CBOK Requirements: Importance of Internal Controls
CBOK Requirements: Importance of Internal Controls
CBOK Requirements: Importance of Internal Controls
The four chapters in Part Two of this book introduce some common practices that are essential knowledge
requirements for every internal auditor. Chapter 3 discusses how enterprises and their internal auditors went for
many years without a clear and consistent understanding of the meaning and concept of internal controls. These
defi- nitions were resolved and clarified, however, through the Committee of Sponsoring Organizations (COSO)
internal control framework, a three‐dimensional description or model of how an enterprise should organize and
think of its internal controls. Origi- nally launched as sort of best practices description of good internal controls,
the COSO internal control framework has become first the U.S. and now a worldwide standard for defining and
establishing good internal controls. Whether operating in an industry environment, as an IT specialist internal
auditor, or in not‐for‐profit or governmental sectors, every internal auditor should possess a CBOK
understanding of the COSO inter- nal control framework.
The COSO internal control framework was revised and updated in 2014, with the need for a greater emphasis on
fraud management and understanding risks as well as evolving worldwide enterprise organizational structures.
COSO is now supported by a set of 17 internal control principles, a key internal audit knowledge requirement.
The
revised COSO framework and its supporting principles are introduced in Chapters 3 and 4.
The COSO internal control framework was revised and updated in 2014, with the need for a
greater emphasis on fraud management and understanding risks as well as evolving
worldwide enterprise organizational structures. COSO is now supported by a set of 17
internal control principles, a key internal audit knowledge requirement. The
revised COSO framework and its supporting principles are introduced in Chapters 3 and 4.
res in the United States and elsewhere became a clarion call for external auditing and
corporate governance reforms. The result was the Sarbanes‐Oxley Act (SOx) in the United
States, discussed in Chapter 5. SOx defines mandatory rules and reporting standards for many
enterprises, large and small, in the United States and worldwide. Although the SOx
legislation is very broad and has regulations and rules in some areas that may be of little
interest to most internal auditors, a knowledge and understanding of the SOx internal control
review procedures should be a CBOK requirement for all internal auditors working at least
with public corporations. In addition, all internal auditors should have general CBOK
understanding of the SOx internal control and its corporate governance rules.
Chapter 6 introduces another very important internal control framework, the con- trol
objectives for IT, or COBIT. An internal control framework with origins tied to IT audit
specialists, COBIT is important for all internal auditors because IT systems and processes are
pervasive in all aspects of virtually every enterprise today. Whether opera- tional, financial,
or IT specialists, all internal auditors should have at least a high‐level CBOK understanding
of the COBIT framework and how it might apply to their internal audit activities.