TABLE OF CONTENTS Internal control is the system and process that companies utilize to manage and run their operations and generate financial reports for internal and external purposes. People are an integral component in the design and operation of the control system that functions to manage and minimize risk, provide for effective and efficient operations, and ensure compliance with laws and regulations. Section 404 of the Sarbanes-Oxley Act focuses on internal control, and requires that management annually conduct an assessment of its controls as of the end of each fiscal year. The legislation put a spotlight on internal control, and the oversight board sanctioned the COSO Integrated Framework as being an acceptable framework for companies to follow in the design and evaluation of their control systems.
In Chapter 4, the COSO Enterprise Risk Management (ERM) Framework, which is the new enterprise risk management model that has been under study and recently released, was described. The discussion of the ERM Framework included only those objectives and components that dealt with managing and mitigating enterprise risk. The purpose in this chapter is to provide an overview of the original COSO Integrated Framework and set the stage for drilling into the components that relate to effective design and operation of internal control systems under the compliance legislation.
Internal control is a people-driven process that consists of processes and sub-processes that contain tasks and activities which provide the foundation for enterprise-wide value creation and containment of risk. Supporting the process is an evolution...
