The first volume of this Primer will explain COSO evaluation criteria.  This issue describes risk assessment. One often hears auditors talk about the COSO pyramid.  This triangle depicts the interrelated way a company is best managed and the components are the evaluation criteria used to measure internal control. Working from the base to the tip these are: 1) Control Environment, 2) Risk Assessment, 3) Control Activities, and 4) Monitoring. Wrap these principles with Information and Communication and you will be ready for a COSO compliant audit.

IT Risk and Control

Now that financial controls and processes must be verified and documented as to their effectiveness by an external auditor, boards of directors, CEOs and CFOs are changing their existing reporting templates to comply with section 404, Sarbanes-Oxley. Greater transparency is ensured in the mandatory quarterly disclosure of controls and procedures audit.
 
The CIO' s group builds and runs the applications that the business units store the data. Segregation of duties must be established to record and report risk. The internal auditor has to match control objectives with where they take place and provide assurance that the applications designed and the transaction data are separated. 
 
Change Control, a process for monitoring procedures like access to sensitive accounts, must be measured for accuracy, completeness, timeliness and also tested at critical points. The eight steps to Risk Assessment compliance are:
1) Automated controls
2) Limited and secure access to transactions and data
3) Data Validation
4) Error checking and reporting
5) Calculations
6) Accurate reporting
7) Tracking interface
8) Reliance on computer generated reports

COSO Risk Assessment

On the second layer above Control Environment COSO evaluation criteria, is Risk Assessment. Organizations address external and internal risks and most importantly one must establish objectives and link them to all levels consistently. Compliance to COSO Risk Assessment requires one to identify and analyze risks in relation to the established objectives. For your ready reference we have listed below some of the required tasks.