Speaker 1: The Committee of Sponsoring Organizations has identified five different components of internal control. And they are the organization's control environment, its risk assessment process, the internal controls themselves, the quality of the organization's information and how it's able to communicate that information, and its ability to monitor the effectiveness of its internal controls. So let's discuss each of these in turn. So we'll start with the control environment. That's the standards, the processes, the structures that make the actual foundation for internal control throughout the entire organization. So this includes the tone at the top. What do I mean by tone at the top? The attitude of top management. Let's take the CEO, for example. So the attitude of the CEO towards internal control. Does the CEO view internal control as just something that they're forced to do, and they don't really care about it, and they don't take it that seriously? Or is the CEO somebody who's a very ethical person and takes internal control very seriously? That's going to affect the environment. Do the lower-level employees take internal control seriously? If the CEO does not, it's unlikely that other people in the organization are going to take internal control seriously. So the environment is very important for setting the attitude throughout the organization toward internal control. Now, each organization is going to have some type of risk assessment process for identifying and managing any type of risk that faces the business. How does this relate to auditing and the financial statements? Well, the company should be assessing the risk of financial statement fraud, and that's going to have a bearing on the company's internal controls. If they take it more seriously, the risk of financial statement fraud, and they actually go and say, this is a risk that we need to assess. We need to understand that management could be playing games with the estimates of depreciation or things like that. Then that's going to affect the internal controls for the company. Now, when we look at the controls themselves, these are just policies, procedures that are put in place to address the risk that we've identified here. So in step two, we're saying, okay, what are the risks of financial statement fraud and other issues? And then once the organization has identified those risks, hopefully they're going to implement some internal controls to try and address those risks. We'll talk about this in other videos, but some examples are segregation of duties, authorization of transactions. Not just anybody can authorize, for example, inventory to be dispersed from the warehouse. So those things are examples of internal controls. Reconciling the company's cash account to the bank balance cash account. So any kind of reconciliation and so forth. Those are all examples of internal controls that an organization could set in place to address the risk of financial statement fraud. Now, information and communication is important and critical to effective internal control. Why is that the case? Well, think about it. If you have an accounting system, if you have an accounting system that is not producing quality financial information, if you're getting information from the financial statement or from your accounting system that cannot be trusted and there's all kinds of issues, for example, you don't have information about the dates when journal entries are recorded, that would be pretty ridiculous. That's a pretty poor accounting system. But let's say that's the case. If you don't have that information, then it's going to be difficult to assess things like cutoff, when a sale was actually recorded and so forth. Was it recorded in the proper period or was it recorded in the wrong period? Also, not just your accounting system, but thinking about the internal control responsibilities. And are those responsibilities being adequately conveyed to the employees by either top management? And that could be through an email. Perhaps top management sends an email and explains to the employees, OK, this is the person in charge of this and so forth. Or the organization could have formal policy manuals that lay out the procedures for internal controls. So internal controls aren't going to be that helpful if you have them in place, but nobody knows what they are or how to operate them. And finally, we look at the monitoring activities and monitoring has to do with evaluating the internal controls. It's not enough to just say, OK, we went and we implemented some internal controls and we guess that they're working, but we're just going to make an assumption. That's not enough. You have to continuously be evaluating the internal controls and see, OK, are they effective? Are people actually applying the internal controls as designed? Are the internal controls working? Are the internal controls catching any mistakes or misstatements? And if the controls are found to be ineffective and that they're not working, then the organization can take action and fix the issue.