For full functionality of this site it is necessary to enable JavaScript. Here are the instructions how to enable JavaScript in your web browser.

CPE for Government Auditors

The Most Important Change to the Yellow Book is the Green Book

I’ve had a few months to digest the changes to the 2018 Yellow Book (Government Auditing Standards),and I’ve taught a few seminars and webinars about the changes.  Most of the changes do not shock my audiences. But I am noticing that quite a few auditors are not familiar with the Green Book which was published by the GAO in 2014.  This is not good because the Green Book is by far the biggest change to the Yellow Book.

The Green Book is the GAO’s version of the COSO model, and its formal title is “Standards for Internal Control in the Federal Government.”

Here are some quotes from one of the performance audit chapters in the 2018 Yellow Book that give performance auditors pause. (Financial auditors please read the section below titled ‘Financial auditors should be pleased.’) I added bolding to draw your eye to some new terms that I’d like you to notice.

8.41 Consideration of internal control in a performance audit begins with determining the significance of internal control to the audit objectives and documenting that determination. Some factors that may be considered when determining the significance of internal control to the audit objectives include

a.the subject matter under audit, such as the program or program component under audit, including the audited entity’s objectives for the program and associated inherent risks;

b.the nature of findings and conclusions expected to be reported, based on the needs and interests of audit report users;

c. the three categories ofentity objectives (operations, reporting, and compliance); and

d. the five components of internal control (control environment, risk assessment, control activities, information and communication, and monitoring) and the integration of the components.

8.42 If internal control is significant to the audit objectives, auditors determine which of the five components of internal control and underlying principles are significant to the audit objectives, as all components of internal control are generally relevant, but not all components may be significant to the audit objectives. This determination can also identify whether specific controls are significant to the audit objectives. Determining which internal control components and principles and/or specific controls are significant to the audit objectives is a matter of professional judgment.

8.47 Approaches for obtaining an understanding of internal control may vary and may include consideration of entity-level controls, transaction- level controls, or both. However, even when assessing only transaction- level controls, it may be beneficial to gain an understanding of entity-level controls that may affect transaction-level controls by obtaining a broad understanding of the five components of internal control at the entity level. This involves considering the relationships between the components, which work together in an integrated manner in an effective internal control system, and the principles of internal control that support each component. In addition to obtaining a broad understanding of internal control at the entity level, auditors may also obtain an understanding of internal control at the transaction level for the specific programs and processes under audit.

Here is an infographic from the Green Book that explains the highlighted terms:
GB

The terms “three categories of entity objectives” appear at the top of the cube and the terms “five components of internal control” appear on the face of the cube. The seventeen “principles of internal control that support each component” are presented in a stack on the bottom left side of the infographic.

Nice infographic, now what?

Yes, the cube is cute and the stack is pretty… but so what?  What does all this new language mean to performance auditors, practically?  What the cube and the stack are illustrating is the most up-to-date structure for approaching internal controls.  This means that performance auditors are going to have to change the way they document internal controls. The GAO is working on a tool right now to help you with this task, but it won’t be published until the spring of 2019.

So if you want to implement these changes in your internal control documentation now, you will need to create something yourself. Here are a few tools developed by forward thinking audit shops that might get your creative juices flowing:

The Florida Department of Economic Opportunity: http://www.floridajobs.org/docs/default-source/division-of-finance-and-administration/financial-monitoring-and-accountability/tools-and-templates/fy-2017-18-internal-control-questionnaire-and-assessment.pdf?sfvrsn=2

HUD https://www.hud.gov/sites/documents/IC_QUESTIONNAIRE_ATOOL.PDF

To save time…

As you can tell, this is going to be a lot of work!  But before you start looking for another job, there is something you can do to minimize the documentation.  You can refine your objective early in the audit process!  The Yellow Book says auditors are only responsible for documenting internal controls that are relevant to the audit objective. Thank you, GAO!  So, the more specific you are about your audit objectives, the less controls you will end up having to document!   If you dig into controls AFTER you have performed your inherent risk assessment and refined your audit objectives, you will conserve precious audit resources and, maybe, be able to tolerate your job for another year or two.

If you want to know more about the Green Book and how to narrow your audit objectives, please check out these resources:

Newsletter explaining the Green Book: http://yellowbook-cpe.com/internal-controls-a-la-gaos-green-book.html

A webinar or book on internal controls:  http://yellowbook-cpe.com/topics/internal-controls

A newsletter explaining how to narrow objectives: http://yellowbook-cpe.com/163-times.html

Or an on-demand video on audit objectives: http://yellowbook-cpe.com/product/audit-objective-video

Financial auditors should be pleased

Financial auditors should be celebrating a rare moment when not much in the Yellow Book is  new to them. Right now, the AICPA is driving the changes to the GAO standards, and financial auditors have been adjusting to the AICPA standards as they come out.

But performance auditors are not going to be able to join in on the celebration because the changes to the Yellow Book are new to them. Although, technically, performance auditors do not have to follow AICPA standards, performance auditors indirectly get dragged into the changes prompted by the AICPA anyway because the GAO seeks to keep the Yellow Book consistent throughout.  So when the GAO plays along with the AICPA in the financial audit standards, they also have to play along with the AICPA in the performance audit standards.

Next time

In my next newsletter, I will discuss how internal control weaknesses can serve as the cause of a well-built finding.

Thanks for everything you do to keep the government running!

19 Movies for Auditors

Auditors enjoy a good s’more as much as the next guy, but auditors aren’t the type to stand around a campfire singing Kumbaya.  Instead we are looking at our fellow campers wondering either:

  • Who didn’t plan well and didn’t bring enough chocolate?
  • Who had the audacity to eat the last bits of chocolate?

We pride ourselves on not being gullible and knowing quite a bit about human nature. We know how folks deceive themselves and others in order to justify a fraud (or a selfish consumption of chocolate).  We are trained to be skeptical, and many of us are a little world-weary.

Auditors know the benefits of internal controls, but we also know that determined fraudsters (or chocolate hogs!) can eventually find their way around even the strongest of controls.

This list of 19 movies is not for someone who must have a Hollywood happy ending or who sings Kumbaya with emotional abandon. These are edifying movies, not feel good movies. These movies are compelling because they involve people we can identify with who get sucked into something beyond their control because they allowed greed to rule their choices.

There is no hero on a white horse who saves the day in these movies.  Government investigators and corporate leaders are portrayed as incompetent, corrupt and greedy.  The controls break down.  The fraudster sometimes wins.  The risk that we auditors are always warning against actually happens, and no one walks of into the sunset holding hands with a handsome prince.

But if you are in the mood to go to the dark side of humanity this weekend, pop some popcorn and dig out that backup stash of chocolate.   You will learn something interesting about fraud, controls and the power of greed by watching any of the following movies that are available on either Netflix or Amazon.

1. The Polka King (2017)
Jack Black stars as an ambitious immigrant who uses a Ponzi scheme to achieve the American dream.  Watch how an otherwise upstanding guy slowly gets drawn into a lie and how the government regulators fail to nip the fraud in the bud.

2. American Made (2017)
At one point in this highly entertaining movie, Tom Cruise’s money laundering methods fail him, and he has a hard time finding places to store his excess cash.  I had to laugh out loud when cash started oozing out of his closet, car, and refrigerator. Who knew crates full of cash could be such a problem!?!  Federal bank regulators employ an auditor’s favorite tool – data analytics – to suss out Tom’s drug running operation.  Near the end of the movie, self-concerned government agencies fight over who will get credit for taking him down.

3. The Smartest Guys in the Room (2005)
This documentary is dry, but it is worth watching because the Enron debacle is something every auditor should be schooled in.  Watch for the real life examples of how a negative tone at the top can take a whole organization down.

4. The Wolf of Wall Street (2013)
Leonardo DiCaprio stars in this wild story of fraud, greed and debauchery. The scenes with Matthew McConaughey are scary good and show human greed at its worst.

After his stint in prison for his involvement in the fraud depicted in The Wolf of Wallstreet, Steve Madden (the shoe designer) created his own documentary Maddman: The Steve Madden Story.  Because Maddman is slow and self-aggrandizing, I can’t confidently recommend it.  But the film presents some interesting insight into the mind of an unsophisticated businessman who got tangled up in a complex financial fraud.

5. The Founder (2016)
Watch Ray Kroc take McDonalds from the true founders.  When it is over, you have to wonder whether Ray Kroc is a smart businessman or a fraudster.

6. Icarus (2017)
In this true story of how the Russians doped at the Olympics, we see how even the most stringent controls can be bypassed.

7. & 8.
Stop at Nothing: The Lance Armstrong Story (2014)&
The Armstrong Lie (2013)

Lance Armstrong earned millions in endorsements from sponsors who believed in him.  Along the way he destroyed the careers of anyone who accused him of using performance-enhancing drugs. Watch these films to witness the harsh realities of whistle blowing.

9. All About Eve (1950)
This classic black-and-white film starring Betty Davis isn’t exactly about fraud but is instead a character study of someone who will stop at nothing to get what she wants.  Deliciously chilling.

10. Sunset Boulevard (1950)
Another classic black-and-white film about the slippery slope of compromise and greed.  The lead character, played by Bill Holden, slowly looses his grip on his life when he takes the easy way out of his financial dilemma and shacks up with a rich, aging silent movie star, played by Gloria Swanson.  When he tries to get away, he winds up floating face down in a swimming pool.

11. Bernie (2011)
This dark comedy depicting a true story also features Jack Black as another nice guy sucked into a bad situation.  This time, his solution is more severe than simply stealing money.  But strangely, at end of the movie, you can’t help but like him. Texans, you will get a hoot out of this clip from Bernie describing the regions of Texas complete with funny insults and stereotypes
https://www.youtube.com/watch?v=JREkqCvLzSo

12. The Wizard of Lies (2017)
Robert De Nero and Michele Pfeiffer star as Bernie and Ruth Madoff in this amazing story of the largest investment fraud in history.  As you would expect, the acting is top notch. You won’t be able to push pause on this one.

13. Inside Job (2010)
Matt Damon narrates this upsetting documentary about how U.S. government officials were complicit in the 2008 crash.  A late section of the film highlights the drug-fueled madness of American bankers and traders ala The Wolf of Wall Street.

14. The Accountant (2016)
Ben Affleck stars as a math wiz who is called in to audit a corporation that has suffered a $61M embezzlement.  Affleck could have easily worn his sexy Batman outfit throughout this film as he reemploys his brooding Dark Knight demeanor to portray the autistic math wiz, and the plot unfolds like a super-hero movie.  At one point, Ben Affleck’s character covers an entire conference room with general ledger printouts to look for expenditure patterns.  Now that’s sexy!

15. Joy (2015)
Jennifer Lawrence stars as a downtrodden divorcee from the wrong side of the tracks who invents a mop that sells like crazy on QVC.   At one point in this drama, which is based on a true story, she has to stand up to a manufacturer who has stolen her invention.  Watch for the lack of controls that lead to the fraud and how she saves her business.

16. The Informant (2009)
Matt Damon stars in a movie so full of surprises, I can’t tell you much about it without ruining some of the fun.  Be ready for some twists and turns.

17. American Hustle (2013)
Amy Adams and Christian Bale star as grifters who are roped into helping with a federal investigation of corrupt politicians.  It is hard to tell who the bad guy is here – is it the grifters, the corrupt politicians or the federal investigators?

18. Up in the Air (2009)
This movie stars George Clooney as a ‘corporate downsizer’ for hire.  In other words, Clooney’s character flies around the country annoying people he has never met before.  Sound familiar?

19. Office Space (1999)
Have you ever wanted to annihilate a piece of uncooperative office technology?  Ever had to hold back an urge to smack your cubicle neighbor? This silly comedy about disgruntled office workers who plot a fraud will let you laugh those urges off and face your semi-dysfunctional office environment again with a lighter attitude and a more measured dependence on chocolate.

Let me know what you think of these and whether you have a film that should be added to this list.  I look forward to hearing from you at Leita@yellowbook-cpe.com.

Pulling It All Together

What’s the matter with the crowd I’m seeing?
“Don’t you know that they’re out of touch?”
Should I try to be a straight-A student?
“If you are then you think too much.
Don’t you know about the new fashion, honey?
All you need are looks and a whole lot of money?”
It’s the next phase, new wave, dance craze, anyways
It’s still rock and roll to me.
Everybody’s talkin’ ‘bout the new sound
Funny, but it’s still rock and roll to me.
It’s Still Rock and Roll to Me, Billy Joel

Objectives:

  • Sequence the steps of developing an internal control structure

Whew!  You made it. We are in the last chapter! Congrats, you have held on through a long case study and a complicated model.

In this final chapter, we are taking another look at the steps of creating a control structure from scratch which will also serve as a review of this text. I will quote various excerpts from the Green Book as I go.  Also, we will address what happens when auditors visit to evaluate your controls.

Steps of developing controls

As I see it, the steps of developing controls are as follows:

1.Choose a subject matter

Maybe you have been asked to develop controls for a whole organization or just a segment of an organization.  In either case, you will benefit from breaking your subject matter down into smaller more defined segments because it is easier to imagine controls for something specific than to imagine controls for something broad.

For instance, if I asked you to control the University of Michigan, you would probably walk out the door never to come back!  But if I asked you to control student financial aid at the University of Michigan, you would feel better.  If I asked you to set up controls to make sure that student financial aid at the University of Michigan is distributed on time, you’d feel super because that is very doable!

The side of the COSO cube prompts us to break the subject matter down into segments.  In the COSO and Green Book literature, the side of the cube is dubbed the ’levels of organizational structure.’  I think of it instead as ‘what’ you are planning to control.

2. Focus on what is risky

Now that you have broken the organization up into segments, you can hone in on the segments that are the most likely to cause trouble.

Risk assessment is the second control component on the face of COSO model, but it is, in practice, the first component you consider when establishing controls.

For each piece, you ask four questions:

  1. What could go wrong?
  2. So what?
  3. How big of a deal is the ‘so what?’
  4. How likely are things to go wrong?

Here are the terms the Green Book uses for all of these questions:

  1. What could go wrong? The Green Book calls the answer to this question ‘identified risks.’
  2. So what?  The Green Book calls this ‘significance.’
  3. How big a deal is the so what?  The Green Book calls this ‘magnitude.’
  4. How likely are things to go wrong?  The Green book calls this ‘likelihood.’

From the Green Book:

7.05 Management analyzes the identified risks to estimate their significance, which provides a basis for responding to the risks. Significance refers to the effect on achieving a defined objective. 

7.06 Management estimates the significance of the identified risks to assess their effect on achieving the defined objectives at both the entity and transaction levels. Management estimates the significance of a risk by considering the magnitude of impact, likelihood of occurrence, and nature of the risk. Magnitude of impact refers to the likely magnitude of deficiency that could result from the risk and is affected by factors such as the size, pace, and duration of the risk’s impact. Likelihood of occurrence refers to the level of possibility that a risk will occur. The nature of the risk involves factors such as the degree of subjectivity involved with the risk and whether the risk arises from fraud or from complex or unusual transactions. The oversight body may oversee management’s estimates of significance so that risk tolerances have been properly defined. 

3. Decide if you want to tolerate the risk

When you are confronted with a risk, you have four choices of how to handle it:  you can accept it and live with the possible consequences, you can avoid it by not doing the activity, you can mitigate it by layering on controls or you can ask someone else to take on responsibility for it.

If you choose to keep on doing or to tolerate the activity that causes the risk, but you’d rather not suffer from this choice, you will proceed through the rest of the steps laid out here to help you create the controls to mitigate the risk.  Mitigate is a fancy word for ‘reduce.’

From the Green Book:

7.08 Management designs responses to the analyzed risks so that risks are within the defined risk tolerance for the defined objective. Management designs overall risk responses for the analyzed risks based on the significance of the risk and defined risk tolerance. These risk responses may include the following: 

  • Acceptance - No action is taken to respond to the risk based on the insignificance of the risk. 
  • Avoidance - Action is taken to stop the operational process or the part of the operational process causing the risk. 
  • Reduction - Action is taken to reduce the likelihood or magnitude of the risk. 
  • Sharing - Action is taken to transfer or share risks across the entity or with external parties, such as insuring against losses. 
8.06 Management analyzes and responds to identified fraud risks so that they are effectively mitigated. Fraud risks are analyzed through the same risk analysis process performed for all identified risks…


4. Come up with a control objective

In order to focus your efforts and make sure that everyone is clear about what you are working toward, the Green Book recommends you come up with a clear control objective.

The Green Book talks about objectives in two layers.  In one layer, they ask you to consider ‘why’ you want to control something.   Is it because you are concerned about operations, compliance or reporting? The GAO calls these ‘categories of objectives’ and they are listed on the top of the cube.
Description: Macintosh HD:Users:Leita:Dropbox:+TOPICS:controls:coso model picture:Slide1.jpg

OV1.01 Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved (see fig. 2). These objectives and related risks can be broadly classified into one or more of the following three categories: 

  • Operations - Effectiveness and efficiency of operations 
  • Reporting - Reliability of reporting for internal and external use 
  • Compliance - Compliance with applicable laws and regulations 

OV1.02 These are distinct but overlapping categories. A particular objective can fall under more than one category, can address different needs, and may be the direct responsibility of different individuals. 
Operations Objectives 

OV2.19 Operations objectives relate to program operations that achieve an entity’s mission. An entity’s mission may be defined in a strategic plan. Such plans set the goals and objectives for an entity along with the effective and efficient operations necessary to fulfill those objectives. Effective operations produce the intended results from operational processes, while efficient operations do so in a manner that minimizes the waste of resources. 

OV2.20 Management can set, from the objectives, related subobjectives for units within the organizational structure. By linking objectives throughout the entity to the mission, management improves the effectiveness and efficiency of program operations in achieving the mission. 

Reporting Objectives 

OV2.21 Reporting objectives relate to the preparation of reports for use by the entity, its stakeholders, or other external parties. Reporting objectives may be grouped further into the following subcategories: 

  • External financial reporting objectives - Objectives related to the release of the entity’s financial performance in accordance with professional standards, applicable laws and regulations, as well as expectations of stakeholders. 
  • External nonfinancial reporting objectives - Objectives related to the release of nonfinancial information in accordance with appropriate standards, applicable laws and regulations, as well as expectations of stakeholders. 
  • Internal financial reporting objectives and nonfinancial reporting objectives - Objectives related to gathering and communicating information needed by management to support decision making and evaluation of the entity’s performance. 

Compliance Objectives

OV2.22 In the government sector, objectives related to compliance with applicable laws and regulations are very significant. Laws and regulations often prescribe a government entity’s objectives, structure, methods to achieve objectives, and reporting of performance relative to achieving objectives. Management considers objectives in the category of compliance comprehensively for the entity and determines what controls are necessary to design, implement, and operate for the entity to achieve these objectives effectively. 

OV2.23 Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements. Some entities may set objectives to a higher level of performance than established by laws and regulations. In setting those objectives, management is able to exercise discretion relative to the performance of the entity. 

But later in the book, the GAO drills down into the categories and describes the need for a specific, customized control objective.

6.02 Management defines objectives in specific and measurable terms to enable the design of internal control for related risks. Specific terms are fully and clearly set forth so they can be easily understood. Measurable terms allow for the assessment of performance toward achieving objectives. Objectives are initially set as part of the objective-setting process and then refined as they are incorporated into the internal control system when management uses them to establish the control environment. 

6.03 Management defines objectives in specific terms so they are understood at all levels of the entity. This involves clearly defining what is to be achieved, who is to achieve it, how it will be achieved, and the time frames for achievement. All objectives can be broadly classified into one or more of three categories: operations, reporting, or compliance. Reporting objectives are further categorized as being either internal or external and financial or nonfinancial. Management defines objectives in alignment with the organization’s mission, strategic plan, and performance goals. 

6.04 Management defines objectives in measurable terms so that performance toward achieving those objectives can be assessed. Measurable objectives are generally free of bias and do not require subjective judgments to dominate their measurement. Measurable objectives are also stated in a quantitative or qualitative form that permits reasonably consistent measurement. 

Our objective was, “Do controls deter the coach from using his purchasing card for personal purchases as defined by Grace School District Policy #C7.459?”

5. Compare the baseline to the ideal

Now it is time to talk to managers and find out if there are any existing controls in place.  This will be your baseline of controls.

16.02 Management establishes a baseline to monitor the internal control system. The baseline is the current state of the internal control system compared against management’s design of the internal control system. The baseline represents the difference between the criteria of the design of the internal control system and condition of the internal control system at a specific point in time. In other words, the baseline consists of issues and deficiencies identified in an entity’s internal control system. 

16.03 Once established, management can use the baseline as criteria in evaluating the internal control system and make changes to reduce the difference between the criteria and condition. Management reduces this difference in one of two ways. Management either changes the design of the internal control system to better address the objectives and risks of the entity or improves the operating effectiveness of the internal control system. As part of monitoring, management determines when to revise the baseline to reflect changes in the internal control system. 

Next, you will compare the baseline to the ideal:  the list of 17 principles.  When management has not already addressed a principle with a control or two, then you will need to design a control for that principle.  Remember, in order to judge a control system as effective, all five components and the underlying 17 principles should be in place!

OV3.03 To determine if an internal control system is effective, management assesses the design, implementation, and operating effectiveness of the five components and 17 principles. If a principle or component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. 

Appendix I: The 17 principles support the effective design, implementation, and operation of the associated components and represent requirements necessary to establish an effective internal control system. The 17 principle requirements of the Green Book are as follows: 

  1. The oversight body and management should demonstrate a commitment to integrity and ethical values. 
  2. The oversight body should oversee the entity’s internal control system. 
  3. Management should establish an organizational structure, assign responsibility, and delegate authority to achieve the entity’s objectives. 
  4. Management should demonstrate a commitment to recruit, develop, and retain competent individuals. 
  5. Management should evaluate performance and hold individuals accountable for their internal control responsibilities. 
  6. Management should define objectives clearly to enable the identification of risks and define risk tolerances. 
  7. Management should identify, analyze, and respond to risks related to achieving the defined objectives. 
  8. Management should consider the potential for fraud when identifying, analyzing, and responding to risks. 
  9. Management should identify, analyze, and respond to significant changes that could impact the internal control system. 
  10. Management should design control activities to achieve objectives and respond to risks. 
  11. Management should design the entity’s information system and related control activities to achieve objectives and respond to risks. 
  12. Management should implement control activities through policies. 
  13. Management should use quality information to achieve the entity’s objectives. 
  14. Management should internally communicate the necessary quality information to achieve the entity’s objectives. 
  15. Management should externally communicate the necessary quality information to achieve the entity’s objectives. 
  16. Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. 
  17. Management should remediate identified internal control deficiencies on a timely basis. 

6. Consider cost 

Before you run out and implement all of the controls you designed in the last step, stop and think about how much each of the controls is going to cost you.  Do you need to invest in technology to make the control work?  Or do you need to beef up your staff?  Also, consider whether the new controls will slow down processes and frustrate employees, suppliers and customers.  Excessive controls are also known as ‘red tape’ and ‘burdensome bureaucracy!’

OV4.07 Management may decide how an entity evaluates the costs versus benefits of various approaches to implementing an effective internal control system. However, cost alone is not an acceptable reason to avoid implementing internal controls. Management is responsible for meeting internal control objectives. The costs versus benefits considerations support management’s ability to effectively design, implement, and operate an internal control system that balances the allocation of resources in relation to the areas of greatest risk, complexity, or other factors relevant to achieving the entity’s objectives. 

7. Does it prevent, detect or correct?

Again, before you proceed with the hard work of implementing the controls you designed, take some time to evaluate whether each control is preventative, corrective, or detective.  Detective controls are nice, but stopping the risk before it happens would be better than cleaning up the mess after it happens. This is especially true when it comes to unacceptable risks such as death and injury.  Make sure you have a good mix of all three types of controls with a preponderance of preventative controls.

8. Document

At this point, you are working with a large volume of information.  Just in case you get a little overwhelmed and forgetful, you’d better write down everything you have worked on so far.  The GAO is pretty firm about documentation:

OV4.08 Documentation is a necessary part of an effective internal control system. The level and nature of documentation vary based on the size of the entity and the complexity of the operational processes the entity performs. Management uses judgment in determining the extent of documentation that is needed. Documentation is required for the effective design, implementation, and operating effectiveness of an entity’s internal control system. The Green Book includes minimum documentation requirements as follows: 

  • If management determines that a principle is not relevant, management supports that determination with documentation that includes the rationale of how, in the absence of that principle, the associated component could be designed, implemented, and operated effectively. (paragraph OV2.06) 
  • Management develops and maintains documentation of its internal control system. (paragraph 3.09) 
  • Management documents in policies the internal control responsibilities of the organization. (paragraph 12.02) 
  • Management evaluates and documents the results of ongoing monitoring and separate evaluations to identify internal control issues. (paragraph 16.09) 
  • Management evaluates and documents internal control issues and determines appropriate corrective actions for internal control deficiencies on a timely basis. (paragraph 17.05) 
  • Management completes and documents corrective actions to remediate internal control deficiencies on a timely basis. (paragraph 17.06) 

OV4.09 These requirements represent the minimum level of documentation in an entity’s internal control system. Management exercises judgment in determining what additional documentation may be necessary for an effective internal control system. If management identifies deficiencies in achieving these documentation requirements, the effect of the identified deficiencies is considered as part of management’s summary determination as to whether the related principle is designed, implemented, and operating effectively. 

9. Evaluate the design vs. operation

Once you have organized your thoughts and chosen controls for all five components and the 17 principles, someone has to put them into action.  That could take a while.  As usual, it is best to be patient and thorough instead of agitated and spotty.  Ha.  Agitated and spotty is a great title for a teen romance novel!

The GAO takes pains to mention the difference between the design of a control and the implementation of a control in over a dozen places in the Green Book.  Here are a few quotes:

OV2.13 Internal control is a dynamic, iterative, and integrated process in which components impact the design, implementation, and operating effectiveness of each other. No two entities will have an identical internal control system because of differences in factors such as mission, regulatory environment, strategic plan, entity size, risk tolerance, and information technology, and the judgment needed in responding to these differing factors. 

OV3.05 When evaluating design of internal control, management determines if controls individually and in combination with other controls are capable of achieving an objective and addressing related risks. When evaluating implementation, management determines if the control exists and if the entity has placed the control into operation. A control cannot be effectively implemented if it was not effectively designed. A deficiency in design exists when (1) a control necessary to meet a control objective is missing or (2) an existing control is not properly designed so that even if the control operates as designed, the control objective would not be met. A deficiency in implementation exists when a properly designed control is not implemented correctly in the internal control system. 

10. Evaluate whether you can declare your controls effective!

Sorry to say that your work isn’t done when you finish designing, documenting and implementing controls.  True to the monitoring component of the COSO model, you can’t just set things up and forget them.  You need to come back and evaluate whether everything you have set up is working, correct any unintended consequences of your efforts, improve controls and start the cycle all over again.

OV3.03 To determine if an internal control system is effective, management assesses the design, implementation, and operating effectiveness of the five components and 17 principles. If a principle or component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. 

This is a great place to introduce auditors back into our conversation because they may be able to help you ensure that the controls you designed are functioning properly.  That is what we will do in our next newsletter.

Chapter 12: Information and Communication

                        Might be a rock n’ roll addict, prancing on the stage

                        Might have money and drugs at your command, women in a cage

                        You may be a business man or some high degree thief

                        They may call you Doctor or they may call you Chief

 

                        But you’re gonna’ have to serve somebody, yes indeed

                        Your gonna’ have to serve somebody.

                        Well, it may be the devil, or it may be the Lord

                        But you’re gonna’ have to serve somebody.

Bob Dylan, Gotta’ Serve Somebody

 

My business is minuscule, but that doesn’t exempt me from having to formalize my information processes and comply with reporting requirements of oversight entities.

Every year, I send a detailed report of my CPE offerings to the National Association of State Boards of Accountancy (NASBA).  They want to know how many classes I offered, who taught them, where they were offered and for what group, the date of the classes, and the number of hours granted.

The first year I prepared the report, I suffered.  I had to dig up physical files from earlier in the year and reconstruct all of the data, so I could input it into the report.  Slog!  It took days to put it together, and when I was finished, NASBA sent it back to me because it wasn’t formatted correctly.  Really?  More time, more suffering.

The State of Texas Board of Accountancy requires similar information, but their report has to be handwritten!  Hand… friggin… written… with an ink pen.  That takes a while to complete…

I realized after that first fiasco that I needed to go paperless and track the information I needed throughout the year rather than wait to gather the data at the last minute.  My assistant Chelsea and I have a checklist of all of the documents we must collect after each class, and we maintain a running spreadsheet of the data I am required to report.  All of the information is kept in a Dropbox file that she and I share and update each time I teach.  No more messy paper files.

This year, I only spent a few hours creating both reports!  And on top of that fabulous achievement, I also feel more confident in the information I am reporting because Chelsea and I double-check each other throughout the process.

I also have to report my income to the IRS every year.  When I first started my business, I reasoned that I could keep the books myself because I am a CPA. The only problem is, I do not enjoy bookkeeping.  I waited until the end of the year to force myself to sit down and input transactions into QuickBooks.

As you can imagine, I forgot the purpose of several payments that occurred early in the year and had to SWAG a description of the transactions.  SWAG stands for Sophisticated Wild Ass Guess.   After about five SWAGS, I decided I needed to stop the madness and hired a real bookkeeper, Carol, who keeps contemporary information on my business.  Carol sends me up-to-date financials every Monday, and when it is time to report to the IRS, all the transactions are there, ready to report.  No SWAGs necessary.

I have learned the hard way that thinking of the info you need to accumulate and share in advance is better than trying to gather it – and guess at it – months or even a year later.

The Green Book is Out to Save You from Suffering

The authors of the COSO model and Green Book must have gone through similar experiences.  So, they advise us to think ahead about the information that needs to be shared and to make sure the data shared is valid.

In the chapter on Information and Communication they ask us to apply three principles:

13. Management should use quality information to achieve the entity’s objectives.

14. Management should internally communicate the necessary quality information to achieve the entity’s objectives.

15. Management should externally communicate the necessary quality information to achieve the entity’s objectives.

Principle #13 – no SWAGs

Auditors are trained to never take anyone’s word on anything.  Auditors are trained to seek convincing evidence and not base any conclusions on testimony.  Because both of my above reports could be audited, I am prepared to back up all of my data with original documents!  For instance, the information I send to NASBA about the classes I offer is backed up with sign-in sheets from attendees.  And the transactions in my accounting records are backed up with receipts and bank statements.

The first principle under the Information and Communication component advises us to put controls in place to make sure all of the information in the reports is valid and backed up with evidence.  Three attributes apply to this principle:

13.01 Management should use quality information to achieve the entity’s objectives.

Attributes

The following attributes contribute to the design, implementation, and operating effectiveness of this principle:

  • Identification of Information Requirements
  • Relevant Data from Reliable Sources
  • Data Processed into Quality Information

Attribute 1: Figure out who wants the information and what information they need

This attribute asks “Who cares about whether your work succeeds or whether your controls are functioning?”  Our case study objective, is Do controls prevent the coach from using his purchasing card for personal purchases as defined by Grace School District Policy #C7.459?   I imagine that the following folks will care if the coach is making personal purchases:

  • The director of the athletic department
  • The executive team of the school
  • The school board
  • The citizens of the school district

Once we have a sense of who we will be sharing information with, we need to find out what they want to know.  We can inquire of the stakeholders directly, or we can make some assumptions about what they need. Knowing what they want rather than guessing what they want is best because the frequency and accuracy of information costs time and money; it is a waste of resources to generate and report information they don’t need.

Section 13.03 says that the process of identifying what stakeholders need is an iterative process… in other words, you will have to redesign the content of your reports several times before you hit on content that is meaningful to the stakeholders.

Here is what the Green Book has to say about this attribute.

Identification of Information Requirements

13.02 Management designs a process that uses the entity’s objectives and related risks to identify the information requirements needed to achieve the objectives and address the risks. Information requirements consider the expectations of both internal and external users. Management defines the identified information requirements at the relevant level and requisite specificity for appropriate personnel.

13.03 Management identifies information requirements in an iterative and ongoing process that occurs throughout an effective internal control system. As change in the entity and its objectives and risks occurs, management changes information requirements as needed to meet these modified objectives and address these modified risks.

Attribute #2: Who you get the information from matters

It is always preferable to get your evidence – or the back-up for your reports – from objective third parties.  So, instead of asking the coach to describe his own transactions, source your information from the credit card statement.  The credit card company has no reason to disguise the purpose of purchases, but the coach does.  If any transaction looks iffy, you could ask for original receipts from the coach.

From the Green Book:

Relevant Data from Reliable Sources

13.04 Management obtains relevant data from reliable internal and external sources in a timely manner based on the identified information requirements. Relevant data have a logical connection with, or bearing upon, the identified information requirements. Reliable internal and external sources provide data that are reasonably free from error and bias and faithfully represent what they purport to represent. Management evaluates both internal and external sources of data for reliability. Sources of data can be operational, financial, or compliance related. Management obtains data on a timely basis so that they can be used for effective monitoring.

Attribute #3: Don’t let anyone doctor the report before it is published

The last attribute addresses how the evidence is processed.  The true financial results for Enron, which were created from reliable and relevant evidence by the Enron accounting department, didn’t look that attractive, so the Enron executives made a few fraudulent changes to the reports before they were published.  Obviously, we don’t want to allow bogus changes to our reports in order to make the results look more acceptable.

This is what the Green Book has to say about processing data.

Data Processed into Quality Information

13.05 Management processes the obtained data into quality information that supports the internal control system. This involves processing data into information and then evaluating the processed information so that it is quality information. Quality information meets the identified information requirements when relevant data from reliable sources are used. Quality information is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Management considers these characteristics as well as the information processing objectives in evaluating processed information and makes revisions when necessary so that the information is quality information.  Management uses the quality information to make informed decisions and evaluate the entity’s performance in achieving key objectives and addressing risks.

13.06 Management processes relevant data from reliable sources into quality information within the entity’s information system. An information system is the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information.

Answering Who, What, When, Where & How

So, now that the Green Book has prompted you to answer the who and what questions –who you need to communicate with and what information they need –  principles 14 & 15 prompt us to answer the when, where, and how questions.

The content of principle  14 & 15 are very similar.  Principle 14 focuses on internal reporting and principle 15 focuses on external reporting.  Both ask that we consider:

  • Audience - The intended recipients of the communication
  • Nature of information - The purpose and type of information being communicated
  • Availability - Information readily available to the audience when needed
  • Cost - The resources used to communicate the information
  • Legal or regulatory requirements - Requirements in laws and regulations that may impact communication

A report for our case study

Let’s make up a report for our case study example.  Remember our control objective is:

Do controls prevent the coach from using his purchasing card for personal purchases as defined by Grace School District Policy #C7.459? 

Thinking through each of the prompts given in section 14.07 and 15.07:

Audience

The intended recipients of the communication

The school board and the public.

Nature of information

The purpose and type of information being communicated

This report will contain a bar graphic for each user of the purchasing card and will look something like this:

chart1

It will also include a detailed list of transactions for each cardholder that will include the date of the transaction, the vendor, the amount of the purchase, and the items purchased.

Availability

Information readily available to the audience when needed

The board will receive the report every month via email and the report will be available to the public on the school’s website after the board has reviewed it.

Cost

The resources used to communicate the information

Accounting has the transaction information readily available in the general ledger, but it is not separated by user.  So, the initial cost to set up individual accounts for each user will require some customization of the accounting software.  But, once it is set up, the report should only take an accountant an hour to create and email to the board.  The webmaster will have to post the report to the site, and that should take about 30 minutes.

Legal or regulatory requirements

Requirements in laws and regulations that may impact communication

This report will not help satisfy any regulatory requirements imposed by the state or federal government. However, the Comptroller of the State will award us a ‘Transparency’ award and will feature our report on their website if we meet their award criteria.

Information and Communication is the most straightforward component

The information and communication component of the COSO model/Green Book advises us to make sure that the information we share is valid and communicated in a manner that is helpful to stakeholders.  In my opinion, it is the most straightforward and clear component of the COSO model/Green Book.

So far, we have covered three components of the COSO model/Green Book – the risk assessment component, the control activities component and the information and communication component.  In the next chapter, we will cover the monitoring component.

Stay Up-To-Date

Sign up here to have the lastest from Yellowbook-CPE.com delivered right to your inbox.

Just provide your name and email information below, and as an introductory “Thank You”, you’ll be able to view and download a free copy of our Audit Objectives whitepaper.

* indicates required




×
Stay Up-To-Date

Sign up here to have the latest from Yellowbook-CPE.com delivered right to your inbox.

Just provide your name and email information below, and as an introductory “Thank You”, you’ll be able to view and download a free copy of our Audit Objectives whitepaper.

[newsletters_subscribe list="20"]

×

Login

Lost your password?