1. 1 الورشة الأولى حول أنظمة الرقابة الداخلية حسب المعايير الدولية تقديم كريم بوجمعة السليتي

2. 2 أنظمة الرقابة الدا خلية حسب المعايير الدولية Internal Control Framework Presentation بعض الأسئلة... Some Questions…

3. 3 أنظمة الرقابة الدا خلية حسب المعايير الدولية Internal Control Framework Presentation

4. 4 What Is Risk?

5. 5

6. 6 How To Identify Risk?

7. What conditions that increase risks?

9. Cost of Fraud & Abuse

10. Do you know that? ©2010 by the Association of Certified Fraud Examiners, Inc

11. Do you know that? ©2010 by the Association of Certified Fraud Examiners, Inc

13. Opportunity is key. To deter opportunity, divide responsibility. Pressure: i.e., financial need. Rationalization: “I deserve it.” “They won’t miss it.” The more dissatisfied the employee, the more likely he/she will engage in criminal behavior. Employees who feel unfairly treated sometimes believe they can “right the scales” by committing occupational fraud and abuse.

15. Examples of Fraudulent Behavior please?

17. ما هو الحل لتخفيف / تقليل / تقليص المخاطر و خاصة عمليات الاحتيال؟ How to Mitigate Risks and Fraud? ما هو الحل لتخفيف / تقليل / تقليص المخاطر و خاصة عمليات الاحتيال؟ How to Mitigate Risks and Fraud?

18. Do you know this? The sum of percentages in this chart exceeds 100 percent because in some cases respondents identified more than one detection method.

19. Implementing An Internal Control Framework is a reasonable guarantee to mitigate Risks and prevent and detect Fraud

20. Potential Risks, Fraud, Waste and Abuse Residual Risks, Fraud, Waste and Abuse

21. 21 Why Internal Control is Important? OMPLIANCE with applicable laws/policies CCOMPLISHMENT of the entity’s mission ELEVANT and reliable data CONOMICAL and efficient use of resources AFEGUARD assets

22. 22 أنظمة الرقابة الدا خلية حسب المعايير الدولية Internal Control Framework Presentation What is the definition of Internal control ?

23. 23 أنظمة الرقابة الدا خلية حسب المعايير الدولية Internal Control Framework Presentation

24. 24 أنظمة الرقابة الدا خلية حسب المعايير الدولية Internal Control Framework Presentation

25. 25 أنظمة الرقابة الدا خلية حسب المعايير الدولية Internal Control Framework Presentation ماهي المعايير المعتمدة فيما يتعلق بالرقابة الداخلية؟

26. 26 Internal Control Framework Presentation What’s Coso?

27. 27

28. Slide 28 The COSO Cubes – I/C and ERM Monitoring Information and Communication Control Activities Risk Response Risk Assessment Event Identification Objective Setting Internal Environment STRATEGIC OPERATIONS REPORTING COMPLIANCE ENTITY - LEVEL DIVISION BUSINESS UNIT SUBSIDIARY

29. 29

30. – Has a pervasive influence on the organization – Reflects the attitude, awareness and actions of the BOD, management and others regarding the importance of internal control History and culture play important roles – “Tone at the top” – Integrity and ethical values Strong code of conduct communicated throughout the organization – Commitment to competence Adequate training, supervision, job descriptions – BOD and audit committee Independent audit committee – Management’s philosophy and operating style Risk taker/conservative, “seat of the pants”/careful planner – Organizational structure Centralized/decentralized, reporting relationships – Human resources policies and practices Recruitment/hiring, new employee orientation, evaluation/promotion/compensation, disciplinary actions What ‘s control Environment? Coso, Internal Control Framework

31. Risk Assessment – Evaluation of potential risks to the organization’s ability to achieve its objectives – 3-step process Estimate the significance of the risk Assess its likelihood Consider how to manage the risk or actions to take – Risks from external factors include legislation, technology – Risks from internal factors include quality of hiring/training – Specific activity-level risks include risks related to specific new products What is Risk Assessment ? Coso, Internal Control Framework

32. Control Activities – Policies and procedures Top-level reviews compare results to budget or other benchmarks Direct functional or activity management entails reviewing operational reports or exception reports and taking corrective action Information processing entails development of new systems or access to data Physical controls over assets Performance indicators entails relating operating data to financial data, and taking analytical, investigative or corrective action Segregation of duties – Integrating risk assessment and control activities Appropriate control activities are established to address specific risks – Controls over information systems General controls that ensure control over all applications (locks on door to computer center) Application controls apply to specific programs – Organization needs to consider evolving technologies and new/modified controls What are Control Activities? Coso, Internal Control Framework

33. 33 Types of Control and Examples DOCUMENTATION - Policies and procedures RECORDS - Recording transactions & events AUTHORIZATION - Approving transactions STRUCTURE - Separation of duties SUPERVISION - Monitoring control objectives SECURITY - Safeguarding resources

34. Slide 34

35. Slide 35 Locked doors, passwords Consistent criteria for review or approval Controlled access/inventory controls Written and communicated policy and procedures Risk Assessments Preventive alert management that a problem has occurred Door alarms, account reconciliations Reviewing, testing, and monitoring controls Audits Complaints Detective controls assist in recovery from problems Insurance policy Corrective

36. 36 CostsCosts BenefitsBenefits Risk Risk ControlControl

37. Communications and Information – Information systems can be formal or informal, internal or external – COSO emphasized that they be Strategic, consistent with the organization’s goals (not outdated) Integrated with other operations – COSO suggests and SOX requires that information be Timely / Accurate / Current / Accessible / Appropriate – Internal systems Most important component may be communication from senior management, “tone at the top” Each person needs to know how he fits into the organization, otherwise may think errors don’t matter Each person needs to know limits, what is unethical/improper Communication must flow up and down – External systems Include a mechanism to capture and act upon complaints, source of potential control issues Communication must flow in both directions Commu nication and Informat ion Coso, Internal Control Framework

38. Monitoring – Historically the role of internal auditors – COSO expands to include ongoing assessments of and adjustments to internal control as circumstances warrant – Many routine business functions are considered monitoring activities, such as reconciliations – Separate internal control evaluations (in addition to ongoing monitoring) need to be performed periodically Can be done by management – Identified internal control deficiencies (no matter how they’re identified) should be reported, investigated, and appropriately acted upon Monitoring? Coso, Internal Control Framework

39. انتبه !!! Pay attenti on

40. 40 So what IC Can Do?

41. There is No IC functi on

42. هذا ما يجب عليك معرفته !! Absolutely to keep in Mind!!! Monitoring Control Activities Risk Assessment Control environment

43. Coso, Internal Control Framework Now It’s time of Practice