Scribd
Upload
60 views2 pages

CBOK and Internal Control Frameworks

The document discusses several frameworks that are essential for internal auditors to understand as part of their common body of knowledge (CBOK). It describes how the Committee of Sponsoring Organizations (COSO) internal control framework became a worldwide standard for defining internal controls. The COSO framework was revised in 2014 to emphasize fraud management, understanding risks, and evolving organizational structures. It is now supported by 17 internal control principles. The document also notes the Sarbanes-Oxley Act (SOX) established mandatory rules for internal controls and that internal auditors should understand SOX's internal control review procedures. Finally, it introduces the Control Objectives for Information and Related Technology (COBIT) framework for IT controls and says all internal

Uploaded by

meyy
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
60 views2 pages

CBOK and Internal Control Frameworks

The document discusses several frameworks that are essential for internal auditors to understand as part of their common body of knowledge (CBOK). It describes how the Committee of Sponsoring Organizations (COSO) internal control framework became a worldwide standard for defining internal controls. The COSO framework was revised in 2014 to emphasize fraud management, understanding risks, and evolving organizational structures. It is now supported by 17 internal control principles. The document also notes the Sarbanes-Oxley Act (SOX) established mandatory rules for internal controls and that internal auditors should understand SOX's internal control review procedures. Finally, it introduces the Control Objectives for Information and Related Technology (COBIT) framework for IT controls and says all internal

Uploaded by

meyy
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

CBOK Requirements: Importance of Internal Controls

The four chapters in Part Two of this book introduce some common practices that are essential knowledge
requirements for every internal auditor. Chapter 3 discusses how enterprises and their internal auditors went for
many years without a clear and consistent understanding of the meaning and concept of internal controls. These
defi- nitions were resolved and clarified, however, through the Committee of Sponsoring Organizations (COSO)
internal control framework, a three‐dimensional description or model of how an enterprise should organize and
think of its internal controls. Origi- nally launched as sort of best practices description of good internal controls,
the COSO internal control framework has become first the U.S. and now a worldwide standard for defining and
establishing good internal controls. Whether operating in an industry environment, as an IT specialist internal
auditor, or in not‐for‐profit or governmental sectors, every internal auditor should possess a CBOK
understanding of the COSO inter- nal control framework.

The COSO internal control framework was revised and updated in 2014, with the need for a greater emphasis on
fraud management and understanding risks as well as evolving worldwide enterprise organizational structures.
COSO is now supported by a set of 17 internal control principles, a key internal audit knowledge requirement.
The

2.3 An Internal Auditing CBOK ◾ 15

16 ◾ An Internal Audit Common Body of Knowledge

revised COSO framework and its supporting principles are introduced in Chapters 3 and 4.

The COSO internal control framework was revised and updated in 2014, with the need for a
greater emphasis on fraud management and understanding risks as well as evolving
worldwide enterprise organizational structures. COSO is now supported by a set of 17
internal control principles, a key internal audit knowledge requirement. The

2.3 An Internal Auditing CBOK ◾ 15

16 ◾ An Internal Audit Common Body of Knowledge

revised COSO framework and its supporting principles are introduced in Chapters 3 and 4.

res in the United States and elsewhere became a clarion call for external auditing and
corporate governance reforms. The result was the Sarbanes‐Oxley Act (SOx) in the United
States, discussed in Chapter 5. SOx defines mandatory rules and reporting standards for many
enterprises, large and small, in the United States and worldwide. Although the SOx
legislation is very broad and has regulations and rules in some areas that may be of little
interest to most internal auditors, a knowledge and understanding of the SOx internal control
review procedures should be a CBOK requirement for all internal auditors working at least
with public corporations. In addition, all internal auditors should have general CBOK
understanding of the SOx internal control and its corporate governance rules.

Chapter 6 introduces another very important internal control framework, the con- trol
objectives for IT, or COBIT. An internal control framework with origins tied to IT audit
specialists, COBIT is important for all internal auditors because IT systems and processes are
pervasive in all aspects of virtually every enterprise today. Whether opera- tional, financial,
or IT specialists, all internal auditors should have at least a high‐level CBOK understanding
of the COBIT framework and how it might apply to their internal audit activities.

Common questions

Powered by AI

The COSO internal control framework is significant as it provides a comprehensive model for organizing and understanding internal controls within an enterprise. It is globally recognized as a standard for good internal controls and was revised in 2014 to emphasize fraud management and risk understanding. COSO is supported by 17 principles which are essential knowledge for internal auditors . In contrast, COBIT focuses specifically on IT systems and processes, providing a framework rooted in IT audit specialization, crucial for IT environments within enterprises . While COSO offers a broad approach to internal controls across industries, COBIT is tailored for IT governance and management, making both essential but distinct tools in internal auditing .

The Common Body of Knowledge (CBOK) serves as a foundational guideline for internal auditors, specifying essential knowledge such as understanding frameworks like COSO and COBIT. CBOK ensures that internal auditors are well-equipped to apply these frameworks effectively, reflecting best practices and industry standards necessary for comprehensive control evaluations and IT governance .

COSO's revised framework includes 17 key principles that focus on areas such as control environment, risk assessment, control activities, information and communication, and monitoring activities. These principles are essential for internal auditors as they provide a structured approach to designing, implementing, and assessing internal controls, ensuring they are effective in mitigating risks and achieving organizational objectives .

The 2014 revision of the COSO internal control framework placed a greater emphasis on fraud management and the understanding of risks, reflecting changes in global enterprise organizational structures. This shifted internal auditing practices to not only focus on compliance but also on risk management and fraud detection, enhancing the robustness of internal controls .

COBIT is crucial for auditors in IT environments as it directly addresses IT governance and management, providing control objectives specifically tailored for IT systems. It allows auditors to evaluate IT processes comprehensively and ensure alignment with organizational goals, which is not as extensively covered by other frameworks focused on broader internal control aspects like COSO .

Understanding the COBIT framework is important for all internal auditors because IT systems and processes are integral in virtually every enterprise, impacting all operational areas. COBIT's focus on control objectives tailored for IT systems makes it relevant for auditors to evaluate and ensure proper governance and management of IT resources, regardless of whether their specialization is operational, financial, or IT-specific .

COSO provides a comprehensive framework for establishing and evaluating enterprise internal controls, focusing on creating standards for good practice across industries with a global perspective . SOx, on the other hand, is legislation that mandates rules and reporting standards specifically within the United States and for public corporations worldwide, with a strong emphasis on compliance, external auditing, and corporate governance reforms . Thus, while COSO offers a standards framework, SOx serves as a regulatory requirement shaping compliance and reporting processes.

SOx legislation impacts global internal auditing practices by setting high standards for financial reporting and auditing, influencing international corporations to adopt similar measures to maintain credibility and compliance in U.S. markets. Consequently, internal auditors worldwide need to be familiar with SOx provisions to align with these standards and ensure their entities meet global investor expectations .

Evolving worldwide organizational structures have influenced the COSO framework's revision by necessitating a greater emphasis on managing fraud and understanding risks, which are critical in a dynamic global environment. The updated principles reflect this need by guiding enterprises to adapt their internal controls to be more robust and responsive to risks associated with such changes .

The Sarbanes-Oxley Act (SOx) significantly influences internal auditors by establishing mandatory rules and reporting standards that require them to have a firm understanding of internal control review procedures, especially in public corporations. SOx's focus on external auditing and corporate governance reforms means internal auditors must ensure compliance with these regulations, which encompass both internal control and corporate governance rules .

You might also like