Controls Definition: Process of exercising a restraining or guiding influence over the activities of an object, organism, or system

COSO  Identify set of controls to guard against threat  Estimate costs and benefits of implementing controls  Evaluate whether to put controls in place  Implement controls (including training)  Monitor

Objective of Internal Controls To reduce likelihood that a threat will come to pass and result in a loss to the organization. (Mitigate risk) »Validity »Completeness »Accuracy »Compliance »Safeguard Assets »Authorized »Timely

Overall IC considerations Means to an end, standard controls are a guideline only Reasonable assurance, not perfection Cost-benefit Controls need context – the company, what it stands for, what level of risk management is willing to tolerate, industry risks involved, etc.

Computer systems controls Data protection –Unique ID/Password –Encryption –Firewalls Physical –Lock rooms –Access monitoring –Data transmission/Internet access restrictions Preventive –Labeling –Backup –Uninterruptible power sources –Disaster recovery

Control matrices Examples Link to Risks identified for groups SLP Corp