Auditing

COSO: Controls Help Is on the Way

In September 2007, companies will be able to scan examples of ways to conduct an internal control assessment.
Helen ShawOctober 23, 2006

Companies that have been asking for more guidance on how to assess internal controls over financial reporting will get some help soon.

The Committee of Sponsoring Organization of the Treadway Commission (COSO) has issued a request for proposal to develop guidance to help companies monitor their internal control systems. In 1992, COSO issued a model, Internal Control — Integrated Framework, which is now used by some companies to assess internal controls as required by the Sarbanes-Oxley Act of 2002. Companies–especially small ones–have aired the myriad challenges that have resulted from their compliance with Sarbox, specifically, the high costs and extensive testing of internal controls.

The new COSO project, which will be awarded to one company, will spawn a two-part document expected to be finalized by the end of 2007, when compliance with Sarbanes-Oxley Section 404, the internal controls provision, will be mandatory for non-accelerated filers. The guidance, which aims to be applicable to all types of companies, will focus on the monitoring of internal controls – one of the five components of the COSO model.

Drive Business Strategy and Growth

Drive Business Strategy and Growth

Learn how NetSuite Financial Management allows you to quickly and easily model what-if scenarios and generate reports.

The first part of the document, a white paper on the basic concepts of monitoring, is expected to be issued in late spring 2007, Dave Richards, president of The Institute of Internal Auditors, told CFO.com. In September 2007, COSO will issue an exposure draft including examples of ways to conduct an internal control assessment, he said. The entire document is expected to be finalized by the end of 2007.

“Current guidance on monitoring [internal controls] is somewhat confusing and more clarity is needed on the subject,” explained Richards. “It’s our belief that if a company is exercising good monitoring of internal controls, then the concern about Sarbanes-Oxley Section 404 assessments would be a no-brainer because people would already be doing those techniques to monitor their key controls on an ongoing basis,” he said.

The guidance should help companies understand different ways to approach monitoring and choose the right method for their particular industry, scope, and size. This endeavor follows COSO’s July 2006 release of small business guidance.

The deadline for the notice of intent to respond to the RFP is November 1. COSO must get the proposals by Tuesday, November 21. During the week of November 26, COSO will notify candidates it wishes to conduct an in-person presentation, which will occur on December 14, 2006. COSO expects to extend the award by the end of this year, said Richards. All companies are invited to apply.

“We feel it’s long overdue and [that is why] we have a tight timeline on this,” explained Richards.