Richard Steinberg 270004HRBG firstname.lastname@example.org | | Tags:  erm coso | 0 Comments | 734 Visits
In case you were too busy watching your kids open their holiday presents you might have missed a “gift” for you – COSO’s updated internal control framework. During the holiday season the draft was exposed for public comment, so if you haven’t already done so, you might want to get your hands on it and tell COSO what you think, and how it might be further improved.
In looking over the draft you’ll see that the fundamental concepts and structure remain. The definition of internal control, the five components, and the COSO cube are unchanged. So are the three categories of objectives, except that the reporting category is expanded to include all reporting by an entity: financial and non-financial, internal and external. This brings the internal control framework in line with how the reporting category of objectives is defined in COSO’s Enterprise Risk Mana
Other enhancements include:
You’ll see the term “ICEFR” (pronounced ice-eh-fer), which is the acronym for internal control over external financial reporting. Because of the importance of the internal control framework for reporting under such requirements as Sarbanes-Oxley, COSO decided to offer a separate guidance document highlighting how the framework can be effectively applied for that purpose. It’s organized around the five internal control components, containing approaches for and examples of their application, with direct linkage to the principles and attributes in the framework. It’s important to keep in mind that the ICEFR guidance is just that, guidance; it will neither replace nor modify the framework. It will be exposed for comment later on this spring.
Well, it’s a case of speak now, or…. If you’re involved in any way with internal control, you’ll want to provide your input on the document. By the way, I’m biased in a positive way – for full disclosure, I was the lead PwC project partner of the team that developed the original Framework, played a similar role with the COSO ERM framework, and advised the project team that developed this updated framework. But you may have different views, and it’s important to make them known. The comment period ends March 31.
Richard Steinberg 270004HRBG email@example.com | | Tags:  fraud risk_management | 0 Comments | 801 Visits
We know the Olympus Corp. suffered a major management fraud. Financial statements were manipulated to hide huge losses, resulting in its stock price dropping like a rock and jeopardizing the company’s listing status and indeed existence in its current form. For more on the fraud, you may want to look at my October 15, 2011 blog posting.
Those looking at this fiasco may well be asking why this fraud, which had been going on for more than a decade, wasn’t brought to light any sooner – that is, before newly appointed CEO Michael Woodford began to smell a rat. Well, now it’s come out that one critical element in detecting and possibly preventing fraud at the highest management levels – which is having an effective whisleblowing process – wasn’t in place at Olympus. Sure, they had a process, but now it’s reported that the very executives perpetrating the fraud were in charge of the hotline! It’s said that the company’s internal auditors and other employees wanted the whistleblower system to be run by outside parties, but at least one of the executives alleged to have been driving the fraud objected and won out. According to an independent panel investigating the fraud, the corporate atmosphere was such that the hotline was “significantly disabled.” Is it essential to have the hotline outsourced? No. But it is critical that company personnel feel comfortable that their communications will not come back to haunt them, which is said not to be the case at Olympus.
Much has been written about management fraud, and what internal controls are needed to prevent or detect it. But my experience is that it really comes down to four key factors. One is having a culture of integrity and ethical values, with the “right” tone at the top of the organization and open communication channels. Another is a board of directors (and audit committee) that is independent and providing effective oversight. One more is an effective internal audit function. And then there’s an effective whistleblower process. Based on what’s been reported, Olympus evidently didn’t have any of these big four – we don’t know much about the functioning of its internal audit function, but now learn that the company is suing the former internal auditor along with two other executives who an independent panel said “orchestrated the scheme.” So is it surprising that such a fraud could have existed for so long? In light of its governance, risk management and internal control processes, the answer is “not really.”
When we look at the potential of management fraud, it’s critical to look at these four elements. If even one is missing, the chance of fraud going undetected increases greatly. And no one should proceed with the odds stacked in favor of bad actors.
Erwin Boeren 270002C43V ERWIN.BOEREN@NL.IBM.COM | | Tags:  risk operational grc compliance ibm solvency openpages governance | 0 Comments | 1,515 Visits
Solvency II and the need for Operational Risk
Blog post from Erwin Boeren, Governance Risk &
Blog post from Erwin Boeren, Governance Risk &
Richard Steinberg 270004HRBG firstname.lastname@example.org | | Tags:  risk_management | 0 Comments | 593 Visits
We know that senior executives, especially chief executive officers, look to drive their organizations’ growth initiatives. Many are hard-driving, proactive, and intently focused on doing what needed to carry out strategic plans. Optimism is a typical trait, which can be contagious in getting others in the organization to work in sync towards established goals. This is what CEOs are charged to do, and a key reason why those who do it successfully get the big bucks.
With that said, experience shows that many CEOs are not sufficiently attentive to what can go wrong – that is, what future events could keep their organizations from successfully carrying out the established initiatives. Of course many CEOs and their C-suite teams do focus on such risks, and their organizations benefit from doing so. One such company is Mazor Robotics, a medical technology company based in Israel, whose CEO Ori Hadomi recently was interviewed. He makes a number of interesting observations, one of which is especially insightful – describing risk management in a particularly understandable and compelling way. He associates risk management with ensuring there’s a devil’s advocate involved in key decision-making.
He says: “One of the most obvious mistakes we found is that too often we choose to believe in an optimistic scenario — we think too positively. Positive thinking is important to a certain extent when you want to motivate people, when you want to show them possibilities for the future. But it’s very dangerous when you plan based on that. So one of our takeaways from that was to appoint one of the executive members as a devil’s advocate.” Hadomi expands on how that works, emphasizing that the assigned executive knows the right questions, and asks them in challenging assumptions and pointing out a need to be “more humble with our assumptions.” Hadomi notes that the most surprising thing is that this devil’s advocate is the V.P. of sales for international markets: “You would expect the V.P. of sales to be pie-in-the-sky all the time. But he has a very strong, critical way of thinking, and it is so constructive,” adding that one of the pitfalls of leadership is “thinking too positively when you plan and set expectations.”
I’ve worked with many large companies, and certainly smaller company executives learn from them. But the reverse also is true. In this case, the CEO of Mazor Robotics provides useful insight into how risk management can be effectively conceptualized and applied. Of course, there’s much more to risk management, including capturing the identified risks, analyzing them, and managing them with accountability for needed actions, follow up, etc. But the concept of a devil’s advocate is powerful, especially for executives who may be struggling with what risk management is about.