 Hello and welcome to this session in which we will discuss the control environment, which is one of the five components of the internal control according to COSO. In the prior session, we looked at the internal control over all. If you don't understand what internal control is or what's the purpose of it, please look at the prior recording. When you think of the internal control, think of the people who manages the company, who owns the company, the owners, the board of directors, top management. What we're looking at here is their attitude, their behavior toward internal control. Why that is important? Here's what research shows. We have this rule called 108010. What is that rule? There are 10% of the people, they're always ethical. They always do the right thing no matter what. There are 10% of the people who are unethical, does not matter how much you monitor in them, train them, guide them, so on and so forth. That's fine. How about the remaining, the majority 80%. The majority 80% of the people follow the people on the top. Therefore, what determines whether a company is ethical or not is the people on the top. If the people on the top are part of this 10%, then they're going to influence the majority of the company, the remaining 80%. And that's why control environment in a company is very important. So control environment are actions, policies and procedures that reflect the overall attitude of top management, directors and owners of the company. What is their attitude toward internal control and its importance? If they value internal control, the people at the bottom, the employees, will value internal control as well. Now, how can we learn about the attitude of the people at the top? We could look at their management, philosophy and operating style. We could look at their integrity and ethical values. We can look at their commitment to competence. We can take a look at the board of directors and audit committee participation. We could look at the internal audit function itself. We can take a look at the organizational structure and accountability. And by examining those six, it's going to give us an idea about the company's control environment, which is a critical component of the internal control. Let's go ahead and get started in discussing each of these components separately. Before we start our discussion, I would like to show you a sample example from the real world. And that's Wells Fargo. Wells Fargo Bank is a bank, is a major bank in the United States. So I'm going to show you what happened to that bank, what happened at that bank. And we're going to come back and look at the various components of the control environment. Wells Fargo has been accused by federal regulator of illegal activity on a stunning level. Authority says employee at the bank secretly created millions of unauthorized bank and credit card accounts between 2011 and July 2015, allowing bank to make more money in fees and meet internal sales target. Obviously the bank was penalized and 5,300 employees were fired. Former employees tell CNN FN, CNN Money, that they felt incredible demand from managers to meal sales quota. The same managers turned a blind eye when ethical and even legal lines were crossed. So keep that statement in mind. I had a manager in my face yelling, Sabrina said, who worked as a licensed personal banker. They wanted you to open a dual checking account for people who could not even manage their original bank account. Currently, she's a middle school teacher. Sabrina says the sale pressure from management was unbearable. Again, keep those statements in mind as we go back to look at the control environment. The pressure cooker environment is also described in a lawsuit filed by the Los Angeles against the Wells Fargo Bank in May 2015. The lawsuit says that Wells Fargo district manager discussed daily sales for each branch and employee four times a day. That's a lot of pressure. 11 a.m. 1 p.m. 3 p.m. and 5 p.m. So they were putting a lot of pressure on their employees. It all stems from Wells Fargo internal goals of selling at least eight financial product. It was called the great initiative, the great eight initiative. In pursuing of this goal, Wells Fargo employees engage in all kinds of sorted practices. One of them was internally called pinning, where the bank issued ATM cards and assigned pin numbers without customer authorization. Also, the bankers were impersonating their customers and input false generic email addresses such as 1234 at Wells Fargo.com. No name at Wells Fargo.com to ensure the transaction is completed. Now, bear in mind, employees were doing so because why? Because they were pressured by upper management. So this is what we need to go back. And when we look at the control environment, I want you to keep Wells Fargo in mind. Let's start by discussing management philosophy and operating style. This serves as the most apparent indicator of the workforce about significance of internal control. So how does the management run the company gives the most strong signal to employees, people at the bottom to do what to run the company? It's essentially reflect the attitude, behavior and action of the organization leadership. Again, the leadership will, whatever they do, whatever they believe, it's going to go down to lower management and lower management will influence employees. And this is how the company is run. So the key questions to consider here might include is the management setting unrealistic sales and profit target? What do you think in case of Wells Fargo? Yes. Are employees being urged to adopt aggressive strategies to achieve goals? Yes. Remember, management, we're looking the other way when it comes to employees. So the other ways when it comes to employees committing fraud, also gaining insight into management philosophy by the auditor can help auditor with a better understanding of the organizational stand toward internal control. What's going to happen is this when I see, when I see as an auditor, the company's attitude toward internal control, I am going to learn a lot about the company, about their behavior about internal control. And as a result, I will do what I will adjust my I will adjust my strategy in auditing this company. Now, integrity and ethical value, that's another component that can greatly influence how internal control are perceived and practiced within the company. Does the company has integrity and ethical values? Well, that's important. What are some indicator about that? Well, you could look at factors such as is there a well understood and enforced stance against fraudulent financial reporting, irrespective at which level it occurs. In other words, how do we know whether it's the company has integrity and ethical values? How are they treating a financial reporting, fraudulent financial reporting is occurring? How does it, how do they look at it? Do they tolerate it or not tolerate it? What do you think in terms of Wells Fargo? Are individual health accountable either through dismissal or disciplinary action if they participate in such behavior? Now, eventually Wells Fargo fired the employees, but that's after they were discovered. So that's different. Do the board and senior executives constantly demonstrate a high standard of integrity and ethical behavior? Why? Because their action can significantly impact the overall ethical climate within the organization. Remember the 10, 80, 10 rules. If the 10% on the top are ethical, they're going to influence the remainder 80%. And the other way is true as well. Is there a written code of ethics available to employees? Now, although it's written, it exists. Is it actively reinforced through training, communication from leadership and requirements for regular written statement of compliance from key employees? It's not only that, you got to tell the key employees to write down, they believe in it and they are going to follow it. In other words, is the code a living document or something that was created, filed and forgotten? Because it's very important. You can have the best code. If it's not being enforced and followed, how good is it? It's not a living document. It's just a piece of paper. Commitment to competence. This relates to the knowledge and skills needed to effectively perform tasks that define a person's role within the organization. How does the company look at commitment and competence? What are some indicators of that? Does management prioritize competence when hiring or is favoritism toward friends and relative prevalent? So when they hire people, are they hired them based on their qualification, experience skills, or are they hired them because they know them, they're doing them a favor? Nothing wrong with hiring someone that you know, as long as they are skilled, competent. Actually, that's easier for you because you know them and you know that they are skilled and competent. But if you are doing favoritism, overriding competency, that's a problem. This could potentially compromise the quality and integrity of the workforce, as well as the overall effectiveness of internal control. Remember, part of the internal control is to achieve company's objective. Well, if you don't have competent employees, you're not going to achieve that effectiveness. It's also important to remember the presence of incompetent or dishonest individual can drastically undermine the effectiveness of any internal control system. If you're hiring people because they are your friends and they're not competent, that's could also negatively affect the internal control. On the other hand, honest and efficient employees can maintain high performance level even in the absence of substantial support from other control mechanism. Simply put, once you hire a person that's not competent and ethical, whether you have a good internal control or not, that's not the issue. On the other hand, if you hire someone who's ethical, well, whether you have a good internal control or not, they're going to behave ethically. However, you've got to keep in mind elements like boredom, dissatisfaction or personal issues can still disrupt their performance. So you always have to monitor the employees. What policies are in place regarding the hiring, evaluation and promotion and compensation of competent trustworthy individuals? So how do they compensate those people? Do they reward them or not reward them? If they don't reward good people, good people will leave and only the bad people will stay. A well-defined and robust policy in these areas can contribute significantly to maintaining a competent workforce in a strong controlled environment. And this is the commitment to competence. How about the participation of board of directors or the audit committee? How involved are they? Again, those are the people on the top. It's going to play a pivotal role in shaping the controlled environment when you see them. They are involved. What should you consider when you are looking at this participation of board of directors and audit committee? Does the organization have an audit committee? That's the first thing because the audit committee within the board of directors is important because that's going to overseas the audit process, which is an independent mechanism. Is the audit committee genuinely functioning independently? Now you could have an audit committee, but are they truly independent from management because they have to? Because when the auditor is auditing the company, they're going to have to go back to the audit committee if they had any issue. And the auditor will have to rely that the audit committee is independent from management because you're auditing management. Is it truly independent? Is there an ongoing and open communication between the audit committee and internal and external auditor? Does the audit committee have the responsibility for hiring the external auditor? That's important. And we learn about this, that who hires the external auditor? The audit committee, not management, because of the independence issue. Does the audit committee authorize non-audit services? For example, if the company wants to have consulting services, tax services, does it go by the audit committee to evaluate whether there is a conflict of interest or no conflict of interest that could impair independence? Also, does the members of the audit committee have a diverse range of expertise, range of expertise, CPAs, business leaders, CFA's, financier, bankers, so on and so forth, including both operational and financial control knowledge? Also, is the audit committee responsible for overseeing the creation of and the compliance with ethical standard within the organization? Okay, and their oversight can be crucial in promoting an ethical corporate culture. So this is how we determine whether the participation of the Board of Directors and the audit committee contributing positively to the control environment. Obviously, if we're talking about internal control, we cannot ignore the internal audit function. Does the company have an internal audit department, internal audit function? And its effectiveness, how effective this internal control would help external auditor tremendously? Its effectiveness often relies on the support of top management, the audit committee and the Board of Directors, as well as the external auditor, because if you have a good internal audit, good internal audit, then you have a better external audit because the external auditor would rely on their work. It's going to save time and complete the audit in an efficient manner. Key aspect to evaluate when you're looking at the internal audit function. First, the first thing is, is top management backing the internal audit function? In other words, are they backing it in terms of budget? Are they given the internal audit authority? Okay, is there a substantial backing from top management as well as the audit committee and the Board of Directors? Okay, this support is essential for the effectiveness of the operating of the internal audit. And the main one you could look at is their budget. Are they given the money to hire people to enforce rules within the company? Has the written scope of the internal audit responsibility has been evaluated by the audit committee for adequacy? Well, they have this evaluation ensured that the internal auditor cover all necessary areas. Has that been evaluated? Is the organizational relationship between the audit committee and senior executive appropriate? And has appropriateness is there an independence between them? Internal auditor should be independent from senior executives. Also, we have to look at the turnover. Is there a high turnover rate that might indicate instability or misalignment in this relationship? If you see that people are constantly leaving the internal audit department, that's bad news. Why? Two reasons. One is they may not be happy with what's going on. That's one. Two, they are not giving enough resources to do their job and both are no good. Are audit reports addressing relevant subject distributed to the appropriate individuals and acted upon promptly? So when the internal audit department issuer report, is it being followed? We can look at this. We can see what's going on. The timeliness and relevance of the audit report are crucial for maintaining an effective control environment. So to determine whether we have a good internal audit function, we would look at all these factors. Also, part of the control environment is the overall organizational structure slash accountability. What is an organizational structure? We have a CEO at the top, CEO at the top, and from the CEO, you have various VP, VP1, VP of operation, VP of finance, VP of HR, VP of whatever division you want. And under those VPs, you're going to have maybe a manager and so on and so forth. This is the organizational structure. The organizational structure comprising the entity level division, operating unit and their function all have their own control. For example, the VP controls this level, the CEO controls all of them. So what relationship do they have in between? Are they well defined? By grasping this structure, auditors can comprehend the businesses, managerial and functional aspect and see how control are enacted. So once they have a clear organizational structure, we can see that there are controls within each department, controls people above you, they're monitoring you, people below you or monitoring the people below you. So there's clear line of authority. Management and the board are tasks with setting expectation and ensuring accountability for internal control. That's their job. Now this process, if they want to do that, relies on creating suitable structure and reporting lines. So if you want to enforce the rules, if you want to enforce controls, you want to make sure you have a structure that allows you to communicate this information and enforce it in a way that is in line with the organizational structure because you're holding people accountable. And this is the sixth component of the control environment. So what we did in this session, we looked at the control environment as one of five components of the internal control. And within the control environment, we looked at six different indicators that determine whether the company value their control environment. And what's the control environment? It's the tone at the top, the tone of management at the top. And why that's important? Because the tone on the top, it's going to follow all the way down. In the next session, we would look at the second component of internal control, which is called risk assessment. What should you do now? You should go to FARHAT lectures, look at additional MCQs through falls, resources that's going to help you understand this topic better. Good luck, study hard, invest in yourself, whether you are a CPA exam candidate or an accounting student, and stay safe.