Financial statement risk assessment following the COSO framework

Abstract

PurposeThe purpose of this paper is to teach students the fundamental and most critical aspects of performing a financial statement risk assessment, a skill vital to help ensure both auditor and public‐company compliance with guidance found in the Sarbanes‐Oxley Act of 2002 (SOX), the SEC's Interpretative Guidance regarding Management's Report on Internal Control over Financial Reporting, the control deficiency evaluation framework found in Auditing Standard No. 5 (AS5) of the Public Company Accounting Oversight Board (PCAOB), and the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Design/methodology/approachThis instructional case study helps students assess the impact of a set of hypothetical internal control deficiency risks in various industries, including inherent and residual financial statement risk assessment, and concludes with determining which identified internal control weaknesses are significant deficiencies and material weaknesses in internal control. Included in the financial statement residual risk assessment process are example entity‐level and process‐level controls described in COSO. Learning objectives, implementation guidance, and the efficacy of using the case study in the undergraduate or graduate auditing or accounting information systems courses are also provided.FindingsThe results of classroom testing of the case study at two universities provides evidence the case study increases student understanding of the implications of internal controls and their impact on the reliability of the financial statements significantly. Students also found the case to be challenging, interesting, relevant, clear, understandable, and a realistic approximation of what they might expect to encounter in the real‐world when performing a financial statement risk assessment.Originality/valueThe case study includes the development of skills important to students in performing financial statement risk assessments, either as an auditor or when working in a private industry environment, including making professional judgments related to risk assessment.

Relationship between Corporate Sustainability and Compliance with State-Owned Enterprises in Central-Europe: A Case Study from Hungary

“…Its conceptual definition has been examined by many authors, and although its sub-elements show differences in the views of individual disciplines, virtually every definition shows that risk is the possibility of a negative effect, which may affect the goals, the operation, the judgment, the trust in the organization in a negative way. Risks can be very diverse and although the negative impact we have mentioned can be expressed in some form of financial loss, it is not limited to financial value since it is difficult to measure and convert a trust deficit in an organization into a monetary measure, especially (e.g., waste management companies) where there is no other available service provider on the market [48]. The State Audit Office also examines integrity issues from year to year in relation to public sector institutions.…”

“…At the same time, there have been many advances compared to previous years, such as the issue of conflicts of interest, which are well regulated by most institutions, but have also highlighted a significant lack of integrity in the public sector, particularly in organizations where demand is consistently higher than supply. It is the closest to the issue of integrity used in public administration with regard to the purpose of "compliance'-both of which are intended to increase the resilience of the organization and to ensure its integrity [47][48][49][50]. The State Audit Office defines integrity as the totality of attributes, abilities, attitudes, and behaviors that are intended to serve the public interest and to ensure that public administration functions properly, effectively, and efficiently [24].…”

IT General Controls Testing: Assessing the Effectiveness of User Access Management

“…In Table 1, several cases directly relate to COSO and internal controls. For example, Premuroso and Houmes (2012) use the COSO framework to perform a financial statement risk assessment, while Fleak, Harrison, and Turner (2010) use COSO to evaluate internal controls in a small organization. Savage, Norman, and Lancaster (2008) use a movie to introduce COSO concepts and to identify internal control failures.…”

Offering a ‘Menu’ of Software and Case Study Options for the Group Project for Students Enrolled in the Introductory AIS Course: An Experimental Application Study

“…Study 13 (Premuroso and Houmes, 2012). The purpose of this case study is to teach students the fundamental and most critical aspects of performing a financial statement risk assessment following the COSO framework.…”

“…One of the authors involved in this study has taught the introductory AIS course at several universities, requiring all students taking the course to perform one particular group project (in the form of a case study) during a school (academic) year consisting of either the autumn or spring semester. The group project offering required of all students was, for several years, either 'Tasteless Tea Company: A Comprehensive Revenue Transaction Cycle Case Study' (Premuroso, Hopwood, and Bhattacharya, 2011) or 'Financial Statement Risk Assessment Following the COSO Framework: An Instructional Case Study' (Premuroso and Houmes, 2012). As a result, primarily, of an analysis of the open-ended comments received in the student course evaluations by one of the authors of this study, it became obvious students taking the introductory AIS class were asking for more choices for the group project.…”