1. COSO 2013: ALIGNING INTERNAL CONTROLS AND PRINCIPLES
By: Drs. Denise Dickins & Rebecca Fay, East Carolina University

2. Summary
Auditing firms and others have criticized the ability of recent graduates to understand and appropriately audit companies' systems of internal control over financial reporting (ICFR). We describe an activity to help deepen students’ understanding of ICFR and to enhance their critical thinking skills using the recently-released COSO 2013 Framework. Provided are a summary discussion of ICFR and the COSO 2013 Framework, an outside-of-class reading assignment, and an activity that requires students (independently or in groups, either in or outside of class) to: (1) classify (i.e., map) a listing of controls as being aligned with one (or more) of the COSO 2013 Framework’s five components and 17 principles that comprise a well-designed system of internal control, and (2) identify any deficiencies in design due to missing or inadequate internal controls. By completing the Case and Activity, students are exposed to concepts important in the design of internal control systems and descriptive examples of internal controls. They also employ critical thinking skills to map internal controls and gain experience in identifying deficiencies in internal controls.

3. Contributions
Responsive to regulators’ concerns about accountants lacking a sufficient understanding of, and exposure to, the design of systems of internal control over financial reporting (ICFR)
Employs the most up-to-date framework to be used by companies and professional accountants in evaluating the design and operating effectiveness of systems of ICFR – The COSO 2013 Framework. (introduced in 2014; required to be adopted in 2015)
Requires critical thinking
Provides hands-on experience of a common task, the evaluation of internal controls, using realistic data developed from three public companies
Easily adapted to class format (traditional vs. flipped), and available time (60 minutes to 135 minutes)

4. Objectives
Intended to supplement, not replace, discussions of ICFR in undergraduate senior-level or graduate-level accounting systems, auditing, or internal auditing classes.
Identify the purpose of internal control, as defined by COSO
Differentiate between an accounting process and an internal control
Differentiate between an entity-level control (ELC) and a process-level control (PLC)
Align a COSO 2013 Framework principle with its intended component
Map an internal control to a COSO 2013 Framework principle
Identify deficiencies in the design of internal controls

5. Content Concepts important to understanding ICFR COSO 2013 Framework
Reliability of Financial Statements
Process vs. Controls
Financial Reporting vs. Operating Controls
Entity-level vs. Process-level Controls
Interplay of Effectiveness & Efficiency
Entity Size & Complexity
Inherent Limitations & Fraud
COSO 2013 Framework
Handout
Components, Principles, Points of Focus
Activity

6. The Activity
Students: (1) map a listing of 32 controls to one (or more) of the COSO 2013 Framework’s five Components and 17 Principles, and (2) identify deficiencies in control design due to “gaps” in internal controls (i.e., controls that are missing or inadequate). Depending on the goal of the instructor and to accommodate time constraints, the activity may be shortened to include only a subset of the Components and Principles.
Read COSO’s Internal Control – Integrated Framework Executive Summary, available at:
Access the Worksheet (a copy of which is presented below) at:
Assign the 32 internal controls listed below to one or more of the 17 Principles (or a subset of the Principles, dependent upon the goal of the instructor and allotted timeframe) described in Column 2 of the Worksheet. List the number of the internal control on the Worksheet in the “Controls Present” box (column 4) corresponding to the related Principle. As examples, listed internal controls applicable to Principle 1 and Principle 14 have identified in the Worksheet. (Note: Internal controls may address more than one Principle.)
After assigning the internal controls to each of the 17 Principles, determine whether there are any deficiencies in design and list “gaps” (i.e., inadequate or missing internal controls) in column 5. To complete this step, compare the controls present (column 4) with the Principles (column 2) and “points of focus” (column 3) to assess whether the Principles have been adequately addressed with the existing controls. As examples, potential gaps, applicable to Principle 1 and Principle 14 have been identified in the Worksheet. (Note: As in real audit cases, there are many possible responses for this column.)

7. Debrief & Assessment of Learning
Instructor Guide – Control-by-control guidance & key points
Example Worksheet Solution
Subjective grading of Students’ Worksheets, or Objective validation “test”

8. Time Commitment
Completing all parts of the activity, including instructor debrief, requires approximately 60 minutes of classroom time over two class periods – assuming students complete all four steps of the activity outside of class.