oso内部控制模型介绍(英文版)

1、coso内内部控制模模型The CCOSO Inteernall Conntroll ModdelThe CCOSO inteernall conntroll fraamewoork wwas ffirstt inttroduuced in 11992, andd in 19944 a ccomprrehennsivee fouur-seectioon reeportt on inteernall conntrolls waas isssuedd, coonsisstingg of an eexecuutivee summmaryy, a frammeworrk, gguidaance to

2、ppubliic coompannies on rreporrtingg on inteernall conntrolls too thiird ppartiies, and evalluatiion ttoolss to helpp a ccompaany ccomprrehennsiveely aassesss itts cuurrennt coontrool ennviroonmennt. The CCOSO frammeworrk iss rellevannt too achhieviing ccompaany oobjecctivees inn thrree aareass:Oper

3、aationnal ggoalss: Thhe frramewwork relaates to tthe eeffecctivee andd effficieent uusagee of all of aa commpanyys rresouurcess. Finannciall repportiing ggoalss: Thhe coonstrruct givees guuidannce oon thhe coonsisstentt prooducttion of rreliaable finaanciaal reeportts. Complliancce goalss: Thhe guui

4、dannce ccreattes aa toppologgy off thee commpanyys ccomplliancce reequirremennts aas thhey rrelatte too inddustrry reegulaationns orr leggal rrequiiremeents for publlic eentitties. coso内内部控制框框架提出三三大目标，即即运营的效效率和效果果,财务报报告的可靠靠性,以及及遵守适用用的法律和和规章五大要素1。控制环环境Contrrol EEnvirronmeentThis elemment is tthe ffou

5、nddatioon off thee COSSO frramewwork. It setss thee oveeralll tonne off thee orgganizzatioon wiith rregarrd too thee impportaance of iinterrnal conttrolss. Etthicaal vaaluess, leeaderrshipp ressourcce alllocaationn, sttaff comppetennce aat alll leevelss, thhe dyynamiics oof auuthorrity and respponsi

6、ibiliity wwithiin thhe orrganiizatiion, and manaagemeent pphiloosophhy arre alll paarts of tthis critticall commponeent.In a sensse, tthe ccontrrol eenvirronmeent iis thhe moost ddiffiicultt commponeent tto quuantiify, becaause muchh of it rrelattes tto thhe ovveralll cuulturre off thee orgganizzati

7、oon. BBut ttheree aree a nnumbeer off cleear ggoalss thaat ann orgganizzatioon caan woork ttowarrd too enssure thatt thee fraamewoork rrestss on a fooundaationn exeempliifyinng maarkett leaadersship.Boardd andd leaadersship invoolvemment is tthe mmost cruccial elemment in aan orrganiizatiion sseekii

8、ng mmarkeet leeaderrshipp. Ass thee boaard aand lleadeershiip seet exxpecttatioons aand mmeasuure pprogrress agaiinst themm, buusineess uunitss or depaartmeent hheadss beggin tto asssignn intternaal coontrools tthe ppriorrity theyy reqquiree. Thhe sppeciffic sstrattegiees thhat ccan bbe emmployyed t

9、to moove tto a markket-lleadeer poositioon wiithinn an induustryy inccludee thee folllowiing:Conveeyingg thee impportaance of eethiccal vvaluees道德价价值 byy setttingg an exammple and “wallkingg thee tallk.” Thiss inccludees reelatiing sstoriies oof inntegrrity and ethiical valuues tthrouugh ppreseentat

10、tionss, neewsleetterr stooriess, annd anny otherr meaans oof geettinng thhe meessagge too eveeryonne thhat tthesee vallues are impoortannt too thee orgganizzatioon. PPubliic coompannies are now requuiredd to havee a ccode of cconduuct ffor tthe bboardd undder tthe rrequiiremeents laidd outt by SOX.

11、Nonnproffits and privvate comppaniees caan allso bbeneffit ffrom a coode oof coonducct. TThe oorgannizattion cannnot ttolerrate viollatioons oof thhis sstanddard. Theere aare ffinannciall bennefitts too thiis appproaach aas weell. One reseearchh stuudy pperfoormedd by the Insttitutte off Bussinesss

12、Etthicss (“DDoes Busiinesss Ethhics Pay?,” AAprill 20003) ffoundd thaat coompannies dispplayiing aa cleear ccommiitmennt too ethhicall connductt connsisttentlly ouutperrformm commpaniies tthat do nnot ddispllay eethiccal cconduuct. Devellopinng cllear orgaanizaationnal gguideelinees reelatiing tto r

13、eesponnsibiilityy andd autthoriity wwith accoountaabiliity ccheckks iss anootherr cleear hhallmmark of aan maarkett leaader. Witthin the orgaanizaationn, leeaderrshipp typpicallly ffolloows aa disstribbutedd moddel, withh inddividdualss unddersttandiing tthe ooveraall oorgannizattionaal gooals and h

14、ow the goalls off theeir ddeparrtmennt orr bussinesss unnit rrelatte too theem. IIndivviduaals sshoulld allso uunderrstannd thheir respponsiibiliitiess andd thee limmit oof thheir authhoritty too enssure thatt thee goaals oof thhe orrganiizatiion aare aachieeved. Wheen a leaddershhip ccultuure llike

15、 thiss is achiievedd, thhe whhole orgaanizaationn is focuused on oorgannizattionaal obbjecttivess andd commmittted tto thhe maainteenancce off thee conntroll strructuure. A guuidinng cooalittion of lleadeershiip meemberrs beelievving in tthe nneed for channge iis onne off thee firrst sstepss typpica

16、llly ttakenn by orgaanizaationns thhat ssucceessfuully makee cullturee shiifts, butt chaangess willl taake efffect slowwly aand ssteaddily overr timme. Embedddingg thee intternaal coontrool frramewwork withhin tthe oorgannizattionaal cuulturre将内部部控制框架架融入企业业文化. Manaagemeent mmust cleaarly defiine rro

17、less andd ressponssibillitiees foor innternnal ccontrrols, inccludiing rrespoonsibbilitty foor thhe deefiniing, documenntingg, teestinng, aand mmonittorinng off conntrolls annd thhe reemediiatinng off prooblemms. TThe oorgannizattion mustt inccorpooratee theese rrespoonsibbilitties intoo thee resspo

18、nssiblee inddividdualss peerforrmancce maanageementt goaals. The iinterrnal conttrolss envvironnmentt is no llongeer viiewedd as sepaaratee froom thhe opperatting compponennt off thee bussinesss; ccontrrols are embeeddedd in proccessees frrom tthe bbeginnningg. 内部部控制环境境不再独立立于企业经经营要素，要要从一开始始就执行TThis

19、apprroachh lowwers the riskk of inaddequaate ccontrrols and ensuures thatt thee conntroll strructuure iis inn plaace ffrom the outsset oof a proccesss pllanniing aand llauncch. Suppoortinng huuman resoourcees pooliciies aand ppractticess thaat prrovidde cllear corpporatte caareerr patths. Humaan ree

20、sourrces manaagemeent pplayss a kkey rrole in eensurring thatt inddividdualss aree hirred wwith the needded ffinannciall commpeteenciees annd thhat ccareeer grrowthh suppportts ann inccreassed llevell of finaanciaal reeportting comppetennciess.对人力力资源/人人才的要求求 2。风险评评估Risk AsseessmeentLeadiing ccompaan

21、iess takke a riskk-bassed aapprooach to SSOX iinterrnal conttrolss commpliaance as aa keyy steep inn achhieviing aa corrrectt ballancee bettweenn cossts aand bbeneffits. Reccent guiddancee froom thhe Puublicc Commpanyy Acccountting Overrsighht Booard (PCAAOB) suppportss thiis appproaach wwith specci

22、ficc reccommeendattionss, inncludding the use of aa rissk-baased methhod tto deetermmine whicch keey coontrools aare ttesteed eaach yyear. Thee PCAAOB aalso recoommennds tthat the viabbilitty off a ccompaanyss bussinesss moodel is aan immporttant conssiderratioon whhen eevaluuatinng riisks. Commpani

23、ies tthat focuus onn theese llargeer prrobleems aand rriskss willl beetterr meeet thhe neeeds of aall ttheirr staakehoolderrs, iincluudingg invvestoors aand aanalyysts.Markeet leeaderrs wiith rrespeect tto innternnal ccontrrols expaand tthe rrisk focuus sttarteed unnder inteernall commpliaance effoo

24、rts to aa brooaderr vennue. One popuular conccept thatt oftten ppreceedes a maaturee entterprrise riskk mannagemment inittiatiive iis thhe foormattion of aa rissk coounciil. TThis counncil is ggenerrallyy commposeed off mannagemment reprresenntatiives fromm difffereent aareass of the busiinesss. Soo

25、me oof thhe eaarly objeectivves oof riisk ccounccil mmeetiings are as ffolloows: Use oof a commmon ttermiinoloogy ffor rrisk disccussiions throoughoout tthe oorgannizattion; Definnitioon off a rrisk frammeworrk orr strructuure ffor ffosteeringg rissk maanageementt acrross the orgaanizaationn; Charaa

26、cterrizattion of tthe oorgannizattions cuurrennt riisk ccapabbilitty ass welll ass rissk annd peerforrmancce inndicaatorss; Identtificcatioon off thee commpanyys ccurreent sspendding on rrisk; andd Formuulatiion oof a plann to mitiigatee thee opeeratiionall rissks oof thhe orrganiizatiion. If thhey

27、ddo noot allreaddy haave aa rissk prrograam, ssome comppaniees taake tthe rrisk manaagemeent pproceess eeven furtther withh a mmore formmalizzed, enteerpriise-wwide proggram headded bby a chieef riisk oofficcer. Undeer thhis aapprooach, thee orgganizzatioon emmbedss rissk iddentiificaationn andd mit

28、tigattion intoo itss cullturee in the samee wayy it adoppted its inteernall conntroll fraamewoork. The goall is to iinterrtwinne riisk aand bbusinness straategyy witth otther orgaanizaationnal ssysteems ssuch as pperfoormannce mmanaggemennt.Anothher iimporrtantt asppect to rrisk asseessmeent iis coo

29、ntinnuouss monnitorring of tthe iinterrnal and exteernall envvironnmentt in whicch thhe enntityy opeeratees. TThis periiodicc scaan off thee opeeratiionall envvironnmentt cann higghligght uupcomming evennts aaffecctingg botth innternnal ccontrrols and riskk strrateggy. EEventts suuch aas syystemms c

30、hhangee, meergerrs annd accquissitioons, losss of key perssonneel, aand ootherr eveents may requuire a clloserr loook att exiistinng coontrools aand rrisk manaagemeent控制活动Contrrol AActivvitieesMarkeet leeaderrshipp in the actuual ddesiggn off conntrolls reequirres ccorpooratee-widde cooordiinatiion

31、aand tthe iinvollvemeent oof owwnersship. Polliciees arre seet ennterpprisee-widde, aallowwing an eefficcientt impplemeentattion whille avvoidiing ddupliicatee efffortss andd deffinittionss. Coontrool deesignn worrkshoops oor trrainiing ccan rraisee thee knoowleddge aand ccapabbilitty off mannagemme

32、nt and stafff too deaal wiith ddefinning, doccumenntingg, maanagiing, testting, andd repportiing oon innternnal ccontrrols. Gloobal orgaanizaationns haave rrecenntly beguun too rolll thhese sesssionss outt thrroughh onlline traiiningg sesssionns foor fooreiggn reegisttrantt commpliaance withh SOXX s

33、ecctionn 4044. Thhese moduules can be uused withh morre-exxperiienceed ussers to rreinfforcee othher oobjecctivees, ssuch as aa retturn to bbasicc conntrolls annd ann empphasiis onn conntinuuous imprrovemment. Leaadingg orgganizzatioons hhave moveed too morre-coompreehenssive traiiningg on basiic ac

34、ccounntingg connceptts, aand iin thhe prrocesss haave iimprooved the timiing oof thheir clossing cyclle, iimpleementted pproceess iimproovemeents, andd redducedd thee errror rrate in aaccouuntinng trransaactioons.Markeet leeaderrs haave ffocussed ccontrrols on ppreveentioon raatherr thaan deetecttio

35、n (seee thee Siddebarr on typees off conntrolls). Theyy havve reeengiineerred bbusinness proccessees, wwheree neeeded, to incoorporrate prevventiion. Autoomatiing ccontrrol ccheckks byy utiiliziing ssoftwware featturess thaat caan coompleete ccheckks wiithouut anny sppeciffic aactioon iss alsso been

36、efiiciall. Innternnal aauditting can helpp proovidee dirrectiion tto buusineess pproceess oownerrs seearchhing for the bestt appproacch too usee. Woorkinng clloselly wiith tthe bboardd willl heelp tthe iinterrnal audiit fuunctiion rreceiive tthe ccompaany-wwide expoosuree neccessaary ffor bbusinness

37、 proccess owneers tto reecognnize the valuue deeliveered to tthe oorgannizattion. It willl alsso maake iit moore llikelly thhat bbusinness proccess owneers wwill “buyy in” to the proccess.Leadiing-eedge comppaniees inn intternaal coontrools iimpleementtatioon efffecttivelly uttilizze teechnoologyy i

38、n seveeral wayss. Fiirst, theey buuild in ccontrrols wherreverr cosst-efffecttive, beccausee thiis onne-tiime cchangge acctivaates a coontinnual and longg-lasstingg proocesss of conttrol testting. Auttomatted ccontrrol ttestiing aalso brinngs aaboutt a qquickker rrespoonse timee to poteentiaal prrob

39、leems aand nneedeed coorrecctionns.Managgemennt caan allso uutiliize ttechnnologgy too suppportt thee doccumenntatiion aand ttestiing ccompoonentts off theeir ccontrrol aactivvitiees. NNumerrous venddors (e.gg., BBWisee, Meethoddwaree) prrovidde cuustommizabble ssoftwware to pproviide aa connsistten

40、t apprroachh acrross the enteerpriise. The use of ssoftwware to ssuppoort tthesee efffortss is not limiited to llargee commpaniies, as mmany proggramss aree scaalablle annd affforddablee forr smaall ccompaaniess. Thhese proggramss hellp ennsuree thaat thhe innitiaal innvesttmentt in docuumenttatioon

41、 annd teestinng iss welll maaintaainedd andd thaat coompliiancee efffortss willl bee susstainned iinto the futuure. Theyy cann alsso seerve as aa bassis ffor hhigheer-vaalue inittiatiives downnstreeam, suchh as busiinesss proocesss impproveementt andd morre-coompreehenssive riskk mannagemment actiiv

42、itiies.信息与交流流Inforrmatiion aand CCommuunicaationnAn oppen fflow of iinforrmatiion aand eease of ccommuunicaationn witthin an oorgannizattion are esseentiaal wiith aany nnew iinitiiativve. EExperriencced pprojeect mmanaggers are welll verrsed in tthe ccommuunicaationns neeededd to disppersee infforma

43、ationn to stakkehollderss. Thhey aalso havee expperieence withh chaange manaagemeent, whicch caan coontriibutee to the timeelierr accceptaance of nnew pproceessess andd thee conntinuuous imprrovemment needded tto exxcel. Expperieencedd proojectt mannagerrs wiill bbuildd meaasureementts innto tthe pp

44、lanss to asseess ssucceess. Leadiing ccompaaniess fosster openn commmuniicatiion bbetweeen iinterrnal audiitorss, maanageementt, annd exxternnal aaudittors. Thee firrst yyear of SSOX iimpleementtatioon foor accceleerateed fiilerss ressulteed inn lesss thhan iideall commmuniicatiions withh extternaal

45、 auuditoors, accoordinng too thee SECC Aprril 22005 Rounndtabble oon Innternnal CContrrol RReporrtingg Proovisiions. Reccent recoommenndatiions fromm thee SECC andd thee PCAAOB hhave clarrifieed exxpecttatioons rregarrdingg extternaal auuditoor coommunnicattionss, wiith tthe sspeciific goall of impr

46、rovinng thhe quualitty off tesstingg, doocumeentattion, andd remmediaationn in the conttrol enviironmment, thuus adddingg bussinesss vaalue. Inforrmatiion ooverlload is pprevaalentt thrroughhout busiinesss. Inn thee “innformmatioon ecconommy,” manaagemeent iis frrequeentlyy oveerwheelmedd by the qua

47、nntityy of dataa avaailabble, ofteen reesultting in aa faiiluree to convvert impoortannt buusineess iinforrmatiion iinto knowwledgge too suppportt theeir ccompeetitiive aadvanntagee in the markketpllace. Leaadingg commpaniies hhave recoognizzed tthat effeectivve reeportting of eexcepptionns annd ann

48、 “exxecuttive dashhboarrd” aapprooach are the bestt wayys too foccus aattenntionn on impoortannt innformmatioon, aand tthey can avoiid pllacinng maanageementt adrrift in aa seaa of meanninglless dataa froom enndlesss soourcees.5。监测MonittorinngContrrol sself-asseessmeents (CSAA) caan pllay aan immporttant