The Committee of Sponsoring Organisations （COSO) of the Treadway Commission is an American

The Committee of Sponsoring Organisations (COSO) of the Treadway Commission is an American voluntary, private sector organisation and is unconnected to government or any other regulatory authority. It was established in 1985 to help companies identify the causes of fraudulent reporting and to create internal control environments able to support full and accurate reporting. It is named after its fi rst chairman, James Treadway, and has issued several guidance reports over the years including important reports in 1987, 1992 and 2006.

In 2009, COSO issued new ‘Guidance on monitoring internal control systems’ to help companies tighten internal controls and thereby enjoy greater internal productivity and produce higher quality reporting. The report, written principally by a leading global professional services fi rm but adopted by all of the COSO members, noted that ‘unmonitored controls tend to deteriorate over time’ and encouraged organisations to adopt wide ranging internal controls. It went on to say that, the ‘assessment of internal controls [can] ... involve a signifi cant amount of ... internal audit testing.’

After its publication, the business journalist, Mark Rogalski, said that the latest report contained ‘yet more guidance from COSO on how to make your company less productive by burdening it even more with non-productive things to do’ referring to the internal control guidance the 2009 report contains. He said that there was no industry sector-specifi c advice and that a ‘one-size-fi ts-all’ approach to internal control was ‘ridiculous’. He further argued that there was no link between internal controls and external reporting, and that internal controls are unnecessary for effective external reporting.

Another commentator, Claire Mahmood, wrote a reply to Rogalski’s column pointing to the views expressed in the 2009 COSO report that, ‘over time effective monitoring can lead to organisational effi ciencies and reduced costs associated with public reporting on internal control because problems are identifi ed and addressed in a proactive, rather than reactive, manner.’ She said that these benefi ts were not industry sector specifi c and that Rogalski was incorrect in his dismissal of the report’s value. She also said that although primarily concerned with governance in the USA, the best practice guidance from COSO could be applied by companies anywhere in the world. She said that although the USA, where COSO is based, is concerned with the ‘rigid rules’ of compliance, the advice ought to be followed by companies in countries with principles-based approaches to corporate governance because it was best practice.

Required:

(a) Distinguish between rules-based and principles-based approaches to internal control system compliance as described by Claire Mahmood and discuss the benefi ts to an organisation of a principles-based approach. (7 marks)

(b) Mr Rogalski is sceptical over the value of internal control and believes that controls must be industry-specifi c to be effective. Required: Describe the advantages of internal control that apply regardless of industry sector and briefl y explain the meaning of the statement, ‘unmonitored controls tend to deteriorate over time’. Your answer should refer to the case scenario as appropriate. (10 marks)

(c) The COSO report explains that ‘assessment of internal controls [can] ... involve a signifi cant amount of ... internal audit testing.’ Required: Defi ne ‘internal audit testing’ and explain the roles of internal audit in helping ensure the effectiveness of internal control systems. (8 marks)