◄Previous: 10 The COSO framework: information and communication

# 11 The COSO framework: monitoring activities

The fifth control component in the COSO internal control framework is monitoring. Monitoring is a process that assesses the quality of the internal control system’s performance over time. It includes regular management and supervisory activities. Internal control deficiencies should be reported to upper-level management, and serious matters should be reported to the board of directors. Monitoring is essential because it ensures the other components of the COSO internal control framework are running as effectively as planned, and it helps reduce the risk of money laundering (Arens, Elder and Beasley, 2014). The next activity will help you understand the monitoring of internal control activities.

In Activity 4, you will explore internal control in the business context of Ramero Ltd.

## Activity 4 Internal control and mitigating money laundering

Allow around 40 minutes for this activity

The purpose of this activity is for you to identify internal control deficiencies and understand how effective internal control can reduce money laundering.

Read the case study and then answer the questions that follow, applying your knowledge of internal controls.

## Ramero Ltd case study

You have been delegated by the board of directors of Ramero Ltd, a family-owned business, to assess and evaluate the effectiveness of the company’s internal control system, as well as any fraud risks. The company manufactures and sells food and beverages, and has been in the industry for about four years. You have held several meetings with key personnel to get an idea about the company’s internal control system. You also had a tour of the company’s premises to observe the working environment.

Your first meeting was with Mr Jones, the company manager. Mr Jones gave you a very brief idea about the company’s internal control system and organisational structure. Mr Jones explained that he reports directly to the CEO, Mrs Ramy, who strives to meet family owners’ expectations and is under continuous pressure to achieve high returns. Mr Jones is overburdened with many responsibilities as he rarely delegates authority to lower-level managers and prefers to approve and authorise almost every business-related transaction. Mr Jones even sets the required criteria for the company’s employees at all levels and is keen to interview and assess them himself. This is why he thinks there is no need for a human resources department. You were told by Mr Jones that there are two accounts officers in the company, who usually do all the recording as well as the preparation of financial statements. However, there is no finance manager to review and approve the financial records and Mr Jones does that himself.

Your second meeting was with Ms Anderson, the IT manager, who is responsible not only for designing the computerised accounting systems but also for updating customers’ information and maintaining the system. After talking to Ms Anderson, you realised she is a qualified and intelligent employee. She is very loyal to the company and does her best to save money for the company. For example, she does all the updates and data backups herself to save the cost of setting staff passwords, creating backups and purchasing security software. Employees in other departments share computers to save the money needed to purchase a PC for each individual employee. There are only two printers for the whole company, easily accessible to everyone and with no login detail for ease of use.

Your third meeting was with Mr Wenzhao, who has been the external auditor for Ramero Ltd since it was first established. Mr Wenzhao assured you of the integrity and qualification of Ramero’s senior management. He mentioned that he always issues a clean audit report for Ramero Ltd because of the management’s integrity, history, and cooperation. However, he mentioned that some internal control weaknesses have not yet been resolved, despite Mr Wenzhao raising them with management. You noticed that there is no internal audit department or audit committee, which Mr Jones justified by cost constraints and the small size of the company.

During your tour of the company’s premises, you found that there were no security guards for the stockroom and poor-quality locks on the stockroom doors. When you entered the room, you found some of the stock boxes were opened, with some of the stock scattered on the floor. You also found the stockroom inappropriate for keeping food and beverages for a long time. The administrative offices housed ten employees who shared three computers. After talking to three of the employees, you realised that morale is low and they complained of unfair treatment by Mr Jones. One of them commented that ‘if Mr Jones likes you, work will be fun’. Some were also unhappy with the compensation structure and annual pay rises, which are usually not linked to performance but based on Mr Jones’s personal judgement. Employees also have no code of ethics or penalty system, as Mr Jones decides on what is acceptable behaviour in the workplace and who should be penalised for what.

Identify three internal control deficiencies and discuss the potential impact of these deficiencies (in approximately 450 words).

(A text entry box would appear here, but your browser does not support it.)

### Feedback

Mr Jones

Mr Jones is overburdened with a lot of responsibilities as he rarely delegates to lower-level managers and prefers to approve and authorise almost every business-related transaction. Too much power in the hands of one person will increase the risk of fraud, money laundering and abuse.

A heavy workload will lead to inefficiency and increase the risk of error. It will also affect the wellbeing of staff, who will struggle to maintain a healthy work–life balance.

The board of directors should pay attention to the importance of delegation of authority and segregation of duties to ensure efficiency and reduce the risk of fraud, money laundering, abuse and error. The board should evaluate the performance of management to ensure that the risk of management override is reduced.

Lack of human resources department

There is no human resources department. Mr Jones sets the required criteria for the company’s employees at all levels and is keen to interview and assess them himself. As there is no human resources department in this company, there are no experts to respond to employee complaints or address staff development needs. There is a lack of commitment to competence, given that there are concerns about Mr Jones’s qualifications and ability to interview staff. Is he sufficiently well qualified? Would he be fair in his decisions, given that there are no defined criteria for employees’ conduct and expected performance?

No separate finance manager

There is no finance manager to review and approve the financial records. The board of directors should pay attention to the importance of monitoring to reduce the risk of fraud, money laundering, abuse and error. The finance manager’s role is significant in ensuring the accounts are prepared correctly and that employees’ performance in the finance department is up to the required level.

◄Contents►Next: 12 Bribery

OpenLearn - Corporate fraud and criminal behaviour
Except for third party materials and otherwise, this content is made available under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 Licence, full copyright detail can be found in the acknowledgements section. Please see full copyright statement for details.