COSO 2013 ALIGNING INTERNAL CONTROLS AND PRINCIPLES By

COSO 2013: ALIGNING INTERNAL CONTROLS AND PRINCIPLES By: Drs. Denise Dickins & Rebecca Fay, East Carolina University

Summary Auditing firms and others have criticized the ability of recent graduates to understand appropriately audit companies' systems of internal control over financial reporting (ICFR). We describe an activity to help deepen students’ understanding of ICFR and to enhance their critical thinking skills using the recently-released COSO 2013 Framework. Provided are a summary discussion of ICFR and the COSO 2013 Framework, an outside-of-class reading assignment, and an activity that requires students (independently or in groups, either in or outside of class) to: (1) classify (i. e. , map) a listing of controls as being aligned with one (or more) of the COSO 2013 Framework’s five components and 17 principles that comprise a well-designed system of internal control, and (2) identify any deficiencies in design due to missing or inadequate internal controls. By completing the Case and Activity, students are exposed to concepts important in the design of internal control systems and descriptive examples of internal controls. They also employ critical thinking skills to map internal controls and gain experience in identifying deficiencies in internal controls.

Contributions Responsive to regulators’ concerns about accountants lacking a sufficient understanding of, and exposure to, the design of systems of internal control over financial reporting (ICFR) Employs the most up-to-date framework to be used by companies and professional accountants in evaluating the design and operating effectiveness of systems of ICFR – The COSO 2013 Framework. (introduced in 2014; required to be adopted in 2015) Requires critical thinking Provides hands-on experience of a common task, the evaluation of internal controls, using realistic data developed from three public companies Easily adapted to class format (traditional vs. flipped), and available time (60 minutes to 135 minutes)

Objectives Intended to supplement, not replace, discussions of ICFR in undergraduate senior-level or graduate-level accounting systems, auditing, or internal auditing classes. Identify the purpose of internal control, as defined by COSO Differentiate between an accounting process and an internal control Differentiate between an entity-level control (ELC) and a process-level control (PLC) Align a COSO 2013 Framework principle with its intended component Map an internal control to a COSO 2013 Framework principle Identify deficiencies in the design of internal controls

Content Concepts important to understanding ICFR Reliability of Financial Statements Process vs. Controls Financial Reporting vs. Operating Controls Entity-level vs. Process-level Controls Interplay of Effectiveness & Efficiency Entity Size & Complexity Inherent Limitations & Fraud COSO 2013 Framework Handout Components, Principles, Points of Focus Activity

The Activity Students: (1) map a listing of 32 controls to one (or more) of the COSO 2013 Framework’s five Components and 17 Principles, and (2) identify deficiencies in control design due to “gaps” in internal controls (i. e. , controls that are missing or inadequate). Depending on the goal of the instructor and to accommodate time constraints, the activity may be shortened to include only a subset of the Components and Principles. Read COSO’s Internal Control – Integrated Framework Executive Summary, available at: http: //www. ecu. edu/business/customcf/COSO_summary. pdf. Access the Worksheet (a copy of which is presented below) at: http: //www. ecu. edu/business/customcf/COSO_worksheet. docx. Assign the 32 internal controls listed below to one or more of the 17 Principles (or a subset of the Principles, dependent upon the goal of the instructor and allotted timeframe) described in Column 2 of the Worksheet. List the number of the internal control on the Worksheet in the “Controls Present” box (column 4) corresponding to the related Principle. As examples, listed internal controls applicable to Principle 1 and Principle 14 have identified in the Worksheet. (Note: Internal controls may address more than one Principle. ) After assigning the internal controls to each of the 17 Principles, determine whethere any deficiencies in design and list “gaps” (i. e. , inadequate or missing internal controls) in column 5. To complete this step, compare the controls present (column 4) with the Principles (column 2) and “points of focus” (column 3) to assess whether the Principles have been adequately addressed with the existing controls. As examples, potential gaps, applicable to Principle 1 and Principle 14 have been identified in the Worksheet. (Note: As in real audit cases, there are many possible responses for this column. )

Debrief & Assessment of Learning Instructor Guide – Control-by-control guidance & key points Example Worksheet Solution Subjective grading of Students’ Worksheets, or Objective validation “test”

Time Commitment Completing all parts of the activity, including instructor debrief, requires approximately 60 minutes of classroom time over two class periods – assuming students complete all four steps of the activity outside of class.