Page 277 - COSO Guidance

Monitoring activities principle 17: Evaluates and
communicates deficiencies

With regard to this principle, the framework states that the organization evaluates and communicates
internal control deficiencies in a timely manner to those parties responsible for taking corrective action,
including senior management and the board of directors as appropriate.

The following three points of focus contained in the framework relate to this principle:

 Point of focus — Assesses results
Management and the board of directors, as appropriate, examine the findings of ongoing and
separate evaluations.

Assessing the ongoing and separate evaluation findings might identify weaknesses in the system of
internal control that are so severe that the entity’s objectives might not be achieved. Additionally, the
evaluation might identify opportunities to enhance the efficiency of the system of internal control or
point to changes that could be made to increase the likelihood that the entity’s objectives will be met.
For example, the board of directors for a local not-for-profit might be presented with a finding that
there is inadequate segregation of duties in the cash-receipts system that is so severe that errors or
irregularities could occur that would be material to the financial statements and would likely not be
prevented or detected by employees in the normal course of performing their assigned duties. The
noted finding is that the person who records transactions to accounts receivable also has access to
cash. The board of directors might also be presented with an alternative (opportunity) to implement a
more efficient method of processing cash receipts that also provides assurance that the entity’s
financial reporting objectives are met, such as the entity’s use of a bank lockbox. In this situation, the
bank will forward a detailed list of cash receipts to the entity’s bookkeeper for posting to accounts
receivable. The bookkeeper will not have access to cash because all customer cash payments are
sent directly to the bank.
 Point of focus — Communicates deficiencies

Deficiencies are communicated to parties responsible for taking corrective action and to senior
management and the board of directors, as appropriate.
Relevant discussion of this point of focus is provided in a later section.

 Point of focus — Monitors corrective actions

Management tracks whether deficiencies are remediated on a timely basis.

For example, in the local not-for-profit discussed previously, management or the board of directors
would obtain assurance (through inquiry or written reports) that the entity did indeed establish a bank
lockbox to receive all cash receipts.

© 2020 Association of International Certified Professional Accountants. All rights reserved. 7-7