I agree with all of the above. I think involving the internal audit department when introducing new products or processes, especially early on can be valuable and prevents us from coming along behind the decision-makers and finding deficiencies with the newly implemented policies. I hope the 37% is acting in a consultative role and not actively involved in making decisions or designing strategies.

The question I have for Tim is: where does the loop start and where does it end?  I'm more comfortable with the idea that business or organisational objectives are purpose of what we do.  The system of internal controls (which includes everything you do to make sure you meet your objectives - risk mgt, governance, compliance, etc before anyone asks) is there to ensure the organisation achieves its objectives.  Therefore, I don't think it should be part of the control framework.  However, I do agree that internal auditors need to understand the organisations objectives, which form the context for their work.  RM and controls and everything else is effective ONLY if it helps the organisation achieve its objectives.

Comment to Norman: I would really like to see the results of the Forbes Insight survey. E&Y's brochure doesn't present many results, mostly an explanation of their market positioning of internal audit, which is interesting, but not as interesting as what our stakeholders actually think.  It would be great to compare the questions and answers of this survey with those that IIA - UKI had (working with Deloitte) in 2001 in the Value Agenda.

To your question, I think that the way IA contributes to the organisation is by providing assurance (that's our USP) and by working to help the organise improve.  But we should do it strategically, ie being aware of the mission, vision and strategy of the organisation.

All the COSO frameworks treat objectives the same way - that having clear objectives is an essential component of internal control (and hence a part of all COSO frameworks). Establishing those objectives, that is, determining exactly what those objectives are, is a management function and not part of internal control.

It's like Info and Communications - the control frameworks say to have good controls an organization must be able to move information. That's the control - the mechanisms to move information. What information needs to be moved is not part of internal control, or the frameworks.

I agree with Norman, and do not think that internal audit should have a role as “strategic advisor” -  we have our hands full with an assurance role.

Larry

Thank you, all, for the comments.

The point on Objectives is interesting. my view:

1. You need controls within the process of setting strategies and objectives, to ensure they are based on an understanding on stakeholder needs and value; reliable and current information; reliable understanding of risks; etc. You also need controls over the cascading of strategies and objectives throughout the organization, to ensure activities at all levels are in sync with the direction set from the top.

2. You also need controls to ensure the strategies and objectives are met.

Rather than speculate about the intent of the COSO authors, I will see if I can get one of them to comment.

So, I  checked with somebody from the COSO ICF team. He said that the determination of objectives is absolutely part of the internal control framework. You will find it in the Risk Assessment layer.

Internal Auditor to act as strategic advisor in the business decision and strategy. Internal Auditor being acting as management representative, is a trust in decision making of the management. It is proven or trusted taking internal auditor a part in business decision, what the internal auditor should prove his understanding towards the management role , while he is entrusted all the checkings for on behalf of the management. A professional with all business understanding he must to possess with him just not subjectively but also objectively, an internal auditor should be asked to be a strategic advisor too, to evaluate how much his understanding is practical to business decision and strategy.

Norman- I agree with your comments that internal audit should be independent of management. Interesting remarks that 37% involve internal audit in making business decisions or setting strategy. We do not know exactly what is inferred by this statement. Perhaps is it just the control aspect and not the making of decisions. I am alway wary of these surveys that seem to have a self interest motivation perhaps behind their publication. But it is what it is.

Jennifer- I agree with your remarks as noted above

Tim - I agree with a good part of what you are saying and frankly your last comment that "the leading control framework is one of the biggest risks to good governance" is the most important statement in this blog and one which I concur with 100%. It is a waste of time to revisit COSO because it will require too much work to redo. There are much better risk frameworks out there that should have been in place in the US but for a variety of reasons were kept off of the market. I don't believe that books should be burned but buried is another matter. COSO should have been buried a long time ago and has served our various constitutents poorly especially over the past five years. Does it have good things about it? Sure it does. Can our various members take it and work with it practically. Not at all from what I have seen. 

We are still waiting after so many years to see one comprehensive COSO ERM case because there is none and nobody except for a few folks would be capable of creating one. Put your energies into ISO 31000, ISO 31010, AS/NZS 4360:2004, HB 436, HB 158, HB 158 for ISO 31000, CoCo, King 3, Combined Code

Arnold 

By the way, I do not believe there is a "fatal flaw" (as Tim puts it) in COSO ICF. Auditors should, if they adhere to the Standards and the Definition of Internal Audit, audit the governance processes and its related controls. That would embrace auditing the controls over governance-setting.

Those controls may exist at several layers of the COSO ICF model, including the entity level (board activities), control activity level (within business processes such as the financial close), risk assessment, and information/communications.

Internal audit can be a strategic advisor with consulting advice on risk and controls, advocating improvements in management's processes for governance, risk management, and the related internal controls.

They should not be expected to be a strategic advisor in the way the EY study seems to advocate: that would involve them becoming involved as a part of management and losing their independence.

I wonder if the author of the study understands the essential role of internal audit, or sees us (incorrectly) as part of management.

Norman:

You seem to be of the view that COSO ICF should primarily be a tool for internal and external auditors. While I agree that that is primarily how it has been used in real life, the goal of a framework claiming to be an "integrated internal control framework" should be to have senior management and work units use it to help them do a better job managing a business.  If the goal of being a useful framework for boards, senior management, and work units was accepted by COSO, I have difficulty believing they wouldn't conclude objective setting should be part of an "integrated control framework".  

If as you imply COSO 92 was mainly created for auditors, I still assert that evaluating the effectiveness of objective setting is a key step.  Claiming objective setting is a governance activity but not part of an integrated control framework relegates IC to the back of the bus.

I agree with Norman's remarks further above on the distinction between the COSO ICF and COSO ERM and preferences. I just agreed with Paul Sobel to write an article for Feb IIA magazine which may be one or two parts on risk assessment. I am going to try and address in this article objectives and strategic planning and the myriad of those items up front that are not so touchy feely in the overall process but which are critical. Hopefully this can be helpful material.

I say leave these frameworks alone for better or worse. Use the material from them especially COSO 1, some decent research from COSO 2 on ERM but not great for implementation, use some aspects of COSO 3 primarily the principles and use the executive summary of COSO 4 on monitoring but not the rest and then let's just move on to try and make things better.

Regards,

Arnold

Norman:

I am familiar with the quote but suggest it implies that the process used to establish objectives isn't part of an integrated control framework, which is exactly the position COSO 92 took in the final release after rejecting the exposure draft framework produced by the original C&L authors that inclused objectives. 

I can't accept that view and I still haven't heard your answer on whether strategic planning processes and budget processes are also excluded from your view of what an integrated control framework is since they involve establishing and refining objectives..

Senior officers at some companies consciously established objectives to deceive regulators and investors through their financial disclosures.   Would you suggest auditors should accept these objectives and assist in determining if controls are "effective" to achieve those aims????  What about companies that consciously prioritize profits over safety and/or profits over environmental stewardship?

Would you not need to "audit" the objective setting process to determine if it was appropriately designed to ensure the board of directors concurs with the objectives set by senior management?

Norman:

I see producing selling goods and acquiring goods and services to produce goods as business processes.  I can't disagree that semantically budgeting is a "business process" but suggest to you that companies like SAP don't exist to do strategic planning and budgetting but do exist to design, build and sell software, generate profits and increase shareholder value.  Strategic planning and budgetting are "ways to achieve objectives" as opposed to end result business objectives just as IT control manuals, reconciliations, training, board oversight are all "ways to achieve" not end result business objectives..

Extending your argument, is Internal Auditing a business process in your mind over which there are controls that is not part of an integrated control framework or is IA an element of an integrated control framework?  It is the term "integrated control framework" that is key to the position I am taking.

Norman:

When I was trained at C&L in 1979 (almost 30 years ago) the framework  used terminology that included "basic controls" and "disciplines over basic controls".  The C&L control framework was a breakthrough at the time that was helpful,but it isn't terminiology that resonates with management and  boards and I don't is consistent with the claim to being an  "integrated control framework". 

Unfortunately for investors  tens of thousands of SOX 404 assessments are done each year without asking the fundamental question of whether clear  financial reporting objectives have been established, clearly communicated, and cascaded down.  An important issue is whether a company's objective is to be in compliance iwth GAAP or "fairly present" .   Is reliable disclosure of related parties an objective and who owns it?  Is it just assumed the objective exists as a precondition to good control but formally articulating it isn't part of an integrated control framework???  Why auditors don't  addreess the existence and communication of financiall reportng objectives is because it isn't part of the  COSO 92.the framework the SEC forces them to use. The SOX 404 opinion error rate using COSO 92 shows it needs improvment.

If there is a failure in how companies and auditors have assessed internal control for SOX, it has been in the level of attention paid to the Control Environment. This layer of the ICF was described well by COSO and ethical behavior has been the root cause of almost every fraudulent financial reporting case. It also addresses the competence of managers and staff involved in financial reporting - a major root cause of errors. Yet, scant attention has been placed on it.

If the COSO framework had been employed better, with appropriate attention to the Control Environment, then that error-rate you love to talk about would be very much reduced.

Tim:

A large number of managers around the world use the definition of internal control and find it useful. I am not sure how you would use a definition or document like COSO ICF to "achieve important business objectives". The framework doesn't do that; instead, it helps you understand how internal controls work to do that.

On your simple question:

1. I believe in continuous improvement and agree with you that COSO should re-examine both ICF and ERM.

2. COSO should re-assess the purpose and value of both frameworks in the current environment.

3. Once it has completed the re-assessment and, perhaps, re-definition, it should objectively assess whether or not those objectives are being achieved.

4. Necessary improvements should be drafted and, together with the purpose and value statements, opened for comment.

Norman:

Thanks for clarifying your position on the need for COSO 92 reform. Have you conveyed your view on the need for a framework improvement process to the COSO Committee?

My point re SOX error rate is that, although restatements and SOX 404 management/auditor errors have dropped significantly they are still in the hundreds per year in the US and in the thousands globally. It would seem to me that COSO and the SEC should be interested in understanding why the application of COSO 92 produced inaccurate effectiveness opinion from both management and the companies external auditors. Was it how it was applied or the framework itself?  

 Would you buy a car from a car company that was disinterested when their cars failed sometimes resulting in major safety risks even deaths? e.g. Toyota recall.  Some of the SOX 404 opinion errors have related to financial statements that had to have massive adjustments to correct and resulted in share devaluation in the billions.

Tim,

Consider something else we learned at C&L: there is a difference between a control breakdown and isolated exceptions. A single journal entry error, even if material, among thousands in a quarter is not a control breakdown. A single control failure regarding an accounting treatment, is not generally indicative of a control breakdown.

We have had a battle getting external auditors to accept that a single error of material size does not mean that the system of internal control does not provide reasonable assurance. Your coming around in support would be helpful.

Tim, the SEC and PCAOB have stated that judgment should be applied to determine whether there has been a material weakness, and the fact of a material error should not mandate the existence of a material weakness. I have spoken to the SEC and PCAOB and know that they understand and (unofficially) agree with the position I laid out.

I have not said and will not say that anybody misapplied COSO. Why? Because I don't believe that is the case. The determination of whether there is a material weakness has to follow SEC standards, not anything in COSO ICF.

I believe the SEC should study the root causes of material misstatements and ensure the guidance for management and the standards for auditors address them - and that will mean increased attention to the Control Environment.

Tim, I don't sit on the COSO board and can't tell you what they have discussed with the SEC.

What I can say is that the definition of internal control in COSO ICF is that internal control is a process that provides reasonable assurance. The SEC defines what reasonable assurance is.

I believe you are unfairly castigating COSO ICF for failing to deliver something it was not designed to do. You want it to be a vehicle for designing internal control. It is a vehicle for understanding what internal control is. There is an appendix that can be used to facilitate control assessments, but it is not very good and needs to be tailored for every organization.

You are blaming a hammer for its inability to screw in a nail. Is it up to the manufacturer of the hammer to tell the user not to use it to screw in a nail?

If you want to blame anybody for failures in the scope and extent of SOX assessments, blame the SEC and PCAOB. They have essentially defined the work to be done in AS5 and the SEC guidance for management.

Good discussion. If you go back to the three bullets at the bottom of your blog you state that IA should provide assurance on governance, risks and controls, shuld contriobute through recommendations and consulting activities as well as be a leader for change. Different recent studies have shown that the biggest risks companies run are strategic and operational failures, not financial reporting errors. Should IA then skip the biggest risks, the strategic ones? Could IA not be independent and at the same time comment on the strategic decisions as well as on the strategy process? Given their independent positioning they should to my opinion identify such processes as tunnel vision. That is when IA can really start to make a difference. That does not say that they should determine the companies strategy. That still is a Boards game.

Norman:  You state: "You are blaming a hammer for its inability to screw in a nail. Is it up to the manufacturer of the hammer to tell the user not to use it to screw in a nail?" 

The SEC has said a "suitable" framework for SOX must be capable of producing reasonably consistent quantitative and qualitative conclusion on control effectiveness and set three other key suitability criteria.  I don't blame COSO for producing a framework in 1992 that isn't capable of producing reasonably consistent quantitative or qualitative conclusions or not having built it specifically for ICFR. 

 I do blame the COSO committee for not candidly and publicly advising the SEC of that fact. Their silence is interpreted by the SEC as agreement with all four IC framework "suitability" criteria.  I do beieve it is up to the manufacturer in an instance as globally critical and costly as SOX 404 to tell the SEC what COSO 92 is, and isn't capable of.  You make many good points above on what COSO 92 isn't capable of and shouldn't be used for.

Steve, I think the problem is that too few internal audit functions have tackled the processes and controls around strategic risk. If they did, they would demonstrate their value to management.

Internal auditors are bright, intelligent, curious people who - when permitted by their CAE to think and use their imagination - can deliver valuable insights and suggest improvements. Their ability to has yet to be tapped by many audit functions.

I have hired many auditors over the years who were not permitted to think. They were provided audit programs and told to follow them.

I removed their chains and required them to unshackle their minds.

We can do so much, including assessing controls over strategic risk, if we use our native intelligence.

Perhaps the most important task for an audit executive is to challenge the staff to think, exercise, and grow their imagination.