The 2013 COSO Framework and the Audit Committee
The implementation of the updated 2013 COSO Framework issued last May provides audit committees and management teams an opportunity to take a fresh look at internal control and create value for the organization, regardless of how mature a company’s system of internal control may be. The framework also can help audit committees manage elevated expectations regarding internal control. There are a number of issues for audit committees to consider, however, as they oversee the implementation of the 2013 COSO Framework.
The updated version of the COSO Framework emphasizes the role of the board—and thereby the audit committee, depending on governance structure—in creating an effective control environment and having a robust risk assessment process, including identifying and addressing fraud risks. The updated framework provides additional structure by defining 17 principles of internal control. The framework’s enhanced structure increases the level of rigor required to evaluate the design and effectiveness of internal control. In accordance with the updated framework, all principles must be present and functioning in order to conclude that internal control over financial reporting is effective.
Many important topics associated with internal control over financial reporting are discussed in detail in the updated framework. These include the competence and accountability of those performing internal control activities, fraud risk identification and response, the quality of information used in internal control, and business events that may necessitate changes in internal control. An analysis of the changes in the 2013 COSO Framework appears in Heads Up: COSO Enhances Its Internal Control – Integrated Framework.
The PCAOB and SEC have also been focusing on internal control-related matters. PCAOB Practice Alert No. 11, Considerations for Audits of Internal Control Over Financial Reporting, released last fall, highlights common PCAOB inspection findings related to audits of internal control. Although the practice alert is primarily addressed to auditors, SEC Deputy Chief Accountant Brian Croteau has stressed that the issues summarized in it may be indicative of material weaknesses that management has not identified.¹
Public companies using the original 1992 COSO Framework for internal control reports should be aware of COSO’s transition guidance, which states that the older framework will be available until December 15, 2014; at that time COSO will consider it to be superseded by the 2013 COSO Framework.² SEC Chief Accountant Paul Beswick stated last May that “the SEC staff plans to monitor the transition for issuers using the 1992 framework to evaluate whether and if any staff or Commission actions become necessary or appropriate at some point in the future.”
The SEC staff has also indicated that “the longer issuers continue to use the 1992 framework, the more likely they are to receive questions from the staff about whether the issuer’s use of the 1992 framework satisfies the SEC’s requirement to use a suitable, recognized framework (particularly after December 15, 2014)…”³
With this background in mind, audit committees have both an impetus and opportunity to use the implementation of the updated framework to challenge management to refresh and reevaluate a company’s internal control. Companies can begin by evaluating the changes needed to meet the December 2014 transition deadline (for calendar year-end public companies reporting on internal control over financial reporting). There is also an opportunity to use the adoption of the updated framework to encompass controls that address other material regulatory compliance or operational risks, as discussed further below.
COSO and the Role of the Board and Audit Committee
The 2013 COSO Framework emphasizes the role of the board of directors—and, by delegation or regulation, the role of the audit committee—in overseeing internal control. The framework highlights:
- The board’s role in the control environment, including providing clarity regarding expectations for integrity and ethics, conflicts of interest, adherence to codes of conduct, and other matters
- The board’s assessment of the risk of management override of internal control and careful consideration of the possibility that management may override such controls⁴
- The establishment and maintenance of open lines of communication between management and the board, and the provision of separate lines of communication, such as whistleblower hotlines.
The following principles within the control environment component of the framework, in particular, emphasize the board’s role:
As companies implement the updated framework and perform a gap analysis to compare it to the company’s current control structure, gaps tend to occur in three areas:
- In the company’s internal control related to COSO’s 17 principles, where one of the principles is not present or functioning
- In the company’s internal control related to the points of focus; for example, though the points of focus are not formally required, the company may determine improvements are needed and decide to implement additional points of focus in order to meet the objective of the principle
- In the company’s documentary evidence demonstrating the principles have been met and supporting management’s assessment of internal control
When discussing with management the company’s progress in evaluating the updated framework’s impact, audit committees should focus on these matters.
Marketplace Trends and the Use of the 2013 COSO Framework
Applying the 2013 COSO Framework in areas other than financial reporting may provide helpful and necessary discipline to address the complex array of risks that boards and audit committees oversee. It may also provide management with a consistent and efficient framework to define, implement, and monitor the control structure and continuously improve risk management processes.
Areas where companies may consider applying the framework include:
- Managing compliance with the Foreign Corrupt Practices Act (FCPA)—There has been a significant increase in FCPA enforcement actions by the SEC and Department of Justice. Audit committees may use the 2013 COSO Framework to help manage and control FCPA-related risks.
- Managing compliance with global security and privacy regulations, including payment card industry rules, and managing risks associated with cyberattacks and threats—The 2013 COSO Framework may also be utilized to manage compliance with third-party contract agreements, including those related to security access and licensing requirements.
- Managing industry-specific regulatory requirements—Examples include meeting Bank Holding Company Act reporting requirements; anti-money laundering regulations; Food and Drug Administration, Federal Aviation Administration, and Defense Contract Audit Agency regulations; and state-specific regulations, where applicable.
- Creating governance, risk, and controls programs related to sustainability—The 2013 COSO Framework may assist in developing a program to manage a growing class of environmental, social, and governance (ESG) risks. Investors are scrutinizing a company’s ESG performance and becoming increasingly averse to ESG risks. Companies that are prepared for ESG shocks may better mitigate downside risks when they occur.
- Providing a framework to identify, mitigate, and manage board-level operational and strategic risk areas, as identified through companies’ enterprise risk management processes.
Consideration of SEC Whistleblower Rules
In discussions with management about adopting the 2013 COSO Framework, the audit committee may consider asking management the following questions related to whistleblower programs:
- Are there opportunities to enhance internal whistleblowing systems, processes, and responsibilities?
- What consideration, if any, has been given to the effect of repeated allegations being considered as part of the fraud risk assessment?
- Are there appropriate methods to maintain accountability for perpetrators of fraud, as well as those in the chain of command with knowledge of fraudulent activities?
- What consideration has been given to the use of monitoring tools to identify potential fraud?
- Have the potential advantages of implementing incentives to encourage internal whistleblowing been considered?
- Are there policies in place to prevent and monitor for retaliation against whistleblowers?
Potential Benefits of the 2013 COSO Framework
While regulators and other stakeholders increase their focus on internal control and related governance issues, the 2013 COSO Framework can help audit committees navigate various internal control issues and build an effective oversight program. Improvements in internal control’s effectiveness can lead to more efficient operations, greater compliance rates, and more effective internal and external financial reporting.
To download a free iPad app to the Audit Committee Brief and an interactive edition of Audit Committee Resource Guide, click here or visit the iTunes App Store and search for “Deloitte Audit Committee Resources” to download the application.
1. See speech by Brian Croteau, December 9, 2013, which stated in part: “As we maintain or increase the intensity of our focus in [internal control over financial reporting]….I remain convinced that at least some of the PCAOB’s inspection findings related to the audits of internal control over financial reporting are likely indicators of similar problems with management’s evaluations of ICFR, and thus potentially also indicative of risk for unidentified material weaknesses….[and] I continue to question whether all material weaknesses are being properly identified….” (http://www.sec.gov/News/Speech/Detail/Speech/1370540472057).
2. SEC rules state that “the framework on which management’s evaluation of the issuer’s internal control over financial reporting is based must be a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment.” See 17 CFR §§ 240.13a-15(c).
3. See minutes of the September 25, 2013, meeting of the Center for Audit Quality SEC Regulations Committee with the staff of the SEC: http://www.thecaq.org/docs/reports-and-publi cations/2013septembe25jointmeetinghls.pdf.
4. Further discussion of actions audit committees can take in this area is included in the AICPA report, Management Override of Internal Controls: The Achilles’ Heel of Fraud Prevention.
- COSO Update: Establishing and Assessing Effective Internal Control
- Top Issues for Audit Committees in 2014
- A New Era in Audit Committee Reporting
- Successful Onboarding for New Audit Committee Members
- Leveraging 10 Years of SOX for Stronger Risk Management