The control evaluation form is finalized as the audit report is prepared, and a completed form is transmitted to the general auditor at the end of each project. Control ratings are summarized at group and company segment levels, forming a basis for reporting on the status of internal controls to senior management and the audit committee. Data is tracked to determine unsatisfactory control trends, as well as areas of audit risk to address in planning future audit projects. For example, if unsatisfactory ratings consistently appear in the monitoring control component, then additional audit emphasis and management visibility may be given to self-reviews, control self-assessment, and similar ongoing monitoring techniques. All control evaluations are summarized semi-annually and presented, with appropriate explanation, to the audit committee as part of the company’s internal control systems assessment.
THE ROAD TO SUCCESS
Although our COSO implementation has ultimately been successful, we did encounter a few hurdles. We implemented the process incrementally, starting with development and testing of the control evaluation form. This earlier version of the form combined COSO control components with internal control objectives from The IIA’s Standards for the Professional Practice of Internal Auditing. An immediate problem developed when auditors were confused by variations in terminology between COSO and the Standards.