organizational goals and how the goals of their d epartment or business unit relate to them. Individuals should also understand their responsibilities and the l imit of their authority to ensure that the goals of the organization are achieved. When a leadership culture l ike this is achieved, the whole organization is focused on organizational objectives and committed to the main tenance of the control structure. A guiding coalition o f leadership members believing in the need for change i s one of the first steps typically taken by organizatio

ns that successfully make culture shifts, but changes w ill take effect slowly and steadily over time.

?Embedding the internal control framework within th e organizational culture将内部操纵框架融入企业文化. Man agement must clearly define roles and responsibilities for internal controls, including responsibility for the defining, documenting, testing, and monitoring of cont rols and the remediating of problems. The organization must incorporate these responsibilities into the respon sible individuals’ performance management goals.

?The internal controls environment is no longer vie wed as separate from the operating component of the bus iness; controls are embedded in processes from the begi nning. 内部操纵环境不再独立于企业经营要素，要从一开始就执行This approach lowers the risk of inadequate control s and ensures that the control structure is in place fr om the outse t of a process’s planning and launch.

?Supporting human resources policies and practices that provide clear corporate career paths. Human resour

ces management plays a key role in ensuring that indivi duals are hired with the needed financial competencies and that career growth supports an increased level of f inancial reporting competencies.对人力资源/人才的要求2。风险评估

Risk Assessment

Leading companies take a risk-based approach to SOX internal controls compliance as a key step in achieving a correct balance between costs and benefits. Recent g uidance from the Public Company Accounting Oversight Bo ard (PCAOB) supports this approach with specific recomm endations, including the use of a risk-based method to determine which key controls are tested each year. The PCAOB als o recommends that the viability of a company’s business model is an important consideration when eval uating risks. Companies that focus on these larger prob

lems and risks will better meet the needs of all their stakeholders, including investors and analysts.

Market leaders with respect to internal controls exp and the risk focus started under internal compliance ef forts to a broader venue. One popular concept that ofte n precedes a mature enterprise risk management initiati ve is the formation of a risk council. This council is generally composed of management representatives from d ifferent areas of the business. Some of the early objec tives of risk council meetings are as follows: Use of a common terminology for risk discussions thr oughout the organization;

Definition of a risk framework or structure for fost ering risk management across the organization;

Characterization of the organization’s current risk capability as well as risk and performance indicators;

Identification of the company’s current spending on risk; and

Formulation of a plan to mitigate the operational ri sks of the organization.

If they do not already have a risk program, some com panies take the risk management process even further wi th a more formalized, enterprise-wide program headed by a chief risk officer. Under this approach, the organiz ation embeds risk identification and mitigation into it s culture in the same way it adopted its internal contr ol framework. The goal is to intertwine risk and busine ss strategy with other organizational systems such as p erformance management.

Another important aspect to risk assessment is conti nuous monitoring of the internal and external environme nt in which the entity operates. This periodic scan of the operational environment can highlight upcoming even

ts affecting both internal controls and risk strategy. Events such as systems change, mergers and acquisitions, loss of key personnel, and other events may require a closer look at existing controls and risk management 操纵活动

Control Activities

Market leadership in the actual design of controls r equires corporate-wide coordination and the involvement of ownership. Policies are set enterprise-wide, allowi ng an efficient implementation while avoiding duplicate efforts and definitions. Control design workshops or t raining can raise the knowledge and capability of manag ement and staff to deal with defining, documenting, man aging, testing, and reporting on internal controls. Glo bal organizations have recently begun to roll these ses sions out through online training sessions for foreign registrant compliance with SOX section 404. These modul