Risk Management and Internal Controls
Domain 6 - Risk Management and Internal Controls. This section tests the COSO internal control and ERM frameworks, risk responses, control classification, segregation of duties, and the deficiency ladder used to grade control failures.
Core rules
- COSO internal control (2013), five components: control environment, risk assessment, control activities, information and communication, and monitoring. The control environment - tone at the top - is the foundation.
- COSO ERM (2017): governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.
- Risk responses: avoid, reduce, share, accept. Compare inherent risk with residual risk after controls.
- Segregation of duties: authorization, custody, recording and reconciliation should not sit with one person.
- Deficiency ladder: deficiency, then significant deficiency, then material weakness - a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.
- Preventive versus detective: approvals and pre-numbered documents prevent; reconciliations, surprise counts and audits detect.
Worked example
In a small company the cashier receives cash, posts to the receivables ledger and prepares the bank reconciliation. Cash can be stolen and the ledger altered to conceal it - a clear segregation failure, and the reconciliation is worthless because it is not independent. Compensating controls where headcount is limited: the owner receives the unopened bank statement directly and reviews it, a second signatory approves disbursements, surprise cash counts are performed, and the reconciliation is completed by someone outside the cash function.
Traps
- Calling a bank reconciliation a preventive control; it is detective and only works if independent.
- Grading a material weakness as a significant deficiency, or vice versa.
- Accepting a risk without documented rationale and approval.
- Assuming a whistleblower hotline is a control activity rather than part of the control environment and monitoring.