The World of Auditing: the Control Environment and Risk Assessment

1653 Words7 Pages
The Committee of Sponsoring Organizations (COSO) requires companies to establish effective internal controls to prevent operational issues and to make sure that these controls (control environment, risk assessment, control activities, information and communication, and monitoring) comply with regulations. Out of these five elements of internal control, the control environment is the starting point and the most difficult to maintain. The control environment is the actions, policies, and management styles that influence a firm’s daily activities. It is setting the tone of organization and influencing control consciousness of its employees. When we think of a control environment, we consider the philosophy, ideology, beliefs, attitude, key personnel, and concern of a business and their ability to provide sufficient resources for all organizational issues. The control environment has a very pervasive structure that includes management’s integrity and ethical values and a commitment to organizational competence. In a good control environment, employees know that doing the right thing is expected even if it hurts the company whereas in a weak environment, procedures are constantly ignored. In a traditional approach, auditors assess the control environment by issuing a questionnaire to senior management to determine if management policies such as a code of ethics have been implemented. Yet, a more effective method would be to survey the people who work in that environment, not management. This approach focuses not on the message that management thinks it is sending but on the message employees are receiving. For a business to display a positive control environment, management and auditors should not only demonstrate that a code exists but they must evaluate its effectiveness. This evaluation could include training sessions for management and employees on
Open Document