COSO: identify components, inherent limits, and audit response

The rules, one page each

1. COSO Control Environment: Tone at the Top and Board OversightSort it

   The control environment covers integrity, ethical values, independent board oversight, competence, and accountability. Weak leadership or governance can undermine transaction-level controls even when documented procedures exist.

2. COSO risk assessment: significant change triggers and what management must doStep by step

   Under COSO, management must specify suitable objectives, identify and analyze risks (including fraud), and reassess when significant change occurs; this comes before designing or modifying control activities.

3. Management override and collusion: COSO inherent limitations and what they implyContrasting cases

   COSO provides reasonable, not absolute, assurance because inherent limitations like management override, collusion, and human error can defeat controls; observed override also points to a control environment problem and often elevates severity.

4. Control activities vs monitoring vs information and communication: classify the controlSort it

   Control activities are the specific policies and procedures (like approvals, reconciliations, segregation of duties); monitoring evaluates whether controls continue to operate effectively; information and communication ensures relevant, quality information reaches the right people for control operation.

5. Audit response to weak COSO components: less control reliance, more year-end substantive workWhat next?

   When significant control deficiencies exist, assess a higher risk of material misstatement, reduce or eliminate planned reliance on the affected controls, and increase the nature and extent of substantive procedures, shifting their timing toward year-end.