Are You Ready? Implementing COSO's Updated Internal Controls Framework

December 16, 2014 11:00A PST/2:00PM EST

CPE credits and supplemental information

We are issuing 1 CPE credit To be eligible for CPE credit, please answer three (3) out of the four (4) polling questions throughout the duration of this webinar. An email with a link to the CPE Course Evaluation Form will be emailed after the webinar.

3

Today’s Speakers

Robert Hirth Chairman Committee of Sponsoring Organizations of the Treadway Commission

Susan Parcells Director, Finance Transformation & Product Expert BlackLine

Michael P Rose Partner, Northeast Region Advisory Services Grant Thornton

Agenda

4

COSO Overview Why the new Framework Transition Timeline and Reporting Implications Leading Practices and Lessons Learned Learn how the BlackLine Task Product can be used to help companies organize and manage the work around complying with the new COSO Framework

Polling Question #1 What type of organization do you work for?

A. Public, US listed

B. Private

C. Not for Profit

D. Other

Agenda

6


7

20 Years in the Making…

8

15,000 > 600,000

Originally formed in 1985, COSO is a joint initiative of five private sector organizations and is dedicated to providing thought leadership through the development of frameworks and guidance on enterprise risk management (ERM) internal control and fraud deterrence.

9,300

386,000

67,000

180,000

9

Mission COSO’s Mission is “To provide thought leadership through the development of comprehensive frameworks and guidance on enterprise risk management, internal control and fraud deterrence designed to improve organizational performance and governance and to reduce the extent of fraud in organizations.”

COSO’s Fundamental Principle Good risk management and internal control are necessary for long term success of all organizations

10

COSO is more than Internal Control…

11

And Thus…

National Commission on Fraudulent Financial Reporting formed with James C. Treadway, Jr., former SEC

Commissioner and General Counsel, Paine Webber as its Chairman – becoming known as the “Treadway

Commission” a private-sector initiative, was formed in 1985 to inspect, analyze, and make recommendations on

fraudulent corporate financial reporting.

Source: sechistorical.org

http://www.sechistorical.org/museum/photos/1980/

12

The Internal Control Recommendation All public companies should maintain internal

controls that provide reasonable assurance that fraudulent financial reporting will be prevented or

subject to early detection - this is a broader concept than internal accounting controls…

…The Commission also recommends that its sponsoring organizations cooperate on

developing additional, integrated guidance on internal controls…

- Treadway Commission report

Agenda

13


14

W hy Make Changes?

In the twenty years since the inception of the original framework, business and operating

environments have changed dramatically, becoming increasingly complex,

technologically driven, and global.

At the same time, stakeholders are more engaged, seeking greater transparency and

accountability for the integrity of systems of internal control that support business

decisions and governance of the organization

Source: COSO September 2012

15

Environmental changes... …have driven Framework updates

Expectations for governance oversight

Globalization of markets and operations

Changes and greater complexity in business

Demands and complexities in laws, rules, regulations, and standards

Expectations for competencies and accountabilities

Use of, and reliance on, evolving technologies

Expectations relating to preventing and detecting fraud COSO Cube (2013 Edition)

Update considers changes in business and operating environments…

16

Original Framework

COSO’s Internal Control–Integrated Framework (1992 Edition)

Refresh Objectives

Updated Framework COSO’s Internal Control–Integrated Framework (2013 Edition)

Broadens Application Clarifies Requirements

Articulate principles to

facilitate effective

internal control

Why update what works – The Framework has become the most widely adopted control framework worldwide.

Updates Context

Enhancements

Reflect changes in

business & operating

environments

Expand operations and

reporting objectives

17

Control Environment

Risk Assessment

Control Activities

Information & Communication

Monitoring Activities

Update articulates principles of effective internal control 1. Demonstrates commitment to integrity and ethical values 2. Exercises oversight responsibility 3. Establishes structure, authority and responsibility 4. Demonstrates commitment to competence 5. Enforces accountability

6. Specifies suitable objectives 7. Identifies and analyzes risk 8. Assesses fraud risk 9. Identifies and analyzes significant change

10. Selects and develops control activities 11. Selects and develops general controls over technology 12. Deploys through policies and procedures

13. Uses relevant information 14. Communicates internally 15. Communicates externally

16. Conducts ongoing and/or separate evaluations 17. Evaluates and communicates deficiencies

18

Update describes important characteristics of principles, e.g.,

• Points of focus may not be suitable or relevant, and others may be identified

• Points of focus may facilitate designing, implementing, and conducting internal control

• There is no requirement to separately assess whether points of focus are in place

Control Environment 1. The organization demonstrates a commitment to integrity and ethical values.

Points of Focus: • Sets the Tone at the Top • Establishes Standards of Conduct • Evaluates Adherence to Standards of Conduct • Addresses Deviations in a Timely Manner

19

Update describes how various controls effect principles, e.g.,

Control Environment

1. The organization demonstrates a commitment to integrity and ethical values.

Component

Principle

Controls embedded in

other components

may effect this principle

Human Resources review employees’ confirmations to assess whether standards of conduct are understood and adhered to by staff across the entity

Control Environment

Management obtains and reviews data and information underlying potential deviations captured in whistleblower hot-line to assess quality of information

Information & Communication

Internal Audit separately evaluates Control Environment, considering employee behaviors and whistleblower hotline results and reports thereon

Monitoring Activities

20

There is no Magic 17 Principles Control Checklist …

• The Framework does not prescribe controls to be

selected, developed, and deployed for effective internal control

• Selection of controls is a function of management judgment based on factors unique to the entity

• How controls effect multiple principles can provide persuasive evidence

Polling Question #2 What industry are you in?

A. Financial Services

B. Distribution, Manufacturing

C. Services

D. Technology

E. Energy and Utilities

F. Other

Agenda

22


23

Transition & Impact

• Users are encouraged to transition applications and related documentation to the updated Framework as soon as feasible

• Updated Framework will supersede original Framework at the end of the transition period (i.e., December 15, 2014)

• During the transition period, external reporting should disclose whether the original or updated version of the Framework was used

24

Mostly Smooth Sailing for Early Adopters of COSO Framework Update (?) “Early adopters of the updated COSO framework say they're finding their existing internal controls map rather well to the newly articulated principles contained in the updated framework, although they need to bring more controls into the scope of their internal control evaluation and audit to show it.” April 8, 2014

25

Microsoft Example • Nearly complete with its implementation of the COSO update, mapping the

new framework to its existing control environment and updating its controls.

• Increased the number of entity-level controls that are scoped into its Sarbanes-Oxley compliance exercise from 45 to 58 as a result of the refresh to the updated framework.

• Found its coverage was adequate, but some of the controls that met the COSO principles were not scoped into the internal control assessment and audit.

• Meant streamlining and identifying activities already doing that met the requirements, then documenting them and bringing them into scope for walkthroughs and testing.

Source: Compliance Week

26

Microsoft Example, Continued • Devoted a few hundred staff hours to the project,

• Finalizing its control design with input from its audit firm, Deloitte.

• “There are still a couple of open questions we are working on with them that may result in a few more changes, but it's not substantial at this point,”

• Throughout the implementation the audit firm has targeted areas that the Public Company Accounting Oversight Board has called on auditors to pay closer attention through its inspection process, he says. They are looking more closely, for example, at risk assessments, outsourcing, and reports that are generated and relied on internally.

Source: Compliance Week

27

Don’t Rush it ? A Risk-free Decision? • “If the company isn’t well into the process already and doesn’t have

the resources in place to make the transition in 2014, don’t rush it. • The SEC has stated that it doesn’t intend to challenge companies—

at least in the near-term—that don’t transition by December 15, 2014.)

• Disclose use of 1992 or 2013 Framework; explanation regarding why transition is delayed but not required in 2014. (revised)

• COSO 2013 is “an important opportunity to improve the efficiency and effectiveness of the business.”

Many Firms, But One Framework

29

Same Destination, Slightly Different Path

Polling Question #3 What is your current status for transitioning to the 2013 COSO Framework?

A. Basically done and did just fine

B. Basically done but it was hard

C. Still in process and doing just fine

D. Still in process and struggling with the amount of work

E. 12/31 year-end but deferring to 2015

F. Not a 12/31 year-end

Agenda

31


© Grant Thornton LLP. All rights reserved.

Leading Practices

and

Lessons Learned


Summary of Changes to COSO 1992

Enhances Governance Concepts

Consider Expectations for Competencies and Accountabilities

Consider Demands and Complexities in Laws, Rules, Regulations and Standards

Reflects Increased Relevance of Technology

Enhances Consideration of Anti-Fraud Expectations

Applies a Principle – Based Approach - Explicitly States 17 Principles

33


Consideration for Implementation of COSO 2013

Spend Time to Understand 17 Principles and Points of Focus

Gather Information on COSO 2013 from a Variety of Sources (Larger Accounting Firms)

Attend Training Sessions

Meet with Peers or Attend Roundtables to Get Questions Answered and See What Others are Doing

34


Consideration for Implementation of COSO 2013 (cont'd)

Map the 17 Principles to Existing Controls

Evaluate Results and any Gaps in the Controls or Documentation

Plan to Make Necessary Additions to Controls and Documentation

Meet with External Audit Firm

Execute on Changes Needed

35


Some Considerations In Implementing COSO 2013

Principles 1-5 Relate to the Control Environment Component - explain linkages between various components of internal control - expand the discussion of governance roles to match organization structures, note

committee/board charters, minutes, accountability, roles, responsibilities - clarify expectations of integrity/ethical values, codes or conduct, whistle-blower

process, investigation and resolution, potential issues, training - expand risk oversight and strengthen linkages between risk and performance

Principles 6-9 Relate to Risk Assessment Component - objective setting as a precondition to risk assessment - focusing risk assessment component on objectives related to operations, reporting

and compliance - clarifying that risk assessment includes processes for risk identification, risk

analysis, risk response, aligning risk tolerance with risk appetite - expand the risk severity beyond impact and likelihood to include velocity and

persistence - considering fraud risk relating to material omission or misstatements of reporting,

inadequate safeguarding of assets, corruption

36


Some Considerations In Implementing COSO 2013 (cont'd)

Principles 10-12 Relate to the Control Activities Component - reflect evolution in technology since 1992 move toward technology infrastructure - more details to reinforce linkages in general controls over technology and

automated control activities - distinction of transaction level controls from controls at other levels of

organization

Principles 13-15 Relating to the Information and Communication Component - emphasizing the importance of quality of information - verifying to a source and for retention when information is used to support

reporting objectives to third parties - impact of regulating requirements on reliability and protection of information - impact of technology as it relates to spend, means and quality of information - use of third-party service providers to manage specific processes and the user

controls that need to be in place

37


Some Considerations In Implementing COSO 2013 (cont'd)

Principles 16-17 Relating to the Monitoring Activities Component

- refines terminology of monitoring activities as "ongoing evaluations" and "separate evaluations"

- expanding discussion of the use of technology and external service providers - use of management's reporting controls

38


Additional Considerations for Implementation

PCAOB Practice Alert #11 Results of Latest PCAOB Inspection Reports Discussions with External Audit Firm Business Risk Manual Produced by AICPA, ACFE and IIA.

39


Thank You

Michael P. Rose, CPA, CIA, CCSA, CRMA, CISA, CISM, CGEIT, CRISC, CITP Partner Northeast Region GRC Practice Leader [email protected]

40

Agenda

41


BlackLine Modern Finance The world’s most trusted solution for Finance Controls and Automation

COMMON CHALLENGES AROUND THE NEW COSO FRAMEWORK

Documenting your controls Mapping your controls to the applicable Points of Focus/Principles Organizing the supporting documentation Assigning roles and responsibilities Providing evidence of managements’ testing of internal controls

COSO Framework: 5 Components & 17 Principles

CONTROL ENVIRONMENT 1. Demonstrates commitment to integrity and

ethical values 2. Exercises oversight responsibility 3. Establishes structure, authority, and responsibility 4. Demonstrates commitment to competence 5. Enforces accountability

RISK ASSESSMENT 6. Specifies suitable objectives 7. Identifies and analyzes risk 8. Assesses fraud risk 9. Identifies and analyzes significant change

CONTROL ACTIVITIES 10. Selects and develops control activities 11. Selects and develops general controls over technology 12. Deploys through policies and procedures

INFORMATION & COMMUNICATION 13. Uses relevant information 14. Communicates internally 15. Communicates externally

MONITORING 16. Conducts ongoing and/or separate evaluations 17. Evaluates and communicates deficiencies

Optional: COSO Points of Focus

1 2 3 4 5 6 7 8 9

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

Public Company Internal Control Activities

Map them to COSO Framework

Department Control # Control Activity Accounts Payable CA 053 All postings to the General Ledger are run

and validated to ensure that the GL and subledger are in balance.

Systems CA 054 Segregation of Duties is maintained throughout all systems and all roles and responsibilities are reviewed by management on an annual basis

Systems CA 055 Requests for access to systems and associated responsibilities/functionality is reviewed and approved by management.

General Ledger CA 056 All balance sheet reconciliations are prepared and reviewed by management on a monthly basis. All reconciliation exceptions are addressed on a timely basis.

General Ledger CA 057 All reconciliations deemed as critical (as per Corp. Policy 146) are completed and approved by workday 6.

Step2:

Step1: Map Control Activities

Add additional control activities Remediate any exceptions/deficiencies Annually assess

Step3:

Evaluate and assess compliance of Internal Control Activities to COSO Framework

Polling Question #4 What tools are you using to currently manage your SOX compliance documentation?

A. Using spreadsheets, flowcharts

B. Using internally developed software

C. Using a third party software

BLACKLINE’S SOLUTION TO MANAGING THE NEW COSO FRAMEWORK

Task Dependency

Use the task dependency functionality to align those control activities with either the Points of Focus and/or the Principles as appropriate

Use the COSO import template to bring in just the 17 COSO Principles or the Principles and the 87 Points of Focus into the BlackLine Task Module (can also bring in approximately 90 basic control activities) and two certification checklists

COSO Import

Template

Features

Control Activities

Add your own control activities as additional tasks

Create a certification checklist around internal controls at the COSO principle level and/or the individual points of focus which includes the necessary documentation of overall analysis and any acceptable level of risk.

Certification Checklist

Features

Certification checklist to indicate: The Principle is present The Principle is functioning Major deficiencies exist

Add documentation to provide: • Summary of Controls for Points of Focus/Principles • Evaluation of Deficiencies within the Principle Add comments to indicate: • Any identified deficiencies • Compensating controls for the deficiencies • Impact on any of the other Principles

Additional Features

Manage COSO Compliance Costs: Track time spent at the individual control points and at the COSO principle levels

Certification Details: Full audit trail tracks and timestamps all certification events for all control point assessments and COSO reviews

Built-In Workflow: • Ensure that there is clear ownership

around the control activities Real-time Reporting and Dashboards: • Management can easily report on

their COSO compliance activities

Additional Features

THANK YOU!

53

QUESTIONS?

54

Robert B. Hirth, Jr. Chairman Committee of Sponsoring Organizations of the Treadway Commission Office: 415.402.3621 www.coso.org

Susan Parcells, CPA, CGMA Director, Finance Transformation & Product Expert BlackLine Office: 818.223.9008 https://www.blackline.com

Michael P. Rose Partner, Northeast Region Advisory Services Grant Thornton Office: http://www.grantthornton.com

FEI http://www.financialexecutives.org

http://www.coso.org/

https://www.blackline.com/

http://www.grantthornton.com/

http://www.financialexecutives.org/

Economy & Finance

Are You Ready? Implementing COSO's Updated Internal Controls Framework