Control and the AIS Control and the Accounting Information System

This paper discusses the process of integrating controls into the accounting information system (AIS) using enterprise risk management (ERM) components. ERM is defined as "a process, effected by an entity's board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives." (Committee of Sponsoring Organizations of the Treadway Commission, COSO, 2004, p.2).

According to COSO, ERM encompasses:

Aligning risk appetite and strategy

Enhancing risk response decisions

Reducing operational surprises and losses

Identifying and managing multiple and cross-enterprise risks

Seizing opportunities

Improving deployment of capital (COSO, 2004, p. 7).

ERM integrates concepts of internal control and the Sarbanes-Oxley Act. Internal controls of accounting systems are intended to protect a company from fraud, abuse, and inaccurate data recording, as well as to help organizations keep track of essential financial activities....

The Sarbanes-Oxley Act created new standards for corporate accountability along with new penalties for wrongdoing that violated corporate disclosure requirements.
COSO ( 2004, pp. 3-4) developed an integrated framework for ERM that consists of eight components:

Internal environment

Objective setting

Event identification

Risk assessment

Risk response

Control activities

Information and communication

Monitoring

The internal environment comprises factors such as the risk appetite, ethics and values of an organization; it establishes a basis for how risk is viewed and addressed by management and staff, their risk management philosophy and the environment in which they operate.

Objective setting describes the next step in the process, defining the risk related objectives of the organization and related strategic goals. Objectives must exist prior to management identifying potential events affecting their achievement. ERM ensures that management has a process in place for setting objectives, and that the selected objectives support and align with the mission's entity, and are consistent with the entity's risk appetite.

Event identification focuses on…