COSO Internal Control - Integrated Framework

In November 2010, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) announced a project to review and update the 1992 Internal Control - Integrated Framework. COSO’s goal in updating the framework is to increase its relevance in the increasingly complex and global business environment so that organizations worldwide can better design, implement and assess internal control.

COSO engaged PwC as author of the update. In turn, PwC received valuable input from the Advisory Council and other stakeholders. The proposed Framework retains the core definition of internal control and the five components of internal control. A significant enhancement is the expression of concepts described in the original framework as 17 principles, accompanied by related attributes. These principles and attributes should assist organizations as they apply judgment in improving performance and managing risk in changing business and operating environments.

This Framework will provide organizations with significant benefits – for example, by increasing confidence that controls mitigate risks to acceptable levels and by providing reliable information to support sound decision-making. Furthermore, because the definition of internal control and its five underlying components are not changing, the codification of the principles and attributes will not impose additional burdens or a higher threshold for designing and maintaining an effective system of internal control.

COSO is now seeking feedback comments on the proposed Internal Control - Integrated Framework. A series of questions are included in the exposure draft for consideration by participants. The comment period closes March 31, 2012.

Global Anti-bribery and Corruption Survey 2011

In Canada, managing bribery and corruption risks has not assumed the importance and urgency seen in other jurisdictions. To date, Canada’s Corruption of Foreign Public Officials Act (CFPOA), has received little attention from corporations and enforcement by officials. This is in stark contrast to the situation in the United States where the Foreign Corrupt Practice Act (FCPA) is robustly and strictly enforced.


However, there have been important developments on the Canadian anti-bribery and corruption (AB&C) front. The new reality for Canadian companies is one of increased AB&C enforcement activity, both at home and abroad.

KPMG Forensic commissioned a survey of 214 executives (106 in the US and 108 in the UK) who consider themselves “one of the most senior persons in charge of day-to-day AB&C matters at their company.” The three most significant AB&C compliance challenges cited by both US and UK respondents are auditing third parties for compliance, difficulty in performing effective due diligence on foreign agents/third parties, and variations in country requirements and local laws on issues, such as data privacy and facilitating payments. (Read the Global Anti-bribery and Corruption Survey 2011.)

Mobile insecurity

The proliferation of mobile computing has brought on a number of challenges, specifically around security issues. Smartphones are repeating a pattern witnessed in the 1980s with desktop computers. They flood into the corporate fold without any rational plan. And very often, they are introduced by employees who can’t resist the status statement these devices make. The greatest obstacle to security is the users themselves. People believe nothing of value resides on their device, yet much can be used for identity theft, intellectual property theft or espionage. Everyone likes these devices for the immediacy and convenience, and don’t want to be bothered with security barriers, especially passwords. This is why many users deactivate the password protection, which to begin with is very rudimentary and requires only a four-digit PIN identification. In a regular notebook, that would never be accepted as security. To learn more, read the article “Mobile insecurity” in the September 2011 CAmagazine online.

Fraudulent Financial Reporting: 1998-2007 (COSO)

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) has published a study, Fraudulent Financial Reporting: 1998-2007. It examines 347 alleged accounting fraud cases investigated by the US Securities and Exchange Commission (SEC) during that period. It also provides an in-depth analysis of the nature, extent and characteristics of the frauds and offers insights on new and ongoing issues to be addressed. Most of the frauds occurred before the Sarbanes-Oxley Act went into effect. (Read the COSO Press Release and also view a free Webinar and presentation slides that summarize the study's findings.)

Global State of Information Security Survey

For many years, information technology and, by extension, information security was among the most likely cost centres to encounter cutbacks in funding when companies fell upon difficult economic times. To find out if this is true, PwC surveyed more than 7,200 CEOs, CFOs, CIOs, CISOs, CSOs and other executives responsible for their organization’s IT and security investments in 130 countries. What are the implications of these trends on how your business is addressing the challenges of the economic downturn? What expectations should you be placing on your information security function at this time? Which areas of focus offer the best opportunities for security to provide concrete business value—not just over the long run but right now, during an unusual economic period? (Read the Global State of Information Security Survey Trial by Fire.)

Spotlight on Companies’ Response to Fraud

Fraud is on the increase as the global financial downturn takes hold. The Ernst & Young European Fraud Survey 2009 reveals that, despite the increasing risk of fraud, many companies appear to see combating fraud as someone else’s responsibility and place heavy reliance on internal and external audit to prevent and detect fraudulent activities.

Canada - Ernst & Young survey on risk management

According to a recent survey by Ernst & Young, corporate fraud, data theft and financial reporting risk can cost organizations dearly. That’s why it’s so important for today’s businesses to get their risk management strategies right. By doing so, they can protect their valuable assets and also create a competitive advantage. In The future of risk: Protecting and enabling performance, Ernst & Young finds 96% of organizations believe they can improve risk management, while nearly half say committing additional resources to risk management could actually drive a competitive edge. The survey also finds coverage of multiple risk functions has become increasingly difficult to manage and is compounded by a lack of alignment. (Read the article "Ignoring risk management is risky, survey says" in the October 2009 CAmagazine online.)

Fraud Risk in Difficult Economic Times

A new publication by the Canadian Institute of Chartered Accountants (CICA) is designed to help boards of directors protect their companies from the increased risk of fraud in today’s unsettled economic environment. The Director Alert, titled Fraud Risk in Difficult Economic Times, provides guidance to directors on how to satisfy themselves that management has implemented reasonable and prudent measures to manage the risk of both internal and external fraud. External fraud includes losses from frauds by suppliers, customers and others outside the company. Internal frauds are committed by those within an organization, whether management or employees, and may include asset misappropriation, corruption or financial statement fraud. (Read the CICA Media Release and review the Director Alert, titled Fraud Risk in Difficult Economic Times.)