COSO《內(nèi)部控制-整合框架》執(zhí)行綱要2013版(中英文對(duì)照)

1、InternalControlIntegratedFramework內(nèi)部控制整合框架ExecutiveSummary執(zhí)行綱要Internalcontrolhelpsentitiesachieveimportantobjectivesandsustainandimproveperformance.COSOsInternalControlIntegratedFramework(Framework)enablesorganizationstoeffectivelyandefficientlydevelopsystemsofinternalcontrolthatadapttochangingbusin

2、essandoperatingenvironments,mitigateriskstoacceptablelevels,andsupportsounddecisionmakingandgovernanceoftheorganization.內(nèi)部控制幫助組織達(dá)到重要的目標(biāo)，維持和改進(jìn)業(yè)績(jī)。科索委員會(huì)的內(nèi)部控制整合框架使得組織能夠開(kāi)發(fā)有效果且有效率的內(nèi)部控制體系，該體系且能夠適應(yīng)變化的商業(yè)和運(yùn)營(yíng)環(huán)境，將風(fēng)險(xiǎn)降低到可接受的水平，并且促進(jìn)規(guī)范決策和組織的治理。Designingandimplementinganeffectivesystemofinternalcontrolcanbechallengi

3、ng;operatingthatsystemeffectivelyandefficientlyeverydaycanbedaunting.Newandrapidlychangingbusinessmodels,greateruseanddependenceontechnology,increasingregulatoryrequirementsandscrutiny,globalization,andotherchallengesdemandanysystemofinternalcontroltobeagileinadaptingtochangesinbusiness,operatingand

4、regulatory第1頁(yè)environments.設(shè)計(jì)并實(shí)施一套有效的內(nèi)部控制體系是充滿挑戰(zhàn)的；每天保持制度運(yùn)行的效果和效率會(huì)讓人可望而不可及。嶄新且不斷更新的商業(yè)模型，對(duì)技術(shù)的深入應(yīng)用和依賴，日益繁多的監(jiān)管要求和檢查，全球化和其他挑戰(zhàn)要求每一個(gè)組織的內(nèi)部控制體系都能夠更加敏捷地適應(yīng)不斷變化的商業(yè)、運(yùn)營(yíng)和監(jiān)管的環(huán)境。Aneffectivesystemofinternalcontroldemandsmorethanrigorousadherencetopoliciesandprocedures:itrequirestheuseofjudgment.Managementandboardsofdi

5、rectors1usejudgmenttodeterminehowmuchcontrolisenough.Managementandotherpersonnelusejudgmenteverydaytoselect,develop,anddeploycontrolsacrosstheentity.Managementandinternalauditors,amongotherpersonnel,applyjudgmentastheymonitorandassesstheeffectivenessofthesystemofinternalcontrol.一套有效的內(nèi)部控制體系除了對(duì)制度和流程嚴(yán)格

6、遵守外，還要求判斷力。管理層和董事會(huì)通過(guò)其判斷來(lái)決定多少控制是充分的。管理層和其他員工每天通過(guò)其判斷，在組織內(nèi)選取，推進(jìn)和實(shí)施各類控制。管理層和內(nèi)部審計(jì)師，以及其他的員工，通過(guò)其判斷來(lái)監(jiān)控和測(cè)試內(nèi)部控制體系的有效性。TheFrameworkassistsmanagement,boardsofdirectors,externalstakeholders,andothersinteractingwiththeentityintheirrespectivedutiesregardinginternalcontrolwithoutbeingoverlyprescriptive.Itdoessoby1T

7、heFrameworkusestheterm“boardofdirectors,”whichencompassesthegoverningbody,includingboard,boardoftrustees,generalpartners,owner,orsupervisoryboard.本框架使用“董事會(huì)”一詞，泛指治理層，包括：董事會(huì)，理事會(huì)，一般合伙人，所有者和監(jiān)事會(huì)等。第2頁(yè)providingbothunderstandingofwhatconstitutesasystemofinternalcontrolandinsightintowheninternalcontrolisbein

8、gappliedeffectively.本框架在內(nèi)部控制方面，對(duì)管理層，董事會(huì)，外部的利益相關(guān)者和其他與組織產(chǎn)生互動(dòng)關(guān)系的相關(guān)方有所幫助，且不會(huì)過(guò)分死板；而這有賴于對(duì)內(nèi)部控制體系構(gòu)成要素的理解，有賴于對(duì)內(nèi)部控制體系能夠有效實(shí)施的時(shí)機(jī)的洞見(jiàn)。Formanagementandboardsofdirectors,theFrameworkprovides:對(duì)于管理層和董事會(huì)，本框架提供：lAmeanstoapplyinternalcontroltoanytypeofentity,regardlessofindustryorlegalstructure,atthelevelsofentity,opera

9、tingunit,orfunction一套工具，將內(nèi)部控制推廣到各類型的組織，無(wú)論行業(yè)或法律形式，無(wú)論在組織層面，經(jīng)營(yíng)單元層面或職能層面；lAprinciples-basedapproachthatprovidesflexibilityandallowsforjudgmentindesigning,implementing,andconductinginternalcontrolprinciplesthatcanbeappliedattheentity,operating,andfunctionallevels一種原則導(dǎo)向的方法，能夠靈活設(shè)計(jì)，實(shí)施和推進(jìn)內(nèi)部控制，并留有判斷空間這些原則可在組織

10、層面、運(yùn)營(yíng)層面和職能層面應(yīng)用；lRequirementsforaneffectivesystemofinternalcontrolbyconsidering第3頁(yè)howcomponentsandprinciplesarepresentandfunctioningandhowcomponentsoperatetogether一些要求，具體闡述有效的內(nèi)部控制體系的要素和原則是如何存在和發(fā)揮作用，如何在一起產(chǎn)生協(xié)調(diào)作用；lAmeanstoidentifyandanalyzerisks,andtodevelopandmanageappropriateresponsestoriskswithinacce

11、ptablelevelsandwithagreaterfocusonanti-fraudmeasures一套工具，識(shí)別和分析風(fēng)險(xiǎn)，開(kāi)發(fā)和管理合適的風(fēng)險(xiǎn)應(yīng)對(duì)措施將風(fēng)險(xiǎn)控制在可接受的水平，且更關(guān)注反舞弊措施；lAnopportunitytoexpandtheapplicationofinternalcontrolbeyondfinancialreportingtootherformsofreporting,operations,andcomplianceobjectives一個(gè)機(jī)會(huì)，將基于財(cái)務(wù)報(bào)告的內(nèi)部控制擴(kuò)大應(yīng)用范圍，滿足各種其他的報(bào)告、運(yùn)營(yíng)和遵循目標(biāo)；lAnopportunitytoelimi

12、nateineffective,redundant,orinefficientcontrolsthatprovideminimalvalueinreducingriskstotheachievementoftheentitysobjectives一個(gè)機(jī)會(huì)，清理那些在降低風(fēng)險(xiǎn)方面價(jià)值不大的無(wú)效，冗余和低效的控制。Forexternalstakeholdersofanentityandothersthatinteractwiththeentity,applicationofthisFrameworkprovides:第4頁(yè)對(duì)于外部利益相關(guān)者和組織的其他相關(guān)方，本框架的應(yīng)用可使其：lGreaterc

13、onfidenceintheboardofdirectorsoversightofinternalcontrolsystems對(duì)于董事會(huì)針對(duì)內(nèi)部控制的監(jiān)管更有信心；lGreaterconfidenceregardingtheachievementofentityobjectives對(duì)于組織實(shí)現(xiàn)目標(biāo)更有信心；lGreaterconfidenceintheorganizationsabilitytoidentify,analyze,andrespondtoriskandchangesinthebusinessandoperatingenvironments對(duì)組織識(shí)別，分析和應(yīng)對(duì)來(lái)自商業(yè)與運(yùn)營(yíng)環(huán)境風(fēng)

14、險(xiǎn)與變化的能力更有信心；lGreaterunderstandingoftherequirementofaneffectivesystemofinternalcontrol更了解有效的內(nèi)部控制體系的具體要求；lGreaterunderstandingthatthroughtheuseofjudgment,managementmaybeabletoeliminateineffective,redundant,orinefficientcontrols更了解管理層如何通過(guò)其判斷清理那些無(wú)效，冗余和低效的控制。Internalcontrolisnotaserialprocessbutadynamica

15、ndintegratedprocess.TheFrameworkappliestoallentities:large,mid-size,small,for-profitandnot-for-profit,andgovernmentbodies.However,eachorganizationmaychoosetoimplementinternalcontroldifferently.For第5頁(yè)instance,asmallerentityssystemofinternalcontrolmaybelessformalandlessstructured,yetstillhaveeffective

16、internalcontrol.內(nèi)部控制不是一個(gè)按部就班的過(guò)程而是一個(gè)動(dòng)態(tài)和整合的過(guò)程。本框架可以適用于各類型的組織：大型，中型或小型；盈利，非盈利或政府機(jī)構(gòu)。然而，每個(gè)組織都可以有權(quán)選擇，實(shí)施不同的內(nèi)部控制。例如，一個(gè)小型組織的內(nèi)控體系可以不那么正式和結(jié)構(gòu)清晰，但仍保持有效。TheremainderofthisExecutiveSummaryprovidesanoverviewofinternalcontrol,includingadefinition,categoriesofobjective,descriptionoftherequisitecomponentsandassociated

17、principles,andrequirementofaneffectivesystemofinternalcontrol.Italsoincludesadiscussionoflimitationsthereasonswhynosystemofinternalcontrolcanbeperfect.Finally,itoffersconsiderationsonhowvariouspartiesmayusetheFramework.以下，本文將對(duì)內(nèi)部控制提供總覽，包括定義，各類別的目標(biāo)，必要要素和相關(guān)原則的描述，以及對(duì)一個(gè)有效內(nèi)部控制體系的要求。本文也將討論內(nèi)部控制的局限性為什么沒(méi)有一個(gè)內(nèi)部

18、控制體系是完美的。第6頁(yè)DefiningInternalControl定義內(nèi)部控制Internalcontrolisdefinedasfollows:內(nèi)部控制定義如下：Internalcontrolisaprocess,effectedbyanentitysboardofdirectors,management,andotherpersonnel,designedtoprovidereasonableassuranceregardingtheachievementofobjectivesrelatingtooperations,reporting,andcompliance.內(nèi)部控制是一套流程

19、，受組織的董事會(huì)，管理層和其他員工所影響，被設(shè)計(jì)并用來(lái)為組織提供合理保證，使其實(shí)現(xiàn)運(yùn)營(yíng)，報(bào)告和遵循目標(biāo)。Thisdefinitionreflectscertainfundamentalconcepts.Internalcontrolis:以上定義體現(xiàn)了一些基礎(chǔ)概念。內(nèi)部控制是：Gearedtotheachievementofobjectivesinoneormorecategoriesoperations,reporting,andcompliance使組織實(shí)現(xiàn)多個(gè)種類的目標(biāo)，如運(yùn)營(yíng)，報(bào)告和遵循；Aprocessconsistingofongoingtasksandactivitiesamea

20、nstoanend,notanendinitself一個(gè)持續(xù)不斷的過(guò)程，包括各種任務(wù)和活動(dòng)一個(gè)達(dá)到目的的手段，而非目的本身；第7頁(yè)Effectedbypeoplenotmerelyaboutpolicyandproceduremanuals,systems,andforms,butaboutpeopleandtheactionstheytakeateverylevelofanorganizationtoaffectinternalcontrol受人的影響不僅僅是制度和流程手冊(cè)，體系和表單，而是組織各個(gè)層級(jí)的人和他們所采取的行動(dòng)；Abletoprovidereasonableassuranceb

21、utnotabsoluteassurance,toanentitysseniormanagementandboardofdirectors可以向組織的高級(jí)管理層和董事會(huì)提供合理保證而非絕對(duì)保證；Adaptabletotheentitystructureflexibleinapplicationfortheentireentityorforaparticularsubsidiary,division,operatingunit,orbusinessprocess可以適應(yīng)組織的結(jié)構(gòu)可靈活應(yīng)用于整個(gè)組織或一個(gè)分支機(jī)構(gòu)，業(yè)務(wù)部，運(yùn)營(yíng)單元或業(yè)務(wù)流程。Thisdefinitionisintentional

22、lybroad.Itcapturesimportantconceptsthatarefundamentaltohoworganizationsdesign,implement,andconductinternalcontrol,providingabasisforapplicationacrossorganizationsthatoperateindifferententitystructures,industries,andgeographicregions.這個(gè)定義被設(shè)定的包含廣泛，包括了關(guān)于組織如何設(shè)計(jì)，實(shí)施和推進(jìn)內(nèi)部控制的一些重要的基礎(chǔ)概念，為不同的組織架構(gòu)，行業(yè)和地理區(qū)域的組織提供了

23、操作支持。第8頁(yè)Objectives目標(biāo)TheFrameworkprovidesforthreecategoriesofobjectives,whichalloworganizationstofocusondifferingaspectsofinternalcontrol:本框架提供了三個(gè)類型的目標(biāo)，使得組織可以關(guān)注于內(nèi)部控制的不同方面：OperationsObjectivesThesepertaintoeffectivenessandefficiencyoftheentitysoperations,includingoperationalandfinancialperformancegoal

24、s,andsafeguardingassetsagainstloss.運(yùn)營(yíng)目標(biāo)組織運(yùn)營(yíng)的效果和效率，包括運(yùn)營(yíng)和財(cái)務(wù)績(jī)效目標(biāo)，資產(chǎn)安全不受損失。ReportingObjectivesThesepertaintointernalandexternalfinancialandnon-financialreportingandmayencompassreliability,timeliness,transpar-ency,orothertermsassetforthbyregulators,recognizedstandardsetters,ortheentityspolicies.報(bào)告目標(biāo)內(nèi)、外部的

25、財(cái)務(wù)和非財(cái)務(wù)報(bào)告的可靠性、及時(shí)性、透明度，以及其他監(jiān)管者、公認(rèn)的標(biāo)準(zhǔn)制定機(jī)構(gòu)和組織政策所要求的方面。ComplianceObjectivesThesepertaintoadherencetolawsandregulationstowhichtheentityissubject.遵循目標(biāo)遵守對(duì)組織適用的法律法規(guī)。第9頁(yè)ComponentsofInternalControl內(nèi)部控制的要素Internalcontrolconsistsoffiveintegratedcomponents.內(nèi)部控制包括五個(gè)相關(guān)關(guān)聯(lián)的要素。ControlEnvironment控制環(huán)境Thecontrolenvironme

26、ntisthesetofstandards,processes,andstructuresthatprovidethebasisforcarryingoutinternalcontrolacrosstheorganization.Theboardofdirectorsandseniormanagementestablishthetoneatthetopregardingtheimportanceofinternalcontrolincludingexpectedstandardsofconduct.Managementreinforcesexpectationsatthevariousleve

27、lsoftheorganization.Thecontrolenvironmentcomprisestheintegrityandethicalvaluesoftheorganization;theparametersenablingtheboardofdirectorstocarryoutitsgovernanceoversightresponsibilities;theorganizationalstruc-tureandassignmentofauthorityandresponsibility;theprocessforattracting,developing,andretainin

28、gcompetentindividuals;andtherigoraroundperformancemeasures,incentives,andrewardstodriveaccountabilityforperformance.Theresultingcontrolenvironmenthasapervasiveimpactontheoverallsystemofinternalcontrol.控制環(huán)境是一套標(biāo)準(zhǔn)、流程和結(jié)構(gòu)，能夠?yàn)閮?nèi)部控制的實(shí)施提供基礎(chǔ)。董事會(huì)和高級(jí)管理層為內(nèi)部控制的重要性（包括期待的行為準(zhǔn)則）提第10頁(yè)供高層定調(diào)（thetoneatthetop）。組織各個(gè)層級(jí)的管理活動(dòng)

29、強(qiáng)化了這種期望?？刂骗h(huán)境包括了組織正直和道德的價(jià)值觀；促進(jìn)董事會(huì)行使公司治理的監(jiān)控職責(zé)的機(jī)制；吸引、開(kāi)發(fā)和保留人才的機(jī)制；嚴(yán)格的績(jī)效衡量、激勵(lì)和匯報(bào)機(jī)制以保證績(jī)效實(shí)現(xiàn)。控制環(huán)境會(huì)對(duì)內(nèi)部控制的整體體系產(chǎn)生全面影響。RiskAssessment風(fēng)險(xiǎn)評(píng)估Everyentityfacesavarietyofrisksfromexternalandinternalsources.Riskisdefinedasthepossibilitythataneventwilloccurandadverselyaffecttheachievementofobjectives.Riskassessmentinvolv

30、esadynamicanditerativeprocessforidentifyingandassessingriskstotheachievementofobjectives.Riskstotheachievementoftheseobjectivesfromacrosstheentityareconsideredrelativetoestablishedrisktolerances.Thus,riskassessmentformsthebasisfordetermininghowriskswillbemanaged.每個(gè)組織都面臨著來(lái)自內(nèi)外部的各類風(fēng)險(xiǎn)。風(fēng)險(xiǎn)是潛在事件發(fā)生并對(duì)組織實(shí)現(xiàn)其目標(biāo)

31、產(chǎn)生負(fù)面影響的可能性。風(fēng)險(xiǎn)評(píng)估包括了根據(jù)組織要實(shí)現(xiàn)的目標(biāo)，動(dòng)態(tài)和反復(fù)的識(shí)別和評(píng)估風(fēng)險(xiǎn)的過(guò)程。將全組織范圍的影響目標(biāo)實(shí)現(xiàn)的風(fēng)險(xiǎn)同已經(jīng)建立的風(fēng)險(xiǎn)容忍度一同考量后，風(fēng)險(xiǎn)評(píng)估就為決定風(fēng)險(xiǎn)如何進(jìn)行管理打下了基礎(chǔ)。Apreconditiontoriskassessmentistheestablishmentofobjectives,linkedatdifferentlevelsoftheentity.Managementspecifiesobjectiveswithincategoriesrelatingtooperations,reporting,andcompliancewithsufficient第

32、11頁(yè)claritytobeabletoidentifyandanalyzeriskstothoseobjectives.Managementalsoconsidersthesuitabilityoftheobjectivesfortheentity.Riskassessmentalsorequiresmanagementtoconsidertheimpactofpossiblechangesintheexternalenvironmentandwithinitsownbusinessmodelthatmayrenderinternalcontrolineffective.風(fēng)險(xiǎn)評(píng)估的先決條件是

33、組織各個(gè)層級(jí)的目標(biāo)的確立。管理層要結(jié)合運(yùn)營(yíng)、報(bào)告和遵循的三大類目標(biāo)，明確相應(yīng)的具體目標(biāo)，以便識(shí)別和分析相關(guān)的風(fēng)險(xiǎn)。管理層也要考慮這些目標(biāo)對(duì)于組織的可持續(xù)性。風(fēng)險(xiǎn)評(píng)估還要求管理層考慮可能導(dǎo)致內(nèi)控失效的外部環(huán)境和內(nèi)部商業(yè)模式的可能變化。ControlActivities控制活動(dòng)Controlactivitiesaretheactionsestablishedthroughpoliciesandproceduresthathelpensurethatmanagementsdirectivestomitigateriskstotheachievementofobjectivesarecarriedou

34、t.Controlactivitiesareperformedatalllevelsoftheentity,atvariousstageswithinbusinessprocesses,andoverthetechnologyenvironment.Theymaybepreventiveordetectiveinnatureandmayencompassarangeofmanualandautomatedactivitiessuchasauthorizationsandapprovals,verifications,reconciliations,andbusinessperformancer

35、eviews.Segregationofdutiesistypicallybuiltintotheselectionanddevelopmentofcontrolactivities.Wheresegregationofdutiesisnotpractical,managementselectsanddevelopsalternativecontrolactivities.第12頁(yè)控制活動(dòng)是通過(guò)制度和流程所確立的行動(dòng)，旨在確保管理層降低影響組織目標(biāo)實(shí)現(xiàn)的風(fēng)險(xiǎn)的方針得以實(shí)現(xiàn)。在組織的各個(gè)層級(jí)，業(yè)務(wù)的各個(gè)環(huán)節(jié)，信息技術(shù)的整個(gè)環(huán)境中都應(yīng)實(shí)施控制活動(dòng)。從性質(zhì)上，可以是預(yù)防性的，也可以是檢查性的；應(yīng)覆蓋

36、手工和自動(dòng)控制；包括授權(quán)和批準(zhǔn)，復(fù)核，對(duì)賬和業(yè)務(wù)績(jī)效評(píng)估。不相容職責(zé)分離也是典型的應(yīng)選取和推進(jìn)的控制活動(dòng)。如果不相容職責(zé)分離無(wú)法實(shí)施，管理層應(yīng)選擇和推進(jìn)替代性的控制活動(dòng)。InformationandCommunication信息與溝通Informationisnecessaryfortheentitytocarryoutinternalcontrolresponsibilitiestosupporttheachievementofitsobjectives.Managementobtainsorgeneratesandusesrelevantandqualityinformationfromb

37、othinternalandexternalsourcestosupportthefunctioningofothercomponentsofinternalcontrol.信息對(duì)于組織而言，對(duì)推進(jìn)內(nèi)控、促進(jìn)其目標(biāo)實(shí)現(xiàn)是非常必要的。管理層從內(nèi)外部獲得或生成，并且使用相關(guān)的有質(zhì)量的信息來(lái)支持內(nèi)部控制其他要素的正常運(yùn)轉(zhuǎn)。Communicationisthecontinual,iterativeprocessofproviding,sharing,andobtainingnecessaryinformation.Internalcommunicationisthemeansbywhichinform

38、ationisdisseminatedthroughouttheorganization,flowingup,down,andacrosstheentity.Itenablespersonneltoreceiveaclearmessagefromseniormanagementthatcontrolresponsibilitiesmustbetakenseriously.第13頁(yè)Externalcommunicationistwofold:itenablesinboundcommunicationofrelevantexternalinformation,anditprovidesinform

39、ationtoexternalpartiesinresponsetorequirementsandexpectations.溝通是一個(gè)持續(xù)和不斷重復(fù)的提供、分享和獲得必要的信息的過(guò)程，。內(nèi)部溝通是一個(gè)手段，使得信息能夠在整個(gè)組織向上、向下和橫向擴(kuò)散，能夠幫助員工接受來(lái)自高管層的清晰的信息控制的職責(zé)必須認(rèn)真實(shí)施。外部溝通包括兩個(gè)部分：將外部的相關(guān)信息傳入組織內(nèi)部，以及根據(jù)其要求和期望，提供信息給外部的相關(guān)方。MonitoringActivities監(jiān)督活動(dòng)Ongoingevaluations,separateevaluations,orsomecombinationofthetwoareused

40、toascertainwhethereachofthefivecomponentsofinternalcontrol,includingcontrolstoeffecttheprincipleswithineachcomponent,ispresentandfunctioning.Ongoingevaluations,builtintobusinessprocessesatdifferentlevelsoftheentity,providetimelyinformation.Separateevaluations,conductedperiodically,willvaryinscopeand

41、frequencydependingonassessmentofrisks,effectivenessofongoingevaluations,andothermanagementconsiderations.Findingsareevaluatedagainstcriteriaestablishedbyregulators,recognizedstandard-settingbodiesormanagementandtheboardofdirectors,anddeficienciesarecommunicatedtomanagementandtheboardofdirectorsasapp

42、ropriate.持續(xù)的評(píng)價(jià)，獨(dú)立的評(píng)價(jià)，或者兩者的某種組合可以用來(lái)確認(rèn)內(nèi)部控制的五個(gè)要素以及每個(gè)要素下的原則是否存在并發(fā)揮作用。嵌入整個(gè)業(yè)務(wù)體系的持續(xù)評(píng)價(jià)可以提供及時(shí)的信息；獨(dú)立的評(píng)價(jià)需要定期開(kāi)展，第14頁(yè)其范圍和頻率可能因風(fēng)險(xiǎn)評(píng)估，持續(xù)評(píng)價(jià)的有效程度以及管理層的其他考慮而有所不同。評(píng)價(jià)中的發(fā)現(xiàn)應(yīng)結(jié)合監(jiān)管者、標(biāo)準(zhǔn)訂立機(jī)構(gòu)和管理層、董事會(huì)所設(shè)定的標(biāo)準(zhǔn)進(jìn)行評(píng)估；缺陷應(yīng)當(dāng)視情況傳遞給管理層和董事會(huì)。第15頁(yè)RelationshipofObjectivesandComponents目標(biāo)和要素的關(guān)系A(chǔ)directrelationshipexistsbetweenobjectives,whicharew

43、hatanentitystrivestoachieve,components,whichrepresentwhatisrequiredtoachievetheobjectives,andtheorganizationalstructureoftheentity(theoperatingunits,legalentities,andother).Therelationshipcanbedepictedintheformofacube.組織要實(shí)現(xiàn)的目標(biāo)，為了實(shí)現(xiàn)目標(biāo)所必須的要素，組織的組織架構(gòu)（如運(yùn)營(yíng)單元，法律實(shí)體及其他）這三者之間存在著直接的關(guān)系。這個(gè)關(guān)系可以以一個(gè)立方體的形式展現(xiàn)。Thethr

44、eecategoriesofobjectivesoperations,reporting,andcompliancearerepresentedbythecolumns.運(yùn)營(yíng)、報(bào)告和遵循三類目標(biāo)以縱列表示。Thefivecomponentsarerepresentedbytherows.內(nèi)部控制的五個(gè)要素以橫行表示。Anentitysorganizationalstructureisrepresentedbythethirddimension.組織的組織架構(gòu)以第三維表示。第16頁(yè)ComponentsandPrinciples要素及原則TheFrameworksetsoutseventeenpr

45、inciplesrepresentingthefundamentalconceptsassociatedwitheachcomponent.Becausetheseprinciplesaredrawndirectlyfromthecomponents,anentitycanachieveeffectiveinternalcontrolbyapplyingallprinciples.本框架確立了十七項(xiàng)原則代表了與每個(gè)控制要素相關(guān)的基本概念。因?yàn)檫@些原則直接從控制要素中提煉，一個(gè)組織可以直接應(yīng)用全部這些原則來(lái)實(shí)施內(nèi)部控制。Allprinciplesapplytooperations,reporti

46、ng,andcomplianceobjectives.Theprinciplessupportingthecomponentsofinternalcontrolarelistedbelow.這些原則都可以應(yīng)用于運(yùn)營(yíng)、報(bào)告和遵循三類目標(biāo)。這些每個(gè)控制要素內(nèi)的原則如下：ControlEnvironment控制環(huán)境1.Theorganizationdemonstratesacommitmenttointegrityandethicalvalues.組織對(duì)正直和道德等價(jià)值觀做出承諾。2.Theboardofdirectorsdemonstratesindependencefrommanagement第

47、17頁(yè)andexercisesoversightofthedevelopmentandperformanceofinternalcontrol.董事會(huì)獨(dú)立于管理層，并對(duì)內(nèi)部控制的推進(jìn)與成效加以監(jiān)督控制。3.Managementestablishes,withboardoversight,structures,reportinglines,andappropriateauthoritiesandresponsibilitiesinthepursuitofobjectives.管理層圍繞其目標(biāo)，在治理層監(jiān)督下，建立健全組織架構(gòu)、匯報(bào)條線、合理的授權(quán)與責(zé)任等機(jī)制。4.Theorganizationd

48、emonstratesacommitmenttoattract,develop,andretaincompetentindividualsinalignmentwithobjectives.組織對(duì)吸引、開(kāi)發(fā)和保留與認(rèn)同組織目標(biāo)的人才做出承諾。5.Theorganizationholdsindividualsaccountablefortheirinternalcontrolresponsibilitiesinthepursuitofobjectives.組織根據(jù)其目標(biāo)，使員工各自擔(dān)負(fù)起內(nèi)部控制的相關(guān)責(zé)任。RiskAssessment風(fēng)險(xiǎn)評(píng)估6.Theorganizationspecifiesobjectiveswithsufficientclaritytoenabletheidentificationandassessmentofrisksrelatingtoobjectives.就識(shí)別和評(píng)估與其目標(biāo)相關(guān)的風(fēng)險(xiǎn)，組織做出清晰的目標(biāo)設(shè)定。7.Theorganizationidentifiesriskstotheachievementofitsob