Page 274 - COSO Guidance Book

Documentation in a separate evaluation
Documentation in a separate evaluation varies with the entity’s size, complexity, and similar factors.

Larger entities typically have written policy manuals, organization charts, written job descriptions,
operating instructions, information systems flowcharts, and other formal documentation. Smaller entities
usually have less documentation. Many controls in smaller entities are informal and not documented yet
are performed regularly and are highly effective. These controls can be tested in the same manner that
documented controls are tested. It is important to note that controls that are not documented do not
indicate an ineffective internal control or one that cannot be evaluated.

Documentation makes the evaluation more efficient, helps employees understand how the system
works, and makes it easier to modify the system when such a need arises.

The nature and extent of documentation normally will become more substantive when statements about
the system or evaluation are made to additional parties. For example, if management were to make a
statement to external parties concerning internal control system effectiveness, then it should consider
developing and retaining documentation to support the statement.

In addition, management should consider documenting the evaluation process.

How to conduct a separate evaluation

The following outlines a suggested action plan for managers who direct evaluations of internal control
systems. This plan includes the following steps:

 Determine the evaluation’s scope based on the categories of objectives, internal control components,
and activities.
 Identify ongoing monitoring activities that routinely provide assurance that internal control is
effective.
 Analyze control-evaluation work by internal auditors and consider any control-related findings of
external auditors.
 Prioritize higher risk areas that need immediate attention.
 Develop an evaluation program with short- and long-range segments based on the previously
mentioned prioritization.
 Arrange for all parties conducting the evaluation to meet to address scope, time frame, tools to be
used, methodology, input from internal and external auditors and regulators, means of reporting
findings, and expected documentation.
 Monitor progress and review findings.
 Ensure that necessary follow-up actions are taken and modify subsequent evaluation segments as
needed.

The principles and associated points of focus for the monitoring activities component of internal control
are detailed in the following material. Examples have been provided to illustrate select points of focus.

© 2020 Association of International Certified Professional Accountants. All rights reserved. 7-4