...United States Government Accountability Office GAO February 2009 GAO-09-232G FEDERAL INFORMATION SYSTEM CONTROLS AUDIT MANUAL (FISCAM) This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office Washington, DC 20548 February 2009 TO AUDIT OFFICIALS, CIOS, AND OTHERS INTERESTED IN FEDERAL AND OTHER GOVERNMENTAL INFORMATION SYSTEM CONTROLS AUDITING AND REPORTING This letter transmits the revised Government Accountability Office (GAO) Federal Information System Controls Audit Manual (FISCAM). The FISCAM presents a methodology for performing information system (IS) control 1 audits of federal and other governmental entities in accordance with professional standards, and was originally issued in January 1999. We have updated the FISCAM for significant changes affecting IS audits. This revised FISCAM reflects consideration of public comments received from professional accounting and auditing organizations, independent public accounting firms, state and local audit organizations, and interested individuals on the FISCAM Exposure Draft issued on July 31, 2008 (GAO-08-1029G)...
Words: 174530 - Pages: 699
...Role of Internal Auditors in the Anti-Corruption Battle John FlahertyThe Challengeh Bribery, and other illicit payments are contrary to the public good. They thwart the competitive process and circumvent laws, regulations, and procedures put in place for the public good. They divert funds from owners, shareholders, and are usually paid as fees, commissions, or are paid without record. The cost to the public totals millions of dollars annually. The US Government is aware of almost 100 cases in which foreign bribes undercut the ability of US firms to win contracts valued at $45 billion in the 12 months before May 1995. "Corruption occurs when someone has monopoly power over a good or a service, has the discretion to decide whether or not you receive it and how much you receive, and lacks accountability." (Robert Klitgaard, Controlling Corruption, 1988). The level of corruption in international business transactions continues to be a critical problem. Companies need both the motivation and the governance practices to discontinue these payments Role of Internal Auditors in the Anti-Corruption Battle John FlahertyThe Challenge Bribery, and other illicit payments are contrary to the public good. They thwart the competitive process and circumvent laws, regulations, and procedures put in place for the public good. They divert funds from owners, shareholders, and are usually paid as fees, commissions, or are paid without record. The cost to the public totals millions of dollars...
Words: 3346 - Pages: 14
...Office of the New York State Comptroller Division of Local Government and School Accountability LOCAL GOVERNMENT M ANAGEMENT GUIDE Management’s Responsibility for Internal Controls Thomas P. DiNapoli State Comptroller For additional copies of this report contact: Division of Local Government and School Accountability 110 State Street, 12th floor Albany, New York 12236 Tel: (518) 474- 4037 Fax: (518) 486- 6479 or email us: localgov@osc.state.ny.us www.osc.state.ny.us October 2010 Table of Contents Who’s Responsible.............................................................................................................. 2 The Origin - Committee of Sponsoring Organizations ......................................................... 4 Integrated Internal Control Framework - The Big Picture ..................................................... 5 The Five Essential Elements of the Internal Control Framework ........................................... 6 Limitations of Internal Controls ..........................................................................................15 The Impact of Information Technology ...............................................................................16 The Role of Internal Auditors and Audit Committees ..........................................................17 Conclusion ....................................................................................................................... 20 Additional Resources...
Words: 8114 - Pages: 33
...Controls at the Bellagio Casino Objectives of the company: To earn profits. Significant amount of income was generated through high-end gaming segment and its over all performance was highly dependent on the volume of customers at its resorts. A highly competitive environment with other gaming and leisure companies. Strategy: Company’s primary methods of successfully competing in these markets: Locating resorts in desirable leisure and business travel markets, and operating at superior sites within those markets. Luxurious and premium customer service. Recruiting and training the best staff. Developing distinctive and memorable marketable and promotional programs. Key performance indicators: Gaming revenue indicators such as table games drop and slot machines handle. Hotel revenue indicators through occupancy and average daily price rate. Increasing use of advanced technologies to help maximize revenue and operational efficiency. Example: By combining the player affinity programs, the players club, and manadalay’s one club into a single program. This enhanced the customer experience and revenue potential. The key strategy to maximize profits this case focuses on is the internal controls adopted by the casino. Internal controls: Extensive government regulation to ensure effective internal controls. Effective Internal Controls were really important in a business such as this where the government had its own share of the pie and the owners of the casino would...
Words: 561 - Pages: 3
...INTERNAL CONTROLS Introduction Internal Controls are to be an integral part of any organization’s financial and business policies and procedures. The objectives of internal controls are: ▪ Protecting resources against waste, fraud, and inefficiency; ▪ Ensuring accuracy and reliability in accounting and operating data; ▪ Securing compliance with the policies of the organization; ▪ Ensuring compliance with applicable laws and regulations; ▪ Evaluating the level of performance in all organizational units of the organization; ▪ Providing management with reasonable assurance that leave and payroll transactions are authorized, valid, complete and accurate; ▪ Safeguarding leave and payroll documents from theft, loss and destruction; and ▪ Internal controls are simply good business practices. The benefits of good internal controls are: ▪ Prevents errors and irregularities from occurring. If errors or irregularities do occur, they will be detected in a timely manner. ▪ Ensures that issues arising from reporting errors are kept to a minimum and quickly resolved. ▪ Protects employees: o By clearly outlining tasks and responsibilities; o By providing checks and balances; and, o From being accused of misappropriations, errors or irregularities. What are Internal Controls? Internal controls are the practices performed by departments to provide management with reasonable assurance that assets are safeguarded and transactions are...
Words: 4448 - Pages: 18
...to make business decisions if financial information failed to reflect business operation and the company’s financial status. Broadly, the market would hurt due to the negative impact on the market efficiency. As a result, COSO, the Committee of Sponsoring Organizations of the Treadway Commission, was formed in 1985. It has published several comprehensive frameworks to help organizations to improve business operation and governance and to avoid fraud. The aim of this report was to study the development of COSO, including its history and main frameworks and guidance regarding internal control, enterprise risk management and fraud deterrence. The report interpreted the three areas under COSO framework with their key compositions and most recent updates. After the detailed interpretation, conclusion and recommendations were given. Keywords: Fraudulent Financial Reporting, COSO, Internal Control, ERM, Fraud Introduction and Background Financial information is a significant and unique composition of the world of business. Analysis on financial information can always help users to make business decisions. However, driven by short-term profit and specific business purposes, companies would take the risk of releasing fraudulent financial reporting. Fraudulent information would fail to lead to good business decisions. Back to 1970s, due to the occurrence of questionable corporate political campaign practices like the Watergate...
Words: 3530 - Pages: 15
...CHAPTER 1 1. DEFINITION INTERNAL CONTROL is a process effected by people at every level of an organization, designed to provide reasonable assurance about the achievement of objectives in the – effectiveness and efficiency of operations, - reliability of financial reporting, - compliance with applicable laws and regulations. A PROCESS: it is a multiplicity of processes, a series of actions, that is integrated with the basic management processes of planning, executing and monitoring in order to enable their function and in order to monitor them. It is not added on to an entity’s activity, but it should rather be “built-in” in order to be most effective. It is also critical to the success of quality programmes and to cost containment and response time (i.e. not adding new procedures but focusing on existing one and building internal control into them). PEOPLE: internal control is effected by the BoD, management and other personnel. People establish objectives, responsibilities, limits of authority and then put control mechanisms in place. Internal control recognizes that every individual brings in different abilities, needs, priorities, which affect internal control and are in turn affected by internal control itself. The BoD does not only oversee, but it also provides directions and approves transactions and policies, so it is an important element of internal control. REASONABLE ASSURANCE: internal control does not provide absolute assurance. Limitations regard faults in human...
Words: 2982 - Pages: 12
...Evaluating and Improving Internal Control in Organizations Internal control is a crucial aspect of an organization’s governance system and ability to manage risk. It is also fundamental to supporting the achievement of an organization’s objectives and creating, enhancing, and protecting stakeholder value. High-profile organizational failures typically lead to the imposition of additional rules and requirements, as well as to subsequent time-consuming and costly compliance efforts. However, this obscures the fact that the right kind of internal controls—enabling an organization to capitalize on opportunities while offsetting the threats—can actually save time and money and promotes the creation and preservation of value. Effective internal control also creates a competitive advantage, as an organization with effective controls can take on additional risk. Despite the existence of sound internal control guidelines, it is often the application of such guidelines that fails or could be further improved in many organizations. With the publication, the Professional Accountants in Business (PAIB) Committee aims to provide a practical guide focused on how professional accountants in business can support their organization in evaluating and improving internal control as an integral part of its governance system and risk management. The guidance is complementary to existing internal control guidelines and is based on those internal control matters that often cause difficulties...
Words: 1324 - Pages: 6
...Autonomic Computing: An Overview Manish Parashar1 and Salim Hariri2 The Applied Software Systems Laboratory, Rutgers University, Piscataway NJ, USA 2 High Performance Distributed Computing Laboratory, University of Arizona, Tucson, AZ, USA parashar@caip.rutgers.edu, hariri@ece.arizona.edu 1 Abstract. The increasing scale complexity, heterogeneity and dynamism of networks, systems and applications have made our computational and information infrastructure brittle, unmanageable and insecure. This has necessitated the investigation of an alternate paradigm for system and application design, which is based on strategies used by biological systems to deal with similar challenges – a vision that has been referred to as autonomic computing. The overarching goal of autonomic computing is to realize computer and software systems and applications that can manage themselves in accordance with high-level guidance from humans. Meeting the grand challenges of autonomic computing requires scientific and technological advances in a wide variety of fields, as well as new software and system architectures that support the effective integration of the constituent technologies. This paper presents an introduction to autonomic computing, its challenges, and opportunities. 1 Introduction Advances in networking and computing technology and software tools have resulted in an explosive growth in networked applications and information services that cover all aspects of our life. These sophisticated...
Words: 5552 - Pages: 23
...companies with these standards (Agami, 2006). Another very important aspect that the PCAOB is charged with is reviewing the samples of audits conducted by accounting firms and ensuring that both the spirit and letter of the SOX act was established under (Parles, O’Sullivan, & Shannon, 2007). The Sarbanes-Oxley Act is divided into eleven sections referred to as titles. In terms of compliance, many have posited, including Addison-Hewitt Associates (2003), that the most important sections in the body of the Act are titles 302, 401, 404, 409, 802 and 906. The main premise of this paper is to investigate one of the most challenging aspects of SOX’s regulations - a company’s responsibility for implementing effective internal control – as described in Section 404. Role of the Internal Control in the Financial Reporting and Section 404 The requirements of the...
Words: 2681 - Pages: 11
...regulation in order to keep stability and self-assurance in the banking system is the main result of the recent years' of unethical behaviors. By having strong internal control system including an internal audit function and an independent external audit which can add to an efficient and collaborative working relationship between bank management and bank supervisors. Because all the banking activity is base on analyzing and managing banking risks, management responsibilities include monitoring the organization risk and review of management procedures by putting in place the most suitable internal control system. For achieving our goals we have established for the internal control system's objectives we highlight the key strengths then we have been focused on its weaknesses by trying to identify the key important breakdowns at my bank internal control structure. An addition we ended by suggesting some recommendations for a proper plan of the internal control in dealing with the complexity and risk level of each organization. Control weakness * Workers do not input correct information in system cause a lack of effectiveness and efficiency of operations in the reports. * Workers have access to manipulating the system causing unreliability of financial reporting. * Workers are not compliance with applicable laws and regulations since training are not being done preparedly. Proposed control * The district managers and management have reasonable assurance...
Words: 743 - Pages: 3
...Objectives Corporate Governance –What it means for OSH Identify some common Safety Management Systems (SMS) Essential Elements required for managing occupational safety and health in organisations What is Health & Safety Management? Practices that contribute to the effective control and sustained reduction in incidents, which have the potential to result in acute and chronic deleterious effects to employees and other exposed persons. Is it all about reducing incidents? What is Governance? ‘ The system by which organisations are directed and controlled by their board of directors’ (Jacqui Boardman, Acona Ltd.) Role of the Board Setting overall direction for the business or organisation Establish boundaries within which the organisation operates Monitoring the organisations performance Key Elements of Governance Lead & establish overall strategic direction Set standards & values for business Set clear objectives & responsibilities for management Hold management to account for their performance in running the business Uphold obligation to the shareholder & other interested parties Overseeing internal controls Key Drivers in OHS Governance Moral Responsibility - duty of care, societal concerns, personal drive Legal Responsibility - legal compliance, prosecution, penalties, licensing requirements Financial Responsibility “ It has to be said that a concern for safety which is sincerely held and repeatedly expressed...
Words: 1117 - Pages: 5
...Control Self-assessment for Information and Related Technology To ensure smooth functioning of an enterprise striving to achieve predetermined objectives, business processes are identified and defined. To ensure the proper completion of process work, procedures are defined, documented and established. Business procedures need to be properly controlled to ensure smooth completion. Out-of-control procedures are expensive; therefore, controls need to be in place. These controls can be preventive, detective and/or corrective in nature. However, the adequacy of controls over procedures depends on various factors, including a balance between costs incurred for implementing controls and the resulting benefits derived. Many controls are essential overheads for the business, and therefore, their effectiveness must be reviewed periodically. Internal audit of controls, an essential overhead, helps avoid relaxation on controls. Ultimately, the control overheads constitute a major expenditure item. Assurance that the controls are in place and effective is essential. This assurance can be given through control self-assessment (CSA), also referred to as control self-assurance. Systems and procedures for many business organizations within various sectors have evolved over time. For example, banking is the oldest service sector and the controls over banking procedures are essential not only for the bank, but also for society in general. Controls in banking procedures have also evolved over...
Words: 5755 - Pages: 24
...companies with these standards (Agami, 2006). Another very important aspect that the PCAOB is charged with is reviewing the samples of audits conducted by accounting firms and ensuring that both the spirit and letter of the SOX act was established under (Parles, O’Sullivan, & Shannon, 2007). The Sarbanes-Oxley Act is divided into eleven sections referred to as titles. In terms of compliance, many have posited, including Addison-Hewitt Associates (2003), that the most important sections in the body of the Act are titles 302, 401, 404, 409, 802 and 906. The main premise of this paper is to investigate one of the most challenging aspects of SOX’s regulations - a company’s responsibility for implementing effective internal control – as described in Section 404. Role of the Internal Control in the Financial Reporting and Section 404 The requirements of the...
Words: 2712 - Pages: 11
...basic principles of corporate governance? • Transparency: Are the board telling us what is going on? • Accountability: Is the board taking responsibility? • Corporate Control: Is the board doing the right thing? 2. What mechanisms are suggested by the ASX corporate Governance Council? Relating to the three principles stated in the last question. The ASX Corporate Governance Council translates the elements into mechanisms: • Is the board telling us what is going on? →forming an environment to take risk. • Is the board taking responsibility? →clarifying the role of the board and management. • Is the board doing the right thing? →Meeting information needs of investment communities. 3. What is an SME? SME stands for Small and Medium Enterprises. 4. What processes would you expect to find in a company relating to risk management and compliance processes? • Policy/framework • Board commitment, oversight and review • Accountability • Risk processes: o Risk identification o Risk assessment/measurement o Risk response • Robust appropriate internal control and statutory and regulatory compliance...
Words: 1703 - Pages: 7
