Evaluation of Control Environment
Area
Points to Consider
Effectiveness
Key executive integrity, ethics and behavior Control consciousness and operating style Commitment to competence Exercise oversight responsibility Define objectives and risk tolerances Identify, analyze, and respond to risk Assess fraud risk Identify, analyze, and respond to change Design control activities Design activities for the information system Implement control activities Existence of necessary policies and procedures Clear financial objectives with active monitoring Logical segregation of duties Use quality information Communicate internally Communicate externally Adequate performance reports produced from information systems Information systems are connected with business strategy
Organizational structure, responsibility, and authority Enforce accountability HR policies and procedures Mechanisms to anticipate, identify, and react to significant events Processes and procedures to identify changes in GAAP, business practices, and internal controls Periodic comparisons of book-to-actual and physical count-to-books Adequate safeguards of documents, records, and assets Assess controls in place Commitment of HR and finance to develop, test, and monitor IT systems and programs Business continuity and disaster plan for IT Established communication channels for employees to fulfill responsibilities Adequate communication across organization
Control Environment
Risk Assessment
Control Activities
Information and Communication
Perform monitoring activities Remediate deficiencies Periodic evaluations of internal controls Internal audit
Implementation of improvement recommendations Compliance review Enterprise risk process
Monitoring Activities
6
Made with FlippingBook Digital Proposal Creator