COSO Enterprise Risk Management E-Book

Robert R. Moeller

• Herausgeber: John Wiley & Sons
• Kategorie: Fachliteratur
• Serie: Wiley Corporate F&A
• Sprache: Englisch

Seitenzahl: 763

Veröffentlichungsjahr: 2011

Beschreibung

A fully updated, step-by-step guide for implementing COSO's Enterprise Risk Management COSO Enterprise Risk Management, Second Edition clearly enables organizations of all types and sizes to understand and better manage their risk environments and make better decisions through use of the COSO ERM framework. The Second Edition discusses the latest trends and pronouncements that have affected COSO ERM and explores new topics, including the PCAOB's release of AS5; ISACA's recently revised CobiT; and the recently released IIA Standards. * Offers you expert advice on how to carry out internal control responsibilities more efficiently * Updates you on the ins and outs of the COSO Report and its emergence as the new platform for understanding all aspects of risk in today's organization * Shows you how an effective risk management program, following COSO ERM, can help your organization to better comply with the Sarbanes-Oxley Act * Knowledgeably explains how to implement an effective ERM program Preparing professionals develop and follow an effective risk culture, COSO Enterprise Risk Management, Second Edition is the fully revised, invaluable working resource that will show you how to identify risks, avoid pitfalls within your corporation, and keep it moving ahead of the competition.

Leseprobe

Contents

Cover

Title Page

Copyright

Dedication

Preface

Chapter 1: Introduction: Enterprise Risk Management Today

The COSO Internal Controls Framework: How Did We Get Here?

The COSO Internal Controls Framework

COSO Internal Controls: The Principal Recognized Internal Controls Standard

An Introduction to COSO ERM

Governance, Risk, and Compliance

Global Computer Products: Our Example Company

Chapter 2: Importance of Governance, Risk, and Compliance Principles

Road to Effective GRC Principles

Importance of GRC Governance

Risk Management Component of GRC

GRC and Enterprise Compliance

Importance of Effective GRC Practices and Principles

Chapter 3: Risk Management Fundamentals

Fundamentals: Risk Management Phases

Other Risk Assessment Techniques

Chapter 4: COSO ERM Framework

ERM Definitions and Objectives: A Portfolio View of Risk

COSO ERM Framework Model

Other Dimensions of the ERM Framework

Chapter 5: Implementing ERM in the Enterprise

Roles and Responsibilities of an Enterprise Risk Management Function

Risk Management Policies, Standards, and Strategies

Business, IT, and Risk Transfer Processes

Risk Management Reviews and Corrective Action Practices

ERM Communications Approaches

CRO and an Effective Enterprise Risk Management Function

Chapter 6: Importance of Strong Enterprise Governance Practices

History and Background of Enterprise Governance: A U.S. Perspective

Enterprise Integrity and Ethical Behavior

Disclosure and Transparency

Rights and Equitable Treatment of Shareholders and Key Stakeholders

Governance Role and Responsibilities of the Board

Governance as a Key Element of GRC

Chapter 7: Enterprise Compliance Issues Today

Compliance Issues Today

Establish a Compliance Assessment Team

Compliance Risk Assessments and Compliance Program Reviews

Work Unit–Level Compliance Tracking and Review Processes

Compliance-Related Procedures and Staff Education Programs

Enterprise Hotline Compliance and Whistleblower Support

Assessing the Overall Enterprise Compliance Program

Chapter 8: Integrating ERM with COSO Internal Controls

COSO Internal Controls Background and Earlier Legislation

Efforts Leading to the Treadway Commission

COSO Internal Controls Framework

COSO Internal Controls and COSO ERM: Compared

Chapter 9: Sarbanes-Oxley and Enterprise Risk Management Concerns

Sarbanes-Oxley Act Background

SOx Legislation Overview

Enterprise Risk Management and SOx Section 404 Reviews

Internal Controls Reporting and Materiality

PCAOB Risk-Based Auditing Standards

Sarbanes-Oxley: The Other Sections

SOx and COSO ERM

Chapter 10: Corporate Culture and Risk Portfolio Management

Whistleblower and Hotline Functions

Risk Portfolio Management

Integrated Enterprise-Wide Risk Management

Chapter 11: OCEG Capability Model GRC Standards

GRC Capability Model “Red Book”

Other OCEG Materials: The “Burgundy Book”

Level and Scope of the OCEG Standards-Setting Authority

Chapter 12: Importance of GRC Principles in the Board Room

Board Decisions and Risk Management

Board Organization and Governance Rules

Corporate Charters and the Board Committee Structure

Audit Committees and Managing Risks

Establishing a Board-Level Risk Committee

Audit and Risk Committee Coordination

COSO ERM and Corporate Governance

Chapter 13: Role of Internal Audit in Enterprise Risk Management

Internal Audit Standards for Evaluating Risk

COSO ERM for More Effective Internal Audit Planning

Risk-Based Internal Audit Findings and Recommendations

COSO ERM and Internal Audit

Chapter 14: Understanding Project Management Risks

Project Management Processes

PMBOK® Guide: A Guide to the Project Management Book of Knowledge

PMBOK® Guide's Project Manager Risk Management Approach

Project-Related Risks: What Can Go Wrong

Implementing ERM for Project Managers

Chapter 15: Information Technology and Enterprise Risk Management

IT and the COSO ERM Framework

IT Application Systems Risks

Effective IT Continuity Planning

Worms, Viruses, and System Network Risks

IT and Effective ERM Processes

Chapter 16: Establishing an Effective GRC Culture throughout the Enterprise

First Steps to Establishing a GRC Culture: An Example

Promoting the Concept of Enterprise Risk

Establishing of Enterprise-Wide Governance Awareness

Enterprise Codes of Conduct

Building a GRC Culture: Risk, Governance, and Compliance Education Programs

Keeping the GRC Culture Current

Chapter 17: ISO 31000 and 38500 Risk Management Worldwide Standards

ISO Standards-Setting Process

Understanding ISO 31000

ISO 38500: The Corporate Governance of IT

Implementing an ISO Standard

Chapter 18: ERM and GRC Principles Going Forward

ERM and GRC for the Internal Controls Professional

COSO's Ongoing Support Role

COSO ERM and GRC Future Prospects

About the Author

Index

Copyright©2007, 2011 by John Wiley & Sons, Inc. All rights reserved. First edition 2007

Second edition 2011

Published by John Wiley & Sons, Inc., Hoboken, New Jersey.

Published simultaneously in Canada.

“PMI” and “PMBOK” are registered marks for the Project Management Institute, Inc.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, [phone], fax [phone], or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, [phone], fax [phone], or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty:While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at [phone], outside the United States at [phone] or fax [phone].

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. For more information about Wiley products, visit our web site at www.wiley.com.

Library of Congress Cataloging-in-Publication Data

Moeller, Robert R

COSO enterprise risk management : establishing effective governance, risk, and compliance

processes / Robert R. Moeller.—2nd ed.

p. cm.—(Wiley corporate f&a; 560)

Includes index.

ISBN 978-0-470-91288-1 (hardback); ISBN 978-1-118-10252-7 (ebk);

ISBN 978-1-118-10253-4 (ebk); ISBN 978-1-118-10254-1 (ebk)

1. Risk management. I. Title.

HD61.M568 2011

658.15'5—dc22

2011012021

To my wife and very best friend, Lois Moeller

Preface

Risk management is one of those concepts where many business professionals will agree that, “Yes, we need a good risk management program!” but those same professionals often have difficulty, when pressed for a better definition, explaining what they mean by the term risk management. For many business professionals, this lack of a consistent understanding of risk management has been similar, until recently, to the earlier lack of a general understanding of the term internal controls. Going as far back as the 1950s in the United States, internal and external auditors as well as many business professionals talked about the importance of good internal controls, but there was no one widely accepted, consistent definition of what was meant by that expression. It was not until the early 1990s with the release of the COSO internal control framework that we have had a consistent and widely recognized definition of internal controls for all enterprises.

Risk management has had a similar history of inconsistent and not always clearly understood definitions. Insurance enterprises had their own definitions of risk management while others, such as credit management, have had a whole different set of definitions and understandings. Project managers had been frequently asked to rate a proposed new effort as high, medium, or low risk without fully understanding the meaning of such a rating. Over past years and until the very recent present, many enterprises including for-profit entities, not-for-profits, or governmental agencies have not had a consistent definition of the meaning of risk management and what was necessary to establish an effective risk management structure or framework. To help with this definition problem, the COSO guidance setting entity1 developed a risk management definition or framework definition called COSO Enterprise Risk Management or COSO ERM. This risk management framework, updated with COSO guidance and published in 2011,2 provides a structure and set of definitions to allow enterprises of all types and sizes to understand and better manage their risk environments.

Similar to our concerns about a better way to look at and understand risk management, enterprises have had similar needs to improve their enterprise governance practices and both regulatory and ethics compliance standards. Although there have always been issues, interests in better enterprise governance and compliance standards first became particularly important at the beginning of this century with the corporate fraud–related failure of the high-flying corporation Enron. This led to the passage of the Sarbanes-Oxley Act (SOx) in the United States and a worldwide interest in enterprise governance and compliance issues. These concerns became even more significant with the worldwide financial recession starting around 2008.

While enterprise risk management is a major focus of this book, governance, risk, and compliance issues are all equally important. Using the initials for each, we frequently refer to these as GRC issues and standards. Enterprises need to build and launch effective GRC processes.

Starting with the letter R of this concept, a major objective of this book is to help business professionals, at all levels from staff internal auditors to corporate board members, to understand risk management concepts and best practices in general and make more effective use of the COSO ERM risk management framework. Using the COSO ERM framework's model and terminology, we will discuss the importance of understanding the various risks facing many aspects of business operations and how to use something called an enterprise's appetite for risk to help make appropriate decisions in many areas of business operations.

COSO ERM concepts are important for all levels of an enterprise. In addition to its applicability for more senior managers, the chapters following will explain how all professionals in an enterprise can make better decisions through use of this COSO ERM framework and its recently released supporting guidance. The COSO ERM framework provides an improved way of looking at all aspects of risk in today's enterprise. This book is designed to help professionals to develop and follow an effective risk culture for many business and operating decisions.

This updated second edition will also discuss effective enterprise governance practices including some of the key regulatory issues currently facing the modern enterprise. Our emphasis is not to just discuss rules and standards but to emphasize effective processes, particularly with an emphasis on using IT tools and processes and utilizing the internal audit function. Also, many of the following chapters will reference an example company that we have called Global Computer Products to help the reader understand the use and practical application of COSO ERM and other effective GRC processes. This hypothetical example company will be described in more detail in the chapters following.

Chapter by chapter, this new second edition covers the following COSO ERM and GRC process description and recommended good practices:

Chapter 1. Introduction: Enterprise Risk Management Today. This introductory chapter introduces the concept of enterprise risk management and the related concepts of enterprise governance and compliance standards. We start by looking at an important standard for defining internal control, the Committee of Sponsoring Organizations (COSO) internal control framework, a worldwide accepted set of guidance materials for defining internal control in enterprises today. From this internal controls framework the chapter then introduces the similar looking in appearance, but very different, COSO enterprise risk management (ERM) framework, the major topic of many of the chapters in this book. We should note here that the COSO materials are not really standards in the sense of an SEC-mandated standards requirement, but they are really very strong guidance materials. Because they are so pervasive today, we will frequently reference them as standard practices. The chapter will also introduce us to an example company, Global Computer Products, which will be referenced for many examples throughout the book. However, the major objective of this chapter is to introduce COSO ERM and related governance and compliance principles and how they have changed since our first edition.Chapter 2. Importance of Governance, Risk, and Compliance (GRC) Principles. Events such as the collapse of the energy trading firm, Enron, and its public accounting firm, Arthur Andersen, and the enactment of the Sarbanes-Oxley Act (SOx) in 2002 raised a whole series of enterprise GRC issues that had been previously all but ignored. The collapse of housing markets almost worldwide during our recent great recession has also focused on needs today for improved compliance processes. This chapter reviews the elements of effective GRC processes and discusses why past events such as Enron and the more recent financial crises have emphasized the growing importance of enterprise governance, risk, and compliance processes.Chapter 3. Risk Management Fundamentals. Key concepts and the terminology used in risk assessments are introduced here. These include some of the basic graphical and probability tools that have been used by risk managers over time as well as the terminology used for risk transfers and assessments. These concepts will be helpful in understanding risks in both a quantitative and qualitative sense and in using and understanding COSO ERM. This chapter also will introduce some of the basic concepts of probability and how they are used to measure and assess risks.Chapter 4. The COSO ERM Framework. This chapter discusses some of the events that led to COSO ERM including ongoing industry and public concerns about the lack of a consistent definition of internal controls and an uncertainty of the meaning and concept of risk on an overall enterprise level. We introduce the three-dimensional model or framework for understanding enterprise risk, COSO ERM, with its eight vertical components or layers as one model dimension, a second dimension of four vertical columns covering key risk objectives, and a third dimension describing the enterprise units in the risk framework. An understanding of these framework components sets the stage for understanding and using COSO ERM. The chapter also highlights some of the recent guidance material released by COSO on how to more effectively implement and use COSO ERM.Chapter 5. Implementing ERM in the Enterprise. Risk management must be understood in terms of its strategic, operational, reporting, and compliance objectives as well how it should be implemented throughout the enterprise, from an individual business unit to the entire enterprise. Beyond the Chapter 3 discussion of risk management fundamentals and the introduction of COSO ERM, these are the other two dimensions of this risk management framework, this chapter discusses these other two elements and how all three relate together. The idea is to think of enterprise risk management as an overall structure that will allow managers to understand and manage risks throughout an enterprise.Chapter 6. Importance of Strong Governance Practices. We outline why all enterprises and public corporations, in particular, are expected to have some social and governance responsibilities. Governance principles can also be introduced at an overall stakeholder level through effective ethics programs and codes of conduct.Chapter 7. Enterprise Compliance Issues Today. Enterprises today face growing amounts of legal and regulatory requirements at national, local, and regional levels. The chapter discusses the multiple issues facing an enterprise and introduces processes for reviewing and assessing compliance at all levels of an enterprise today.Chapter 8. Integrating ERM with COSO Internal Controls. Prior chapters have only referenced the COSO internal controls framework in contrasting it to COSO ERM. This chapter will dig a bit deeper and provide a more detailed look at the components and objectives of the COSO internal controls framework as well as some background on its origins. Since the COSO internal controls framework has a risk component, we will also discuss its relationship to COSO ERM. An overall objective of this chapter will be to describe how managers can use and apply effective enterprise risk management practices when building strong COSO internal control practices.Chapter 9. Sarbanes-Oxley and Enterprise Risk Management Concerns. SOx has had a major impact on corporations whose securities are registered with the U.S. Securities and Exchange Commission (SEC) and has changed the financial reporting and public accounting regulatory landscape from one of self-regulation by external audit firms to quasi-governmental rules. Both SOx and COSO ERM have some important interdependencies on each other, and today's enterprise manager must have a general understanding of both. This chapter provides general background on SOx and describes some of its enterprise risk–related attributes.Chapter 10. Corporate Culture and Risk Portfolio Management. This chapter looks at several important areas for implementing an effective enterprise risk management culture, including the help and support resources necessary for enterprise codes of conduct and the role of whistleblower functions both in support of SOx requirements and as an escape mechanism to manage enterprise risks. Enterprises need such a whistleblower facility where a stakeholder can independently report a problem without fear of retribution and can seek further information about some rule or procedure and ask for help.

Our second topic in this chapter is risk portfolio management. Any enterprise faces a wide range of different types of risks and potential consequences. In order to effectively manage them, an effective approach is to divide these many and diverse risks into separate portfolios and then to assess and manage the risks on a portfolio basis.

Chapter 11. OCEG Capability Model GRC Standards. The Open Compliance and Ethics Group (OCEG) is an industry-led nonprofit organization that develops standards and helps enterprises enhance their governance, risk management, and compliance processes. OCEG is a relatively new organization and certainly did not exist at the time of the first edition of this book. While the OCEG does not have the standards-setting authority that might be found in the American Institute of Certified Public Accountants' (AICPA's) standards or even in some of the ISO 31000 guidance discussed in Chapter 17, it has published several guidance standards such as a GRC capability model. This chapter reviews several of the currently published OCEG guidance materials, including their “Red Book” on a GRC capability model, what they call their “Burgundy Book” on GRC capability processes, and related materials. Many of these OCEG guidance materials are very similar to the GRC and ERM framework guidance information found in other chapters, but with a slightly different emphasis or approach.Chapter 12. Importance of ERM in the Corporate Board Room. This chapter will consider the importance of corporate boards of directors in subscribing to good GRC principles as well as introducing COSO ERM and effective GRC principles to today's boards and their decision-making processes. It will suggest approaches for effectively implementing COSO ERM both for overall enterprise decision-making guidance and as a process for helping boards make decisions. While boards have a basic responsibility for the governance of their enterprises and related compliance issues, this chapter will emphasize the need for strong board-level GRC principles. The chapter will also discuss the importance of establishing a board-level risk committee operating in parallel with the audit committee. A broad enterprise-wide perspective of COSO ERM is an important tool for helping board members to better consider and evaluate the risks facing their enterprises.Chapter 13. Role of Internal Audit in Enterprise Governance, Risk, and Compliance. Internal audit plays an important role in monitoring and assessing all GRC processes in the enterprise. They may also act as internal consultants for helping to support GRC processes, internal controls implementations and maintenance. The chapter looks at important roles for internal audit in reviewing critical GRC systems and processes as well as techniques for building risk-based approaches for the overall internal audit process. Internal auditors have always considered risks in planning and performing audits, but COSO ERM as well as the recently updated Institute of Internal Auditors (IIA) internal audit standards suggest a greater need for emphasis on ERM.Chapter 14. Understanding Project Management Risks. Many enterprise efforts are organized as projects—limited duration activities that are managed as separate efforts within normal enterprise boundaries. The chapter introduces the Project Management Institute's standard A Guide to the Project Management Book of Knowledge (PMBOK® Guide) with its own risk management component. This chapter will discuss how to integrate PMBOK® Guide risk guidance materials with the overall ERM framework to better manage and control project risks.Chapter 15. Information Technology and Enterprise Risk Management. Because of the complexity in building and maintaining computer systems and applications, risk management has been very important to information technology (IT) processes. The chapter will look at three important IT areas and how COSO ERM can help an enterprise to better understand those IT risks: Application Systems Risks. Enterprises often face significant risks when they purchase or develop new applications, implement them to production status, and then maintain them as production systems. There are risks associated with each of these areas and COSO ERM can help in their management.Effective Continuity Planning. Once more commonly called disaster recovery planning, continuity planning can help IT systems and operations, which can be subject to unexpected interruptions in their services, deal with those risks. COSO ERM provides an enhanced framework to understand and manage those risks.Worms, Viruses, and Systems Network Access Risks. There are many risks and threats in our world of interconnected systems and resources. COSO ERM provides guidance to assist an enterprise in deciding where it should allocate resources. This chapter also discusses the more significant of these potential risks.Chapter 16. Establishing an Effective GRC Culture throughout the Enterprise. Effective risk management needs to go beyond implementing COSO ERM or announcing a GRC program as an initiative with one or another enterprise functions. It should be an overall philosophy that is understood and used throughout the enterprise. The chapter discusses how to establish an ERM function and GRC culture in a larger enterprise as well as the roles and responsibilities of the chief risk officer who would lead such a function.Chapter 17. ISO 31000 and 38500 Risk Management Worldwide Standards. While COSO ERM was first introduced as a U.S.-based guidance standard, other risk management standards have now been released throughout the world. The chapter will look at both ISO 31000 and 38500,3 two related international risk management standards, and will discuss how these international standards relate to COSO ERM.Chapter 18. ERM and GRC Principles Going Forward. The concept of COSO ERM and GRC principles has changed very much since the first edition of this COSO ERM book was published in 2007. In today's highly regulated environment, enterprises are increasingly pressured by governance, risk, and compliance concerns while at the same time they have strong needs to drive their business performance and to enhance stakeholder confidence. Underlying these GRC management issues, an enterprise must coordinate and manage a wide range of manual and IT infrastructure processes that directly support the tools and systems in a GRC business environment. This final chapter summarizes some of the current trends and issues that will continue to make GRC management increasingly important. In particular, it reviews some of the areas that several professional organizations are promoting to increase an awareness of GRC and ERM.

Notes

1. COSO stands for the Committee of Sponsoring Enterprises. Its role will be described in Chapter 1.

2. “Embracing Enterprise Risk Management: Practical Approaches to Getting Started,” COSO, 2011, www.coso.org.

3. ISO stands for the International Organization for Standards, a French language–based authority in Geneva, Switzerland. See www.iso.org.

Chapter 1

Introduction: Enterprise Risk Management Today

Well-recognized or mandated standards are important for effective enterprise governance and management. Compliance with these standards allows the enterprise to demonstrate they are following best practices and complying with regulatory rules. For example, the enterprise's financial statements are audited by an external audit firm to determine whether they are consistent with generally accepted accounting principles (GAAP) in the United States or are fairly stated following international financial reporting standards (IFRS). This financial audit process applies to virtually all enterprises worldwide, no matter their size or enterprise structure. Investors and lenders want an external party—an independent auditor—to examine financial records and attest whether they are fairly stated. In order to attest to these financial statements, that same auditor has to determine that there are good supporting internal controls surrounding all significant financial transactions.

Internal controls cover many areas in enterprise operations. An example here is a separation of duties control where a person who prepares a check for issue to an outside party should not be the same person who approves that check for payment. Two independent people should be involved with the release of checks that take cash from the enterprise. This is a common and well-recognized internal control, and many others relate to similar situations where one person or process should always be in a position to independently check the work of another party. Good internal control processes are essential for effective risk management systems in an enterprise.

This introductory chapter briefly looks at an important guidance standard for defining internal control, the Committee of Sponsoring Organizations' (COSO) internal control framework. This COSO guidance has become the worldwide accepted standard for defining internal control in enterprises today. From this internal controls framework the chapter then introduces the similar looking in appearance, but very different, COSO enterprise risk management (ERM) framework, the major topic of many of the chapters in this book.

The chapter will also introduce us to an example company, Global Computer Products, which will be referenced in many examples throughout other chapters. The Global Computer Products hypothetical enterprise is a U.S.-headquartered computer hardware and software products manufacturer with worldwide development and distribution facilities. Although no example can be comprehensive or complete, we will try to use this Global Computer Products example as a vehicle to better understand and implement COSO ERM and governance, risk and compliance (GRC) issues in an enterprise today as well as to use them for implementing effective enterprise practices.

The COSO Internal Controls Framework: How Did We Get Here?

Similar to the many acronyms for products and techniques common in information technology (IT), product and process names are quickly turned into acronyms in the worlds of auditing, accounting, and corporate management. In the IT world, we quickly forget the names, words, or even the concepts that created the acronym and just use the several-letter acronyms. For example, International Business Machines Corporation (IBM) launched a custom software product for just one customer called the Customer Information Control System (CICS), back in the old mainframe or legacy computer system days of the early 1970s when IBM needed to develop software to access files in an online basis. Other computer manufacturing competitors at that time had online, real-time software, but IBM did not. IBM's CICS product was enhanced and generalized over the years. It is still around today for legacy systems, and today's users call it “Kicks” as their pronunciation of CICS. The definition or meaning of this acronym has been essentially forgotten and CICS has now become an IT “word.”

The internal control guidance-setting organization, COSO, is a similar example with an abbreviated name standing for the Committee of Sponsoring Organizations of the Treadway Commission. Of course, an explanation of that COSO name does not offer much help—who is this committee, what are they sponsoring, and what is the Treadway Commission? To understand how this internal control standard came about, it is necessary to go back to the late 1970s and early 1980s, a period when there were many major enterprise financial failures in the United States due to conditions including very high inflation, the resultant high interest rates, and some aggressive enterprise accounting approaches. The scope of these failures seems minor today when contrasted with the financial meltdowns of 2009 and 2010 or the financial frauds at the beginning of this century that led to the Sarbanes-Oxley Act (SOx). Financial crises will always be with us, and a concern back in the 1970s was that several major corporations suffered a financial collapse even though their recently published audited financial reports, signed by their external auditors, showed both adequate earnings and good financial health. Some of these failures were caused by fraudulent financial reporting, but most turned out to be victims of the high inflation and resultant high interest rates during that period. It was not uncommon for many companies that failed to have issued fairly positive annual reports despite the bad news about to come. This also was another period of high regulatory activity in the United States and some members of Congress drafted legislation to “correct” these business or audit failures. Congressional hearings were held, but no legislation was ever passed. Rather, a private professional group, called the National Commission on Fraudulent Financial Reporting, was formed to study the issue. Five U.S. professional financial organizations sponsored this National Commission: the American Institute of Certified Public Accountants (AICPA), the Institute of Internal Auditors (IIA), the Financial Executives Institute (FEI), the American Accounting Association (AAA), and the Institute of Management Accountants (IMA). Named after its chair, SEC Commissioner James C. Treadway, the authority adopted as its official name The Committee of Sponsoring Organizations of the Treadway Commission. Today, that group has become known by its acronym name, COSO.