New COSO ERM Framework – Enterprise Risk Management – Integrating with Strategy and Performance; COSO 2013 Internal Control Framework; the Business Judgment Rule

You may have heard or seen that the new COSO ERM Framework is out as of a day or two ago – Enterprise Risk Management – Integrating with Strategy and Performance. This is a project that COSO announced on October 21, 2014, so it is a longtime in the works. The original (first) framework was issued in 2004. Below I have provided the bare bones outline for the new ERM Framework, in addition to the bare bones outline for the COSO 2013 Internal Control Framework, and a summary of the business judgment rule. Why did I provide all three? Because for boards and audit committees, and for business entities and their executive officers, and sometimes for the employees also, all three are, or should be, tied together.

I will be commenting about and outlining the ERM Framework in detail in later posts (after I have had time to evaluate the detailed materials, and discuss them with colleagues). For now, all I can give you is the outline below. I do note – and I’m not being negative about this – that I have some concern that the five concepts and twenty principles, with the detail added, might be a lot for some small and mid-sized business entities, nonprofits and governmental entities to handle. But it is what it is. And as you may know, although it is now recognized that boards are responsible for oversight of risk management, many audit committees are responsible for risk management oversight pursuant to statute, regulation, or exchange requirements, and a typical audit committee charter lists oversight of risk management as an area of responsibility, generally there is no legally required or mandated risk management framework or process, although some industries (such as banks, for example) are heavily regulated for risk management purposes. It is possible that the new COSO ERM Framework will become the accepted framework to follow, although other frameworks do exist.

COSO (the Committee of Sponsoring Organizations of the Treadway Commission) is a private sector initiative, jointly sponsored and funded by the American Accounting Association, American Institute of Certified Public Accountants, Financial Executives International, Institute of Management Accountants, and The Institute of Internal Auditors.

The new COSO ERM Framework is organized into five interrelated primary or core components, which are supported by a set of twenty principles. The following is a broad outline of the five components and twenty principles. And as I stated above, in later posts I will be adding considerable detail. Below I have also provided an outline for the COSO 2013 Internal Control Framework, and a discussion about the business judgment rule.

Thanks for reading. David Tate, Esq., Royse Law Firm, Menlo Park office, with offices in the San Francisco Bay Area and Los Angeles

 

COSO ERM Framework – Enterprise Risk Management – Integrating with Strategy and Performance (five components, and twenty principles)

I.  Governance and Culture Component:

Supporting Principles:

  1. Exercises Board Risk Oversight
  2. Establishes Operating Structures
  3. Defines Desired Culture
  4. Demonstrates Commitment to Core Values
  5. Attracts, Develops, and Retains Capable Individuals

II.  Strategy and Objective-Setting Component:

  1. Analyzes Business Context
  2. Defines Risk Appetite
  3. Evaluates Alternative Strategies
  4. Formulates Business Objectives

III.  Performance Component:

  1. Identifies Risk
  2. Assesses Severity of Risk
  3. Prioritizes Risks
  4. Implements Risk Responses
  5. Develops Portfolio View

IV.  Review and Revision Component:

  1. Assesses Substantial Change
  2. Reviews Risk and Performance
  3. Pursues Improvement in Enterprise Risk Management

V.  Information, Communication, and Reporting Component:

  1. Leverages Information and Technology
  2. Communicates Risk Information
  3. Reports on Risk, Culture, and Performance

 

Enterprise Risk Management (ERM) and internal controls work together and should complement each other. The following is the broad outline of the COSO 2013 Internal Control Framework.

Sarbanes-Oxley section 404 requires public company management and its external auditors to attest to the design and operating effectiveness of a company’s internal control over external financial reporting. Internal controls should also be designed and implemented for private company, nonprofit and governmental entities.

COSO 2013 Internal Control Framework – 5 Components, and 17 Principles

1.  Control Environment Component:

Mandatory Principles

  1. Demonstrate commitment to integrity and ethical values.
  2. Board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
  3. Management establishes, with board oversight, structures and reporting lines and appropriate authorities and responsibilities in the pursuit of objectives.
  4. Demonstrate commitment to attract, develop and retain competent individuals in alignment with objectives.
  5. Hold individuals accountable for their internal control responsibilities in the pursuit of objectives.

2.  Risk Assessment Component:

Mandatory Principles

  1. Specify objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
  2. Identify risks to the achievement of its objectives across the entity and analyze risks as a basis for determining how the risks should be managed.
  3. Consider the potential for fraud in assessing risks to the achievement of objectives.
  4. Identify and assess changes that could significantly impact the system of internal control.

3.  Control Activities Component:

Mandatory Principles

  1. Select and develop control activities that contribute to the mitigation of risks to the achievement of objectives and acceptable levels.
  2. Select and develop general control activities over technology to support the achievement of objectives.
  3. Deploy control activities through policies that establish what is expected and procedures that put policies into action.

4.  Information & Communication Component:

Mandatory Principles

  1. Obtain or generate and use relevant, quality information to support the functioning of internal control.
  2. Internally communicate information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
  3. Communicate with external parties regarding matters affecting the functioning of internal control.

5.  Monitoring Activities Component:

Mandatory Principles

  1. Select, develop and perform ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
  2. Evaluate and communicate internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

 

The Business Judgment Rule

The business judgment rule also is relevant on these topics (from Tate’s Excellent Audit Committee Guide). The business judgment rule provides a director with a defense to personal liability, holding that as a general principle of law, a director, including a director who serves as a member of a board committee, who satisfies the business judgment rule has satisfied his or her duties. Thus, the business judgment rule provides one standard of care, although other standards may very well also apply to specific tasks and responsibilities. The business judgment rule provides a very good overall approach for directors and audit committee members to follow, although the rule itself is lacking in specific detail. In some states the business judgment rule is codified by statute while in other states the rule is established by case law (see, i.e., Cal. Corp. Code §309 for California corporations, Del. Gen. Corp. Law §141 for Delaware corporations, in addition to relevant case law). The rule also applies to directors as board committee members.

The Business Judgment Rule

In summary, as a general principle the business judgment rule provides that a director should undertake his or her duties:

-In good faith, with honesty and without self-dealing, conflict or improper personal benefit;

-In a manner that the director reasonably believes to be in the best interests of the corporation and its shareholders; and

-With the care, including reasonable inquiry, that an ordinarily prudent person in a like position with like expertise would use under similar circumstances. The rule itself doesn’t require a particular level of expertise, knowledge or understanding; however, as you might be aware, public company audit committee members do have such a requirement, and you can at least argue that, depending on the facts and circumstances, a board or committee member should have or should obtain a certain unspecified level of knowledge or understanding to be sufficiently prepared to ask questions, evaluate information provided, and make decisions.

Reliance Upon Other People Under the Business Judgment Rule

In the course and scope of performing his or her duties, a director must necessarily obtain information from and rely upon other people. An independent director is not involved in the day-to-day operations of the business. The director provides an oversight function. Pursuant to the business judgment rule, a director is entitled to rely on information, opinions, reports or statements, including financial statements and other financial data, prepared or presented by any of the following:

-Officers or employees of the corporation whom the director reasonably believes to be reliable and competent in the relevant matters;

-Legal counsel, independent accountants or other persons as to matters that the director reasonably believes are within the person’s professional or expert competence; or

-A committee of the board on which the director does not serve, as to matters within that committee’s designated authority, so long as the director acts in good faith, after reasonable inquiry as warranted by the circumstances, and without knowledge that would cause reliance to be unwarranted.

That’s it for now. Thanks for reading. Much, much more to come on these topics. David Tate, Esq., Royse Law Firm, Menlo Park office, with offices in the San Francisco Bay Area and Los Angeles

* * * * *

Advertisements

Comments re post by Norman Marks – internal audit and ERM accused of failing to hit the mark – discussion about management, boards and audit committees – David Tate, Esq., Royse Law Firm

I have provided below a link to a post by Norman Marks, in which Norman discusses and in part compares or contrasts internal audit and ERM. Norman’s post is a good, worthwhile read.

There are many good writers on these topics – you will also note that there are disagreements between knowledgeable professionals. Just for example, as Norman notes, ERM or enterprise risk management is a management function (I would say a management, board and audit committee function) whereas internal audit is independent; however, there has been for sometime considerable discussion about the role of internal audit and whether it can be or should be or has been expanded in ways that could make it less independent or less of an audit function and more of an advisory function in some circumstances – internal audit endeavors to make itself more valuable and needed as a function and department.

I don’t get into the discussions about whether internal audit should or should not be less independent or more advisory – instead, if internal audit is not being sufficiently utilized I primarily attribute that to one or both of two reasons which can be interrelated: (1) either internal audit needs to do a better job selling to management, the board and the audit committee how internal audit can help, or (2) particularly the board and the audit committee need to be more educated or convinced about how internal audit can help them to satisfy their oversight duties and responsibilities (I can help you with reason (2)).

If you are interested in risk management and enterprise risk management you are aware that COSO is still updating its ERM framework. If you aren’t interested in risk management or ERM but you are a board and/or audit committee member you definitely should be interested as it or parts of it are part of your oversight duties and responsibilities.

COSO has said that its updated ERM function should be out mid-2017, in other words, soon. This is a big deal. Whereas risk management professionals will extensively evaluate and comment about the new framework from an ERM perspective, and although I am also a CPA, I will primarily evaluate the framework from a legal perspective and what the new framework will or may require of management, the board and the audit committee in satisfaction of their duties and responsibilities. Add to this the COSO 2013 updated internal control framework, and the changes that are being made to audit procedures and the audit report, in addition to increasing disclosures about events, practices and procedures not just numbers, and you have a significantly changing environment in terms of management, board and audit committee duties and responsibilities.

That’s all for now. Below is the link to Norman Marks’ new blog post – read his post – it covers more about internal audit and ERM than the title indicates. David Tate, Esq., Royse Law Firm (see below for firm practice areas), Menlo Park, California office, with offices in northern and southern California. The following is a link to my other blog, about trust, estate, and elder, etc., disputes, litigation and difficult or contentious administrations: http://californiaestatetrust.com.

Here is the link to Norman’s post:  https://normanmarks.wordpress.com/2017/07/15/internal-audit-and-erm-accused-of-failing-to-hit-the-mark/

David Tate, Esq. (and CPA, California inactive). Royse Law Firm, Menlo Park Office, California (with offices in both northern and southern California).

Royse Law Firm – Practice Area Overview – San Francisco Bay Area and Los Angeles Basin, http://rroyselaw.com/

  • Corporate and Securities, Financing and Formation
  • Corporate Governance, D&O, Boards and Committees, Audit Committees, Etc.
  • Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  • International
  • Immigration
  • Mergers & Acquisitions
  • Labor and Employment
  • Disputes and Litigation (I broke out these areas because they are my primary areas of practice)
  •             Business
  •             Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  •             Trade Secrets, NDA, Financial & Accounting Issues, Fraud, Lost Income, Royalties, Etc.
  •             Privacy, Internet, Hacking, Speech, Etc.
  •             Labor and Employment
  •             Mergers & Acquisitions
  •             Real Estate
  •             Owner, Founder, Investor, Board & Committee, Shareholder, D&O, Lender/Debtor, Etc.
  •             Insurance Coverage and Bad Faith
  •             Investigations
  •             Trust, Estate, Conservatorship, Elder Abuse, Etc., and Contentious Administrations
  •             Dispute Resolution and Mediation
  • Real Estate
  • Tax (US and International) and Tax Litigation
  • Technology Companies and Transactions Including AgTech, HealthTech, etc.
  • Wealth and Estate Planning, Trust and Estate Administration, and Disputes and Litigation

New COSO Updated ERM Framework – Coming Soon – End of June, Perhaps – Could Be Very Important

Just a heads up, a source has suggested that the new long-anticipated COSO (Committee of Sponsoring Organizations of the Treadway Commission) ERM update might finally be out at the end of June. COSO is spending a very long time (since October 2014) preparing and vetting this “update” of the 2004 Enterprise Risk Management — Integrated Framework. COSO’s sponsoring organizations are the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), The Institute of Internal Auditors (IIA), and the National Association of Accountants (now the Institute of Management Accountants [IMA]), and the Commission includes representatives from industry, public accounting, investment firms, and SROs (exchanges).

We’ll have to wait and see what we get with this “update,” which will either simply be a relatively unimpressive or vague tweak, or a useful, modernized, sufficiently detailed guide which might become the standard to achieve, or somewhere in between. I’m hopeful for the useful version – ERM needs a big boost – this “update” is important. I find that there really are only three ways to provide this type of boost: sponsorship and push by large or influential organizations and people, mandatory (i.e., by law, regulation or rule) adoption, or, sometimes, push and expectancy by the public.

Here is the link to the COSO website https://www.coso.org/Pages/default.aspx

Best to you, David Tate, Esq., Litigation, D&O, audit committees, etc., Royse Law Firm http://rroyselaw.com/

Important – SEC v. United – Administrative Proceeding Relating to United’s Internal Accounting Controls to Prevent Violation of United’s Policies

On December 2, 2016, the SEC issued an Accounting and Auditing Enforcement, Administrative Proceeding Order against United Continental Holdings, Inc. Here is a link to the Order, CLICK HERE

Why is this Order important – because the SEC found that “United failed to design and maintain a system of internal accounting controls that was sufficient to prevent its officers from approving the use of United’s assets in connection with the South Carolina Route in violation of United’s Policies, which prohibited the use of assets for corrupt purposes.” This isn’t a Foreign Corrupt Practices Act case – the alleged corruption or impropriety occurred in the United States. The SEC alleged that United “instituted the South Carolina Route following pressure from David Samson (“Samson”), then the Chairman of he Board of Commissioners of the Port Authority of New York and New Jersey (“Port Authority”). The route provided Samson – who exercised authority and influence as a Port Authority official in matters affecting United’s business interests – with a more direct route to his house in South Carolina.”

The scenario in this case could occur at any time that a public company (1) allegedly acts improperly, and (2) it is alleged that the act was allowed or able to occur because of insufficient internal controls (resulting in a violation of the books and records and internal accounting controls provisions of the Securities Exchange Act, which is automatically alleged in a great number of cases because it is easy in most situations to allege that something unexpected occurred because of inadequate internal controls), and (3) the alleged improper act also allegedly violates some policy or procedure of the public company (i.e., in this case to not use corporate assets for an allegedly corrupt or improper purpose).

What can a company (and the audit committee) do about these possible situations? Review the company’s policies and procedures, and adopt and enact sufficient internal controls, monitored and updated regularly, to ensure that the policies and procedures are followed. But, of course, it is difficult and probably impossible to ensure 100% compliance. I have previously written that the books and records and internal accounting controls provision in the Securities Exchange Act should be amended to include a standard of conduct provision (such as negligence) because it is unreasonable to expect that internal controls, no matter how good, will stop all alleged wrongful conduct.

Below is a screenshot of some of the SEC v. United Order, providing a summary of some of the facts, and I have also included below a link to Tate’s Excellent Audit Committee Guide. Dave Tate, Esq., San Francisco and California

sec-v-united-continental-holdings

The following is a link to Tate’s Excellent Audit Committee Guide (updated October 20, 2016), Click Here

The following is a link to my trust, estate, conservatorship and elder abuse litigation blog, http://californiaestatetrust.com

Audit Committee 5 Lines of Defense 07182016

 

Gretchen Carlson – Harassment & Discrimination – Culture – A Task For The Board – And Internal Audit?

I have provided below a link to a short article about Gretchen Carlson, an interview that she is giving, possible legislative efforts, and sexual harassment and discrimination. We all know, or should know, that this is an important topic. Not only sexual harassment and discrimination, but harassment, discrimination, retaliation, bullying, and hostile environments, and not only male harassment and discrimination of females, but also female v. male, male v. male, female v. female, and including race, color, ancestry and national origin, religion and creed, age and elder, mental and physical disability, sex and gender, sexual orientation, gender identity, and more.

This is or should become an area of oversight for your board, and it also relates to the culture of the organization, and tone at the top, at the middle, and at the lower employee levels, including an environment that encourages people to report harassment and discrimination without fear of retribution, anonymously if the desired, with the knowledge that the reported conduct will be timely, fairly and fully investigated, and that appropriate action will be taken.

This really isn’t new stuff from legal and governance perspectives. Are your board, and the board’s committees, on top of this issue and the culture of the organization?

These can and often are difficult issues and situations.  Of course anyone accused is entitled to a defense, and to rebut the allegations. At law, in most situations, innocence is presumed. In recent past years there have also been stories involving allegations of harassment and discrimination reported in the news that turned out to be false or at least not sufficiently supported.

An investigation into situations involving these allegations often should be performed by outside legal counsel with a reputation for integrity and knowledge and experience in these practice areas.

But let me also suggest that the culture of the organization (but not an actual investigation of a specific situation) also could be an area for attention by internal audit, if the board or management puts it on internal audit’s agenda, and if internal audit is provided education and training about the critical elements, and investigation techniques, and help preparing an audit and reporting program. After all, internal audit also is looking to become more relevant in helping the organization to achieve its organizational objectives, goals and strategies.

The following is a link to one of the articles about Gretchen Carlson and what she is trying to do and accomplish: http://people.com/tv/gretchen-carlson-alleged-sexual-harassment-in-2020-interview/

 

New ISO Anti-Bribery Standard – Will It Give Companies An Absolute Defense?

ISO has published its new international anti-bribery standard, ISO 37001. You can find select information about the new standard HERE and at http://http://www.iso.org/iso/home/standards/management-standards/iso37001.htm .

The short PowerPoint presentation in part says:

The Standard benefits an organization by providing:

  • Minimum requirements and supporting guidance for implementing or benchmarking an anti-bribery management system
  • Assurance to management, investors, employees, customers, and other stakeholders that an organization is taking reasonable steps to prevent bribery
  • Evidence in the event of an investigation that an organization has taken reasonable steps to prevent bribery.

SO HERE’S AN INTERESTING QUESTION: will compliance with the standard give the company a free pass on bribery liability with the SEC and other state and federal entities and agencies if in fact a bribery occurs? I bet not. However, consider that generally liability does not result unless the person or entity charged has breached or failed to satisfy the applicable standard or duty of care (except in select situations, e.g., such as strict liability or products liability, etc.), and that breach or failure causes damages. Thus, if the applicable standard becomes ISO 37001, and if that standard is met or satisfied, it certainly is arguable that no fault or liability should result if a bribery occurs.

Best to you, Dave Tate, Esq., San Francisco and California. See also Tate’s Excellent Audit Committee Guide (updated October 2016), tates-excellent-audit-committee-guide-10202016-final-with-appendix-a

The Business Judgment Rule – a short animation (for fun, but also correct):

Audit Committee 5 Lines of Defense 07182016

DTatePicture_Square

Updated Tate’s Excellent Audit Committee Guide – Attached – Use It – Pass It Along – Free

Below is a link to my updated Tate’s Excellent Audit Committee Guide (updated October 20, 2016). Please use it, and pass it to other people who would be interested, such as audit committee members, directors, officers, accountants, internal and external auditors, in-house counsel, compliance professionals, and other people.

I do note that as I was updating these materials, and going through the entire Guide, it definitely hit me that all of the specifically enacted statutes, regulations, rules and pronouncements definitely could cause an audit committee member to not be able to see the forest for the tress. So let’s also not forget to look at the situation as a whole.

Although the Guide is 186 pages, I do expect some significant updates soon, and perhaps prior to the end of 2016. Many of the updates will be posted to this blog first, and then to the Guide. I am looking forward to the COSO enterprise risk management (ERM) updated framework.

Best to you. Dave Tate, Esq., San Francisco and California.

Here is a link to the updated Tate’s Excellent Audit Committee Guide (updated October 20, 2016), tates-excellent-audit-committee-guide-10202016-final-with-appendix-a

Audit Committee 5 Lines of Defense 07182016

The business judgment rule – an animated video:

 

DTatePicture_Square