Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CPA] AUD: Auditing Internal Control: The COSO Framework
Transcript
- Marcus: Ava, let's talk about internal control. I know it's a huge topic on the AUD exam, but why does it matter so much? We hear about it in the context of massive corporate scandals, like Enron. Ava: That's exactly the right place to start, Marcus. Enron wasn't just a case of bad numbers; it was a catastrophic failure of the systems designed to protect those numbers. It was a failure of internal control, driven by a corrupt "tone at the top." That's why auditors don't just audit the final financial statements. We have to scrutinize the entire system behind them. Marcus: So we need a consistent way to evaluate that system. A common language. Ava: Precisely. And that language is the COSO framework. It’s the blueprint auditors use to evaluate whether a company's controls are designed properly and actually working. Marcus: So what is the official COSO definition of internal control? How do they frame it? Ava: COSO defines it as a process, put in place by the board, management, and staff, that's designed to provide reasonable assurance that the company will achieve its objectives. Marcus: "Reasonable assurance," not absolute. And it mentions objectives. What kind of objectives are we talking about? Ava: COSO breaks them down into three categories. The first is Operations. This is about the day-to-day effectiveness and efficiency of the business—hitting performance goals, running smoothly, and safeguarding assets from being lost or stolen. Marcus: Okay, running the business well. What's the second category? Ava: The second is Reporting. This covers all the company’s reports, both internal and external, financial and non-financial. The key here is that the reporting is reliable, timely, and transparent. Marcus: And the third? Ava: Compliance. This is pretty straightforward: is the company adhering to all the laws and regulations it's subject to? Marcus: So, Operations, Reporting, and Compliance. For a financial statement audit, is there one we care about more than the others? Ava: Absolutely. While they're all important to the company, the auditor's primary focus is squarely on the Reporting objective. Our job is to find material misstatements in the financial statements, so we're most concerned with controls that ensure the reporting is accurate. Marcus: That makes sense. So how does an auditor actually use the COSO framework to evaluate those controls? What's the structure? Ava: The framework is built on five integrated components. For the system to be effective, all five have to be present and functioning together. Marcus: And I bet there's a mnemonic for those five components. Ava: Of course. The one everyone uses is CRIME. C-R-I-M-E. Marcus: CRIME. Okay, let's walk through it. What does the 'C' stand for? Ava: 'C' is for Control Environment. This is the big one. It's the set of standards, processes, and structures for the entire organization. You’ll often hear it called the "tone at the top." Marcus: So it's about the company's culture? Does management actually demonstrate a commitment to integrity and ethical values? Ava: Exactly. Think of the Control Environment as the foundation of a house. If the foundation is cracked—if management doesn't value ethics, or the board isn't independent—it doesn't matter how strong the walls and the roof are. The whole structure is at risk. Marcus: A weak foundation compromises everything else. Got it. So after the 'C', we have 'R' in CRIME. Risk Assessment. Ava: Right. This is management's process for identifying and analyzing the risks that could prevent the company from achieving its objectives. It’s a forward-looking, continuous process. Marcus: So this is where management has to actively ask, "What could go wrong?" and "How bad could it be?" Does that include things like fraud? Ava: It has to. The framework specifically says management must consider the potential for fraud. They also need to identify and assess any big changes, like a new competitor or a new technology, that could impact their system of internal control. Marcus: Okay, so we have the environment, and we've assessed the risks. Let's talk about the specific actions a company takes. That would be the 'E' in our mnemonic, Existing Control Activities. Ava: Yes, 'E' is for Existing Control Activities. These are the specific policies and procedures that management puts in place to mitigate the risks they just identified. This is the real nuts-and-bolts, "doing" part of internal control. Marcus: Can you give me an example of a classic control activity? Ava: Segregation of duties is a perfect one. The person who authorizes a transaction shouldn't be the same person who records it, who also shouldn't be the person who has custody of the asset. You separate those roles to reduce the opportunity for fraud. Marcus: So one person can’t just write a check to themselves, record it as a valid expense, and then cash it. What's another common one? Ava: Authorizations and approvals. This ensures that transactions are valid. For example, a purchasing manager has to approve any purchase order over a certain amount. It’s a simple but powerful control. Marcus: Makes sense. So, we've covered C, R, and E. Now for the 'I' in CRIME. Information and Communication. Ava: This component is about making sure the right information is getting to the right people at the right time. Information is what the entity needs to carry out its control responsibilities, and communication is the process of sharing it. Marcus: So it’s not enough to have good controls; people need to be told about them, and the data flowing through the systems needs to be high-quality and relevant. Ava: You've got it. Think of it as the company's nervous system. It includes everything from policy manuals and training for employees inside the company, to the financial statements we provide to investors outside the company. If the communication breaks down, the controls can't function. Marcus: Okay, that leaves the last letter, 'M'. Monitoring Activities. Ava: Monitoring is the process of checking up on the whole system. It’s how management and the board determine if all five components of internal control are present and functioning over time. Marcus: So this is stepping back and asking, "Are our controls, which we designed and implemented, actually working as intended?" Ava: Precisely. This can be done through ongoing evaluations—like a supervisor reviewing reports as part of their normal duties—or through separate evaluations, like a formal review by the internal audit department. The key is that deficiencies are found and communicated to someone who can fix them. Marcus: This framework is really logical. Could we apply it to a practical example? Maybe walk through how we'd use CRIME in an audit? Ava: Absolutely. Let's take the Beacon Lighting scenario. We're auditing their revenue cycle. First, we start with 'C', the Control Environment. Marcus: Okay, what do we find at Beacon? Ava: We interview management and review their code of conduct. We discover that they put a huge emphasis on hitting aggressive sales targets, and the sales team's compensation is heavily tied to receivables, even if they haven't been collected. Marcus: That sounds like a weak "tone at the top." It creates a lot of pressure to book revenue, maybe even prematurely, just to hit a bonus number. Ava: Exactly. It's a red flag in the Control Environment. Now, let's look at 'R', Risk Assessment. We ask management how they identify risks related to revenue. They tell us they review sales contracts quarterly, but they have no formal process to assess fraud risk or to track changes in their customers' ability to pay. Marcus: So they aren't proactively looking for trouble. They’re being reactive, not proactive. That’s a deficiency in their risk assessment. Ava: Correct. Now for 'E', Existing Control Activities. Here, Beacon actually looks pretty good on paper. They have proper segregation of duties between sales, shipping, and billing. They require credit department approval for new customers. They do monthly reconciliations. Marcus: So they have some of the right procedures in place. We’d test a sample of those to make sure they're actually being followed. Ava: We would. But then we move to 'I', Information and Communication. We find that the sales team is negotiating non-standard payment terms to close deals, but those special terms aren't being consistently communicated to the accounting department. Marcus: Ah, so accounting might be booking the full revenue right away, when the special terms say payment isn't due for a year. That could be a material misstatement. A clear communication breakdown. Ava: A classic one. And finally, we look at 'M', Monitoring. We find out their internal audit department actually identified that communication gap last year. Marcus: That's a good thing, right? That's monitoring in action. Ava: It is, except when we ask management what they did about it, we learn they haven't taken any corrective action. The problem still exists. This tells us their process for evaluating and communicating deficiencies isn't working. They find problems but don't fix them. Marcus: So when you put it all together, even though they have some decent control activities, the weaknesses in the environment, risk assessment, communication, and monitoring create a really high risk of material misstatement in revenue. Ava: That would be our conclusion. It shows how all five components have to work together. Marcus: I think I'm following, but I could see one area of confusion. Distinguishing between a Control Activity and a Monitoring Activity. They both sound like they involve "checking" something. Ava: That is the most common pitfall. The key is to ask about the purpose and timing of the activity. A Control Activity is designed to prevent or detect misstatements in the normal course of business. A Monitoring Activity is designed to assess whether those controls are working effectively over time. Marcus: Okay, give me an example. Ava: A manager performs a bank reconciliation every month. Is that a control or monitoring? Marcus: That's a routine procedure to find errors, like an unrecorded check or a deposit that didn't clear. It's happening in the normal course of things. I'd say it's a Control Activity. Ava: Perfect. Now, what if the controller reviews a sample of five completed bank reconciliations each quarter to make sure the managers are doing them correctly and on time? Marcus: Ah, the controller isn't re-doing the work. She's checking the quality of the control itself. That's taking a step back to see if the system is working. That's Monitoring. Ava: You've got it. The first is doing the task. The second is reviewing the effectiveness of the task. That distinction is critical. Marcus: That's a very clear way to put it. Do you have a final tip for how to think about this on exam day, when you're looking at a scenario and have to pick which component is deficient? Ava: The best way is to ask yourself: what is the root cause of the failure? If the problem is about ethics, attitude, or a lazy board of directors, the root cause is the Control Environment. If it's about failing to identify a potential problem before it happens, that's Risk Assessment. Marcus: And if a specific procedure is just missing or broken, that's a failure of Control Activities. If it's about bad data or people not being told what they need to know, it's Information and Communication. Ava: And finally, if the problem is a failure to check up on the system or to fix known issues, that's a breakdown in Monitoring. Focusing on the root cause will almost always lead you to the right component. Marcus: That's a fantastic mental checklist. It helps connect the theory directly to the kinds of practice questions we'll face. Ava: It does. And getting comfortable with that application is all about practice. That’s why VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. You can try it for free to see how these concepts play out in different scenarios. Marcus: Listeners can get started at Vora Prep dot com. Ava: So, to bring it all home: The COSO framework is our guide, with its three objectives—Operations, Reporting, and Compliance—and its five integrated components, which we remember with the mnemonic CRIME. Marcus: Control Environment, Risk Assessment, Information and Communication, Monitoring, and Existing Control Activities. And understanding the *purpose* of each is the key to diagnosing a weakness in any scenario. Ava: Well said, Marcus. Thanks everyone for joining us for Office Hours. Marcus: We'll see you next time.