Patent Application
20060129441
The invention relates generally to computer software program products and more particularly to automation of enterprise, public entity, and corporate governance, documentation, reporting, and management of financial controls such as mandated in the Sarbanes-Oxley Act of 2002 and similar requirements of regulatory bodies.
Definitions
The description of the invention will utilize certain terms of art known to those skilled in the practice of audit, public accounting, corporate governance, internal controls, financial management, and financial reporting. The following terms are taken from references and incorporated herein for convenience for use in the claims.
Sources/References:
COSO is a voluntary private sector organization dedicated to improving the quality of financial reporting through business ethics, effective internal controls, and corporate governance. COSO was originally formed in 1985 to sponsor the National Commission on Fraudulent Financial Reporting, an independent private sector initiative which studied the causal factors that can lead to fraudulent financial reporting and developed recommendations for public companies and their independent auditors, for the SEC and other regulators, and for educational institutions.
COSO Enterprise Risk Management Framework
Recognizing the need for definitive guidance on enterprise risk management, COSO initiated a project to develop a conceptually sound framework providing integrated principles, common terminology and practical implementation guidance supporting entities' programs to develop or benchmark their enterprise risk management processes. A related objective is for this resulting framework to serve as a common basis for managements, directors, regulators, academics and others to better understand enterprise risk management, its benefits and limitations, and to effectively communicate about enterprise risk management issues.
Enterprise Risk Management (ERM)
Enterprise risk management is a process, effected by an entity's board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. The underlying premise of enterprise risk management is that every entity, whether for-profit, not-for-profit, or a governmental body, exists to provide value for its stakeholders. All entities face uncertainty, and the challenge for management is to determine how much uncertainty the entity is prepared to accept as it strives to grow stakeholder value. Uncertainty presents both risk and opportunity, with the potential to erode or enhance value. Enterprise risk management provides a framework for management to effectively deal with uncertainty and associated risk and opportunity and thereby enhance its capacity to build value. Enterprise risk management consists of eight interrelated components. These are derived from the way management runs a business, and are integrated with the management process. The components are: Internal Environment, Objective Setting, Event Identification, Risk Assessment, Risk Response, Control Activities, Information and Communication, and Monitoring.
Internal Control Integrated Framework
The report entitled “Internal Control Integrated Framework”, was commissioned by the Committee on Sponsoring Organizations of the Treadway Commission commonly referred to as COSO. It establishes a common definition of internal control that services the needs of different parties for not only assessing their control systems, but also determining how to improve them.
Internal Control
Internal control is broadly defined as a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations, Reliability of financial reporting, Compliance with applicable laws and regulations. Internal control consists of five interrelated components. These are derived from the way management runs a business, and are integrated with the management process. The components are: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring.
Control Objective
Control Objectives are quantifiable, measurable, achievable business goals. Within this context, Control Objective relates to the preparation of reliable published financial statements, including interim and condensed financial statements and selected financial data derived from such statements, such as earnings or Net Asset Value (NAV). Within the context of COSO, objectives can be Strategic, Operational, Reporting or Compliance related in nature.
Operations Objectives
Operations objectives relate to the effectiveness and efficiency of the entity's operations. They include related sub-objectives for operations, directed at enhancing operating effectiveness and efficiency in moving the enterprise toward its ultimate goal. Operations objectives need to reflect the particular business, industry and economic environments in which the entity functions. The objectives need, for example, to be relevant to competitive pressures for quality, reduced cycle times to bring products to market or changes in technology. Management must ensure that objectives reflect reality and the demands of the marketplace, and are expressed in terms that allow meaningful performance measurements. A clear set of operations objectives, linked to sub-objectives, is fundamental to success. Operations objectives provide a focal point for directing allocated resources; if an entity's operations objectives are not clear or well conceived, its resources may be misdirected.
Reporting and Financial Reporting Objectives
Reliable reporting provides management with accurate and complete information appropriate for its intended purpose. It supports management's decision making and monitoring of the entity's activities and performance. Examples of such reports may include results of marketing programs, daily sales flash reports, production quality, and employee and customer satisfaction results. Reliable reporting provides management reasonable assurance of preparation of reliable reports for external dissemination. Such reporting includes financial statements and footnote disclosures, management's discussion and analysis, and reports filed with regulatory agencies.
Compliance Objectives
Entities must conduct their activities, and often take specific actions, in accordance with relevant laws and regulations. These requirements may relate to markets, pricing, taxes, the environment, employee welfare and international trade. Applicable laws and regulations establish minimum standards of behavior, which the entity integrates into its compliance objectives. For example, occupational safety and health regulations might cause a company to define its objective as, “Package and label all chemicals in accordance with regulations.” In this case, policies and procedures would deal with communication programs, site inspections and training. An entity's compliance record can significantly either positively or negatively affect its reputation in the community and marketplace.
Top-Level Reviews
Management at various levels should review the results of performance, contrasting those results with budgets, competitive statistics, and other benchmark measurements. Management actions to follow-up on the results of these top-level reviews and to take corrective action represent a control activity.
Direct Functional or Activity Management
Managers running functions or activities review operational reports. A manager responsible for a bank's consumer loans reviews reports by branch, region and loan (collateral) type, checking summarizations and identifying trends, and relating results to economic statistics and targets. In turn, branch managers receive data on new business by loan-officer and local-customer segment. Branch managers also focus on compliance issues, reviewing reports required by regulators on new deposits over specified amounts. Reconciliations are made of daily cash flows, with net positions reported centrally for overnight transfer and investment.
Information Processing
A variety of controls are performed to check accuracy, completeness and authorization of transactions. Data entered is subject to on-line edit checks or matching to approved control files. A customer's order, for example, is accepted only after reference to an approved customer file and credit limit. Numerical sequences of transactions are accounted for; exceptions are followed up and reported to supervisors. Development of new systems and changes to existing ones are controlled, as is access to data, files and programs.
Physical Controls
Equipment, inventories, securities, cash and other assets are secured physically and periodically counted and compared with amounts shown on control records.
Performance Indicators
Relating different sets of data—operating or financial—to one another, together with analyses of the relationships and investigative and corrective actions, serves as a control activity. Performance indicators include, for example, staff turnover rates by functional unit. By investigating unexpected results or unusual trends, management identifies circumstances where an insufficient capacity to complete key processes may mean that objectives have a lower likelihood of being achieved. How managers use this information—for operating decisions only, or to also follow up on unexpected results reported by external financial reporting systems—determines whether analysis of performance indicators serves operational purposes alone or external financial reporting control purposes as well.
Segregation of Duties
Duties should be divided or segregated among different people or functions to reduce the risk of error or inappropriate actions. This is a basic and important internal control procedure.
Preventive, Detective, and Corrective Control Classifications
Controls can be designed to either 1) Identify errors as they occur and prevent them from further processing; or 2) Detect and correct errors that already have entered the system. There are trade-offs for each approach. Preventive controls are more timely and help ensure that errors are never recorded in the accounting records to begin with. Detective controls may be cheaper to design and perform but are performed after the fact, potentially compromising the accounting system for extended periods of time. Both types of controls contain both an error detection and correction component.
Control Impact
Controls have varying degrees of importance within companies. Companies must distinguish between routine, key, and entity level controls. Routine controls, by themselves, are considered less material in nature than key or entity level controls thus having less impact. It is critical for companies to identify this impact level for their controls in order to prioritize which controls need constant monitoring, testing, and evaluation. This ensures that company resources are utilized in the most efficient manner and that proper attention is given to areas of higher risk.
Control Evaluation
In order to maintain an adequate internal control infrastructure, all standards (and now law) prescribe that management should regularly evaluate the effectiveness and efficiency of the controls that have been instituted. There are various methods by which management would perform Control Evaluations including Control Self Assessment, Peer Review, and Internal Audit work-plans. The goal of a Control Evaluation is to determine if the Control properly mitigates the associated risk and if it is efficient in doing so. It is necessary to determine if the control should be kept as is, modified or replaced.
Control Test
A Control Test is an activity performed for a particular control that will provide evidence to enable management to determine if that control is operating effectively. There are a number of factors that go into determining what type of test is performed, how often, by whom, and to what extent.
Accounting Process
In general, the Accounting Process entails identifying, measuring, recording, and communicating economic information to permit informed judgments and decisions by users of the information. In order to achieve this objective, individual Accounting Processes are established for the significant accounts of an organization. Collectively, these individual Accounting Processes exist to enable the overall Accounting Process.
Accounting Sub-Process
At a more detailed level, sets of rules and procedures, each called an Accounting Sub-Process, is defined for specific accounts to achieve the aforementioned for each Accounting Process.
Risk
Risks are potential or existing barriers to achieving Control Objectives.
Control (Control Activity or Control Point)
A Control is a process or activity put in place within the business to manage risks. Controls can be set up to run automatically within systems or can be manually performed by employees on a regularly scheduled basis or as needed. Controls can also be designed to prevent risks from occurring or for detecting and correcting problems as or shortly after they occur. Controls can be of varying degree of importance depending on the risk that the control is designed to mitigate and at what level in the organization the control resides. Controls are also referred to as Control Points which as the term implies, are designed to mitigate risks at specific points in a process or at a critical review time.
Control Definition
Control Definition is the end result of a process of determining and documenting how, when, and by whom the Control is to be performed. The Control Definition includes either general guidance or specific rules for performing the control and determining whether or not the risk has been properly mitigated.
Control Self-Assessment
Control Self-assessment is a method of control review by which a company can evaluate control effectiveness. These assessments are generally performed by employees that are involved in the actual process that is being assessed. Self-assessments allow companies to empower individuals to evaluate the effectiveness of their own control assignments. This is particularly important as control theory evolves to a decentralized approach where all employees should have a role in properly controlling a company.
Remediation
Remediation is a process by which controls deemed ineffective through evaluation, assessment, or testing are improved or replaced in order to properly mitigate their associated risk. This process needs to be well documented and can also lead to a public disclosure if the control ineffectiveness was judged to be of a material nature.
Exception
An exception is an outcome of a control evaluation in which the control is determined to not be functioning as originally designed. An exception by itself does not necessarily indicate a control breakdown. Judgment is rendered to determine if a remediation is necessary.
Monitoring
Internal control systems need to be monitored—a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.
Auditor Control Objective
An Auditor Control Objective is slightly narrower in scope than a Business or Control Objective and has a different purpose. An Auditor Control Objective is a goal that an external auditor would test against to ensure that numbers generated by a particular process were accurately arrived at and materially correct. If the auditor determines through testing that the Auditor Control Objective has been met, the auditor can then rely on the materiality of the numbers without manually calculating and tallying every transaction within the process.
Standard Errors (or Assertions)
Financial statement amounts and disclosures embody what are known as financial statement assertions. These assertions are further collectively broken down into various assertions or standard errors, characteristics of accuracy over the financial statements amounts and disclosures e.g. Does the asset exist (existence)? Did the transaction occur (occurrence)?.
Financial Statement Accounts
Financial Statement Accounts are those accounts that are listed on the Financial Statements for the purpose of reporting on economic performance and status of a business entity as a whole, prepared for all decision makers outside the company.
References
A reference is a piece of work, either a narrative or diagram, containing useful information that an employee or auditor can utilize (or refer to) if needed while performing control related activities.
Unqualified Attestation
In the context of Sarbanes-Oxley Section 404, an Unqualified Attestation is an External Auditor's communication of a positive conclusion about the reliability of management's assessment of the effectiveness of the company's internal control over financial reporting. An Unqualified Attestation is given only when there are no identified material weaknesses and when there have been no restrictions on the scope of the auditor's work.
COSO Definition of Internal Control
Internal control is a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations, Reliability of financial reporting, Compliance with applicable laws and regulations
Key Concepts
Internal control is a process. It is a means to an end, not an end in itself. Internal control is effected by people. It's not merely policy manuals and forms, but people at every level of an organization. Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity's management and board. Internal control is geared to the achievement of objectives in one or more separate but overlapping categories. Multinational, diversified public corporations may have in excess of 1000 control objectives in management accounting, financial reporting, and compliance with legal requirements. Supporting each objective are multiple procedures and controls. A company may have many thousand controls, which may be applicable daily, weekly, monthly, or quarterly according to their risk and benefit to the shareholders. It is traditional that, guided by external auditors, the CFO and his staff created policies and procedures in printed paper form which merely documented controls, what were best practices, without absolutely making sure that all employees followed the policies through. These were referred to as the control binders. Testing the effectiveness and implementation of these best practices consisted of periodic meetings between performers and auditors to verbally confirm that the policies were established, still applicable, and followed. Staying in compliance by ensuring that all of these control activities are executed, remediating errors, and attesting to their correctness is now mandated by SEC rules implementing the Sarbanes-Oxley Act of 2002.
Business people, regulatory organizations and investors have become acutely aware of irregularities in financial control management. The Sarbanes-Oxley Act supported by all but 3 members of Congress was passed in response to the breakdown in corporate checks and balances that cost investors hundreds of billions of dollars in losses.
For too long, too many companies have lacked adequate internal controls. In recent years more than a thousand public companies have issued corrections for errors in their financial statements. Auditors who used to test all the controls in which they were relying annually, cut back on the level of their tests significantly as they faced pressures to reduce their fees.
In the process of documenting their existing financial control environments which many had assumed were essentially complete, project managers have discovered a significant level of effort in the level of testing needed, the addressing of deficiencies discovered, and the documentation sufficient to support attestation by the auditors.
Other categories of compliance mandates could fall in a wide range of areas, including industry-specific (e.g. HIPPA), safety-related (OSHA), quality-related (ISO 9000, six sigma), global (NAFTA, WTO), or financial markets-related (NASDAQ, NYSE). They could be directed to customer support (service level agreements), banking (lending covenants), or supplier requirements (terms of purchasing agreements). Finally and perhaps more commonly, organizations will develop company-specific policies, procedures, and tasks which will incorporate the operating and cultural environment of the company and industry.
As if designing, implementing, running and evaluating the system were not enough, companies will need to identify factors and drivers of change to the financial control management system and quickly make and implement those changes on a regular and timely basis. A number of internal and external factors can drive the change. Internally, they include new corporate policies (in any functional area); the acquisition of a company or product line and major change in operational performance; and changes in personnel, documents or information. External factors that will drive changes to the financial control system include regulatory changes (e.g. new sections of federal law, new interpretations of accounting standards, tax law), competitive actions, supplier agreements, and lending institutions among others. Therefore, not only will establishing a comprehensive, systematic financial control system take time, training, and money, maintaining and sustaining it will require constant monitoring, evaluation, and maintenance.
The current problem with manuals of procedures is that there is no economically repeatable way to analyze the degree of compliance over time or across organizational entities. Nor is there a way to consistently score and evaluate how an organization is improving over time. There may not be objective measurements of the effectiveness of the control or tracking of remediation when controls are found ineffective. Nor is there enough information to make a business judgment on the urgency or importance of correcting an error or omission. A manual report on compliance to control binders cannot be automatically rerun to check if corrections have been effective.
Summary of Invention
Accordingly, what is needed is an improved system of providing processes and automation to make compliance to new standards of internal control successful, economical, and verifiable. The present invention includes both apparatus and methods to automate both the efficient establishment of an complete and automated control system as well as ongoing, continuously measured and improved processes of ensuring appropriate internal control.
During the design and deployment phase which encompasses installation, configuration, and evaluation phases of deploying a system of controls, the present invention increases productivity by requiring lower skill levels for participation. A template-tized creation system allows non-programmers to develop systems of controls, evaluations, and tests for systems they are familiar with as users or financial professionals.
The underlying architecture uses twin hierarchies cross linked to each other as well as to lists of context data to provide efficiency, flexibility and to provide for better analysis of resulting transactional data. One hierarchy provides a framework to organize possibly thousands definitions of financial controls and their associated evaluations and tests. The other hierarchy provides a framework to describe an enterprise or organizational structure ultimately to the level at which user roles to be associated with the design and operation of financial controls can be automated.
Each member of the definition hierarchy has a data element specifying its frequency of application and a relationship to the framework recommended by industry reporting standards bodies. The use of templates for the definitions simplifies the development and maximizes reuse. The other hierarchy reflects the responsibility of performing controls, evaluations, and tests as well as providing for the assignment of escalation or follow up roles. Personnel or performers in an enterprise are organized into a hierarchy of units which may be geographical, functional, market, historical or any mixture of legacy organizational structures. Linking of higher level nodes in the twin hierarchies allow for more efficient assignment of one or more controls to many units and vice versa.
The present invention enables the rapid integration with legacy systems by use of templates which drive existing backend applications to present integrated user interfaces. In contrast to previous approaches which either emphasize the automation of creating documentation or the self documenting nature of writing software, the present invention enables without the need for programming skills the definition of a self-executing internal control system by means of preparing the documentation of the internal controls and the assignment of performers. The nature of the definitions prepared for the internal control hierarchy encompass the control itself, its method of being evaluated, as well as a set of tests of the control. As a result of having the controls related in a hierarchy according to the objectives and risks prioritized by the entity, management can review the evaluations and tests in preparation for its assertion of compliance and external audit organizations can review the hierarchy of definitions and their test results as support for their attestation of complete compliance.
In the production and continuous improvement phase of the present invention, the present invention coordinates the timely delivery of information to performers responsible for performing elements of the internal control system. Every control is defined with a type of frequency according to its relevant financial period and is automatically scheduled with appropriate lead time prior to the due date. Each assigned performer receives a customized email with a url to obtain detailed directions, data, and the on-line resources needed for that activity. A process template delivered to the user's client workstation is populated by the selected process template data defined during the design/deployment phase and his submitted results recorded. The Application Container offloads formatting and interactivity to the client browser at the user's desktop and assembles the routed data and provides a mini-application. Parameters in each control allow reminders or escalation steps to occur in a timely manner according to action or even non-action thereby losing no transaction.
In short, to assure regulators, stockholders, tax-payers, customers, and suppliers to large public and private entities that proper and thorough internal control have been established and are respected, new standards of responsibility, behavior, and measurement have come into use. The present invention makes it possible not only to economically comply with these new reporting requirements but also leverage these investments to contribute to the day-to-day efficient operation of the entity in its main business processes by addressing risks to attaining its objectives.
a and 3b Units and Sub-Unit List Data Sample and Detail Sample
a-d Internal Control Definition Sample
Detailed Description While this invention is susceptible of embodiments in many different forms, there is shown in the drawings and will herein be described in detail preferred embodiments of the invention with the understanding that the present disclosure is to be considered as an exemplification of the principles of the invention and is not intended to limit the broad aspect of the invention to the embodiments illustrated.
Referring now to
Referring now in detail to
Each member of the Control Hierarchy Structure named above may have encoded upon the computer readable medium a reference to an element of a repository disclosed as Context Data also encoded upon a computer readable medium to control the operation of the invention. Each Control which may be executed, evaluated, or tested has a default or specified performer assigned from the members of the Unit Hierarchy element of Context Data.
Within the Context Data is shown the Unit Hierarchy of users responsible for creating, performing, evaluating, or testing the Controls. Their responsibility may be assigned individually or by means of the hierarchy. Any level of the Control Hierarchy may be assigned to an individual in the Unit Hierarchy who shall be the default performer of every control below that level of Control. These defaults may be overridden by further assignment by category or by specific assignment to an element lower in that Control Hierarchy. Failure or delay of an assigned individual to perform a control in a timely manner automatically invokes an escalation procedure by the scheduler which will contact the person designated in the Unit Hierarchy. Thus it will be observed that the Unit Hierarchy may be distinguished from a traditional table of organization because the knowhow and appreciation of performing controls will frequently not correspond to the chain of command authority.
Also with the repository of Context Data is information useful to users which may be referenced by the Controls but is not embedded in each control for efficiency. The business logic behind each control, use of standard language in creating or modifying controls, identification of regulatory or audit requirements that are pertinent to the controls and their ranges of acceptability are all centralized in the context data structure.
Referring now to
Referring in detail to
The final steps control the operation of a computer system by specifying if the scheduler shall notify all units defined in the unit structure, a plurality of units by linking to a list of Units, or a plurality of unit categories by linking to unit categories or not assigning controls to any units for automatic scheduling. In each case, it is possible to set specific overrides to default assignments to deal with unique and exceptional situations. In contrast to other implementations of controls, the definition of the control documents both the frequency of being run and the performer who must participate.
Referring now to
Referring now in detail to
Referring now in detail to
Referring now in detail to
Referring now to
Referring now to
Referring now to
Referring now to
In this example the performer is instructed to execute a query on the General Ledger system and manually enter the corresponding value from their bank and record if the amounts reconcile. In this example the document is marked as a completed control for the record. Note that various buttons are selectively displayed or rendered inoperable according to the status of the control. The present invention controls the operation of the computer system in scheduling the preparation of this document, determining the buttons and fields shown on the document, determining the text content of the document, transmitting the document to the assigned performer and monitoring performance, escalating the document if performance does not occur in a timely manner, and scoring the compliance and recording out of compliance results thereby automating an internal financial control system.
Referring in detail to
Referring in detail to
Only two levels of hierarchy are mandatory, the Control and the Control evaluation. At installation, the other levels may be deselected for a simpler implementation. They will be hidden from the user post-installation. There may be multiple Major Areas or not as may be the case. For each Major Area there may be a plurality of Accounting Processes. For each Accounting Process there may be a plurality of Accounting Sub-Processes. For each Accounting Sub-Process there may be a plurality of Objectives. For each Objective, there may be a plurality of Risks. For each Risk, there may be a plurality of Controls. The heart of the system are the Controls and Control Evaluations. The hierarchy above them is for clarity of organization and convenience of assignment. Controls and Control Evaluations are paired. Each Control may have a plurality of Tests. The list of Abbreviations is shown when any specific control is being displayed as a hierarchical path to locate the control within the hierarchy.
Note also the control self-assessment setting. If the Use Control Self Assessment radio button was set to No, the related selection would be not shown or in gray. If Yes, then the installer may select from available Self Assessment levels and set the frequency that the organization wishes to perform self-assessment. Finally an optional rollup of the self-assessments is offered and in this case denied.
The degree of detail for management's assertion of control efficacy is selectable and the appropriate documentation for the auditor's attestation is automatically created to support the assertion and attestation.
Referring now to
Referring now to
Preferred embodiment In the preferred embodiment of the present invention everything
Because it is based on a production-proven, scalable business process management platform, it proactively monitors and manages all the reminders and follow-up needed across an entire organization to ensure that internal control activities are completed correctly and on time. It is designed specifically for Sarbanes-Oxley control documentation and ongoing monitoring.
In contrast with systems of previous design,
Control Definition The present invention provides a straightforward, structured method for defining internal controls.
Control Execution The present invention ensures that each and every control is executed on time, correctly, and completely while providing full visibility into the process.
Annual Control Evaluation The present invention enables management to meet its evaluation obligation under the Sarbanes-Oxley. It drives the annual control evaluation process while offering full visibility into the status and results of the ongoing process.
The foregoing description of the embodiments of the invention are to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes that come within the meaning and range of equivalency of the claims therefore are intended to be embraced therein. The embodiment described is selected to best explain the principles of the invention and its practical application to thereby enable others skilled in the art to best utilize the invention in various embodiments and with various modifications as suited to the particular purpose contemplated. In particular, Applicants contemplate that functional implementation of invention described herein may be implemented equivalently in hardware, software, firmware, and/or other available functional components or building blocks. Other variations and embodiments are possible in light of the above teachings, and it is thus intended that the scope of the invention not be limited by this Detailed Description, but rather by claims following.
