Memo assignment

Note: Read the scenario provided and write a memo that is no more than 2-3 single spaced pages in proper memo format as per as the instructions provided.

Scenario:

As required by Section 404 of the Sarbanes-Oxley Act of 2002, the SEC adopted rules requiring certain companies “to include in their annual reports a report of management on the company's internal control over financial reporting. The internal control report must include: a statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting for the company; management's assessment of the effectiveness of the company's internal control over financial reporting as of the end of the company's most recent fiscal year; a statement identifying the framework used by management to evaluate the effectiveness of the company's internal control over financial reporting; and a statement that the registered public accounting firm that audited the company's financial statements included in the annual report has issued an attestation report on management's assessment of the company's internal control over financial reporting.” (http://www.sec.gov/rules/final/33-8238.htm) Some companies, who are not required to report on controls, voluntarily elect to do so.

Committee of Sponsoring Organizations (COSO) Integrated Framework:

In the U.S., most companies use the COSO integrated framework for evaluating controls.

COSO defines internal control as having five components:

• 1.       Control Environment
• 2.       Risk Assessment
• 3.       Information and Communication
• 4.       Control Activities
• 5.       Monitoring

COSO identifies 17 principles that are used to assess the five components. The first principle is used to evaluate the control environment: “The organization demonstrates a commitment to integrity and ethical values.” You can find the executive summary of the COSO framework at http://www.coso.org/documents/990025P_Executive_Summary_final_may20_e.pdf

One of the ways COSO describes as a way to demonstrate this commitment is that management “Sets the tone at the top.”

The Information Systems Audit and Control Association (ISACA) has a nice description of why Tone at the Top matters at this link: http://www.isaca.org/Journal/Past-Issues/2009/Volume-3/Pages/Tone-at-the-Top-Is-Vital1.aspx

Assignment Instructions:

You are to assume the role of an internal auditor who has been asked to identify 5 things that management can do to establish a tone at the top that conveys a commitment to integrity and ethical values. Thus, we are only focusing on the first principle in this assignment. You are to write a memo that is no more than 2-3 single spaced pages in proper memo format - memo heading (person addressed, writer, date, subject), initial by name, introductory paragraph (context, purpose, and preview), headed segments, and conclusion. The memo shall be addressed to the CEO and head of the audit committee of the Board of Directors with recommendations on establishing the appropriate tone. Provide a detailed description of each of the five items and a persuasive argument as to why the item is useful for conveying the appropriate tone. Be sure to identify any sources you have used to help you in your research. Citations and references should comply with APA requirements. Because this is a memo, please use footnotes for including sources and references. Do not include a formal bibliography at the end but please ensure that you have completely documented your sources in the footnotes (See grading rubric on next page.) You should consider the guidance in SAS 99 (Consideration of Fraud in a Financial Statement Audit).

Your memo should explain to the intended audience WHY the items you are recommending convey a commitment to integrity and ethical values. This is important in persuading your audience why they should consider your recommendation. Thus, only listing the five things without justifying them is not sufficient.