Background information:
As required by Section 404 of the Sarbanes-Oxley Act of 2002, the SEC adopted rules requiring certain companies "to include in their annual reports a report of management on the company's internal control over financial reporting. The internal control report must include: a statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting for the company; management's assessment of the effectiveness of the company's internal control over financial reporting as of the end of the company's most recent fiscal year; a statement identifying the framework used by management to evaluate the effectiveness of the company's internal control over financial reporting; and a statement that the registered public accounting firm that audited the company's financial statements included in the annual report has issued an attestation report on management's assessment of the company's internal control over financial reporting." Some companies who are not required to report on controls, voluntarily elect to do so.
Committee of Sponsoring Organizations (COSO) Integrated Framework:
In the U.S., most companies use the COSO integrated framework for evaluating controls.
COSO defines internal control as having five components:
1. Control Environment
2. Risk Assessment
3. Information and Communication
4. Control Activities
5. Monitoring
COSO identifies 17 principles that are used to assess the five components. The first principle is used to evaluate the control environment: "The organization demonstrates a commitment to integrity and ethical values."
One of the ways COSO describes as a way to demonstrate this commitment is that management "Sets the tone at the top."
Required:
You are to assume the role of an internal auditor who has been asked to identify 5 things that management can do to establish a tone at the top that conveys a commitment to integrity and ethical values. Thus, we are only focusing on the first principle in this assignment. You are to write a memo that is no more than 4 single spaced pages in proper memo format -memo heading (person addressed, writer, date, subject), initial by name, introductory paragraph (context, purpose, and preview), headed segments, and conclusion. The memo shall be addressed to the CEO and head of the audit committee of the Board of Directors with recommendations on establishing the appropriate tone. Provide a detailed description of each of the five items and a persuasive argument as to why the item is useful for conveying the appropriate tone. Be sure to identify any sources you have used to help you in your research. Citations and references should comply with APA requirements. Because this is a memo, please use footnotes for including sources and references. Do not include a formal bibliography at the end but please ensure that you have completely documented your sources in the footnotes. You should consider the guidance in SAS 99 (Consideration of Fraud in a Financial Statement Audit).
Your memo should explain to the intended audience WHY the items you are recommending convey a commitment to integrity and ethical values. This is important in persuading your audience why they should consider your recommendation. Thus, only listing the five things without justifying them, is not sufficient.
To assist you, here are the instructions used by the GEB courses for writing memos:
1. Set up with words, "To," "From," Subject," and "Date"; subject line should clearly state the specific subject
2. Initial in superscript next to sender's name
3. Begin with an introductory paragraph (with no heading). It should state the purpose of the memo and preview its main headings. However, sometimes for tax memos, this introductory paragraph is omitted.
4. Use headings for most business memos; tax memos often use "Facts," Issues," Conclusion," "Discussion" or other designated organizational plans (e.g., IRAC)
5. Include footnotes to reference outside sources
6. Single space with a double space between paragraphs
7. Justify the left margin, but not the right
8. Add a page header to pages following the 1st page (client or subject, date, page number)
9. End with a brief concluding paragraph (unless you use on of the organizational plans described in #4 above). It does not have to repeat the main ideas but should summarize the overall conclusion and request next action, if appropriate.