Business Environment & Concepts (BEC) –
|Business Environment and Concepts (BEC) |
|Area |Current CSOs |New CSOs |
|Area I |Business Structure (17-23%) |Corporate Governance (16-20%) |
|Area II |Economic Concepts (8-12%) |Economic Concepts and Analysis (16-20%) |
|Area III |Financial Management (17-23%) |Financial Management (19-23%) |
|Area IV |Information Technology (22-28%) |Information Systems and Communication (15-19%) |
|Area V |Planning and Measurement (22-28%) |Strategic Planning (10-14%) |
|Area VI |N/A |Operations Management (12-16%) |

Controls over Business Processes • segregation of duties: for each transaction cycle, the functions of authorization, approval, execution (custody of assets) and recordkeeping should be segregated (manual- different individuals performing functions, technology-based- controlling access and passwords)
Sales & Collections Business Process
|Risk |Nature of Process |Examples Controls |
|Inaccurate or incomplete sales data and lack |Sales orders inputted manually |• Password control over terminals to assure that sales are |
|of security over sales order information | |authorized by sales department |
| | |• Accuracy and completeness controls over inputs |
| | |• Physical controls over terminals and files |
| | |• Encryption of transmitted data |
| | |• accuracy and completeness controls over inputs |
| | |• Password control over access to information to maintain a |
| |Sales over the internet |segregation of duties |
| | |• Data controls to ensure that sales prices are accurately |
| | |inputted and updates |
|Sales to customers that are not creditworthy |Outsource credit to credit card company |• Protect credit card info with password control and |
| | |physical security over terminals and files |
| |Organization has credit department that |• Credit departments should be independent of sales function|
| |extends credit |and approve credit limits |
| | |• Effective practices for collecting credit information to |
| | |make evaluations to grant credit |
|Maintaining too much or too little inventory |Inventory control and management |• Use of perpetual inventory system |
| | |• Use of techniques such as JIT, EOQ, and reorder points as |
| | |method of managing inventory |
| | |• Heavy reliance on technology to determine when and how |
| | |much to order |
|Inaccurate filing of orders |Manual filing of orders |• Have an individual not involved in filling the order check|
| | |it for accuracy |
| |Technology used to fill orders |• Input controls to assure information is correct in |
| | |computer process |
| | |• Use technology such as bar code scanners to pack goods |
|Inaccurate billing of customers |Manual billing process |• Individual doing billing match sales order to shipping document|
| | |to ensure accuracy of billing invoice |
| | |• Use of pre-numbered documents and accounting for all |
| | |documents |
| | |• Invoice checked for clerical accuracy by an individual not|
| | |involved in preparation |
| | |• Billing department is independent of individuals |
| | |maintaining receivables records |
| | |• Account for numerical sequence of documents |
| | |• accuracy and completeness input controls to assure billing|
| | |information is accurate and based on accurate shipping info input by|
| | |shipping personnel |
| | |• accuracy and completeness controls to assure that pricing |
| |Technology used for billing |information is accurate and based on authorization from sales |
| | |department |
| | |• password control over terminals to insure segregation of |
| | |duties |
|Failure to bill for shipment |Manual billing process |• Accounting for all prenumbered shipping documents |
| | |• Accuracy and completeness input controls to assure that |
| |Technology used for billing |all shipping information is entered to the system for billing |
|Errors or fraud in processing and depositing |Cash receipts received through the mail |• Segregation of cash handling form A/R records or use of a |
|cash receipts | |lockbox at a financial institution |
| |Electronic funds transfer system |• Control over access to the system through the use of a |
| | |password system |
| | |• Use of accuracy and completeness controls over input or |
| | |cash receipt info |
|Accounts may be written off without |Manual |• Individual independent of sales and cash receipts should |
|authorization | |be authorized to write off accounts |
| | |• Use of prenumbered authorization forms |
| | |• Accounting for all forms |
| | |• Access to terminal for authorization by independent |
| | |individual should be restricted by password system |
| |Technology –bases system | |

Acquisition & Payments Process
|Risk |Nature of Process |Example Controls |
|Ordering unneeded goods |Manual or technology-based system |• Use of perpetual inventory system|
| | |• ordering based on inventory |
| | |management techniques, such as JIT, EOQ, |
| | |and reorder points |
|Purchasing goods from unauthorized vendors |Manual or technology-based system |• Establish preferred vendor |
| | |relationships |
| | |• establish criteria for authorized|
| | |vendors |
| | |• Creation of purchase orders |
| | |• Accuracy and completeness |
| | |controls over inputting of purchasing info |
| | |into the computers |
| | |• password control over terminals |
|Receiving goods that were not ordered |Manual system |• Matching of purchase order to |
| | |good received |
| |Technology-based system |• Computer comparison of purchase |
| | |info input by the purchasing department |
| | |with info on goods received inputted by the|
| | |receiving departments |
|Receiving goods that damaged or inferior |Manual or technology-based system |• Inspect goods received |
|Payment for goods not received |Manual system |• Matching of purchase orders with |
| | |receiving reports |
| |Computer generation of payments based on |• Accounting for all prenumbered |
| |purchase and receiving info |documents |
| | |• Individual authorized to sign |
| | |checks is independent of those maintaining |
| | |records and receiving goods |
| | |• Check signer cancels supporting |
| | |documentation |
| | |• Accuracy and completeness input |
| | |controls for purchase and receiving |
| | |information |
| | |• Segregation of those maintaining |
| | |records and processing payments from those |
| | |authorized to make payments |
| | |• Password control to ensure |
| | |segregation of duties |
|Payment for purchase twice |Manual system |• Cancel supporting documents for |
| | |all payments |
| |Technology-based system |• Control access to receiving and |
| | |purchasing information by use of passwords |
| | |and appropriate segregation of duties |
|Unauthorized cash payments |Manual system |• Segregation of duties of |
| | |accounting and authorized check signers |
| | |• Reconciliation of bank account by|
| | |individual independent of individuals |
| | |preparing and signed checks |
| | |• Passwords and controls over |
| |Technology-based system |terminals prevent issuance of unauthorized |
| | |payments |
| | |• Reconciliation of bank account by|
| | |computer or independent individual |
|Loss or theft of assets |Manual or technology-based system |• Periodic reconciliation of |
| | |physical assets to accounting records by |
| | |individuals independents of individuals |
| | |having custody of the assets and |
| | |individuals maintaining the accounting |
| | |records for the assets |
| | |• reconciliation of bank accounts, |
| | |taking physical inventories, and |
| | |inventories of supplies and equipment |

Additional Controls over Inventories 1. Perpetual inventory records for large dollar items 2. Pre-number receiving reports prepared when inventory received; receiving reports accounted for 3. Adequate standard cost system to cost inventory items 4. Physical controls against theft 5. Written inventory requisition used 6. Proper authorization of purchases and use of pre-numbered purchase orders
Controls over Payrolls 1. Segregate timekeeping, payroll preparation, personnel, and paycheck distribution 2. Time clocks used when possible 3. Job time tickets reconciled to time clock cards 4. Time clock cards approved by supervisors (overtime and regular hours) 5. Treasurer signs paychecks 6. Unclaimed paychecks controlled by someone otherwise independent of the payroll function (locked up and eventually destroyed if not claimed). In cases In which employees are paid cash (as opposed to checks) unclaimed pay should be deposited into a special bank account. 7. Personnel department promptly sends termination to the payroll department.
Controls over Fixed Assets 1. Major asset acquisition are properly approved by firm’s board of directors and properly controlled through capital budgeting techniques. 2. Detailed records are available for property assets and accumulated depreciation. 3. Written policies exist for capitalization vs. expensing decisions. 4. Depreciation properly calculated. 5. Retirements approved by an appropriate level of management. 6. Physical control over assets to prevent theft. 7. Periodic physical inspection of plant and equipment by individuals who are otherwise independent of PPE (internal auditors)
Change Control Process • management must effectively control the inevitable changes that occur in processes, policies and procedures, and systems • an effective control process enables management to control: o change requests o change analyses o change decisions o change planning, implementation and tracking • system of documentation should be established to ensure that changes are authorized, communicated, and documented • changes should be thoroughly tested before being implemented

COSO Internal Controls • number of internal control frameworks used as benchmarks • most common is US in Internal Control- Integrated Framework developed by COSO, defines internal control as: o a process, effected by the entity’s board of directs, management, and other personnel designed to provide reasonable assurance regarding the achievement of objectives in the categories of (1) reliability of financial reporting, (2) effectiveness and efficiency of operations, and (3) compliance with applicable laws and regulations
COSO Internal Control 1. The Control Environment • sets the tone of an organization by influencing the control consciousness of people • may be viewed as the foundation for other components of internal control • includes: o Integrity and ethical values: management should establish a tone at the top of the organizations that encourages appropriate behavior; top management should communicate these values through a code of conduct, official policies, and by example o Commitment to competence: employees should possess the skills and knowledge essential to performing their jobs, especially when they are responsible for performing important control functions o Board of directors or audit committee: the control environment is significantly influenced by the effectiveness of the board of directors and its audit committee o Management’s philosophy and operating style: management that takes undue risks or stresses making profit goals by any means can create an environment where employees are motivated to engage in unethical or illegal activities o Organizational structure: provides a basis for planning, directing, and controlling operations o Assignment of authority and responsibility: personnel need a clear understanding of their responsibilities and the rules and regulations that govern their actions; communicated through job descriptions and organizational charts o Human resources policies and procedures: control environment is enhance by effective policies and procedures for hiring, training, evaluating, promoting, and compensation 2. Risk Assessment • requires that management have a system of risk assessment • management’s process for identifying, analyzing, and responding to risks 3. Control Activities • policies and procedures that help ensure that management directives are carried out • promote actions that address the risks that face the organization • include performance reviews, information processing controls, physical controls, and segregation of duties 4. Information and Communication • to make effective decisions, managers must have access to timely, reliable and relevant information • should be implemented to capture information and process, summarize and report the information on an accurate and timely basis • involves providing employees with an understanding of their roles and responsibilities and open communication channels 5. Monitoring • process used to assess the quality of internal control performance over time • may be achieved by performing ongoing activities or by separate evaluations o Ongoing monitoring activities: include regularly performed supervisory and management activities, such as continuous monitoring of customer complaints, or review the reasonableness of management reports o Separate evaluations: performed on a non-routine basis, such as periodic audits by internal auditors • technology has enhanced an organization’s ability to monitor internal controls and risk (embedded modules to look for unusual or suspicious transactions or relationships) u --
Product differentiation- involves modification of a product to make it more attractive to the target market or differentiat between competitor's product