1 / 24

Governance Model for Trusted Businesses

BPM GOSPEL (LLP-LDV-TOI-2010-HU-001) This project has been funded with support from the European Commission. This publication reflects the views only of the author s , and the Commission cannot be held responsible for any use which may be made of the information contained therein.

talib
Download Presentation

Governance Model for Trusted Businesses

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. BPM GOSPEL(LLP-LDV-TOI-2010-HU-001)This project has been funded with support from the European Commission.This publicationreflects the views only of the authors, and the Commission cannot be held responsible for any use which may be made of the information contained therein. Governance Model forTrustedBusinesses Linking GovernancetoSustainable Value Creation

  2. Agenda • What‘sthebisunessworldcomingto? • Do weneedtochangetothebetter? • What do wehave so far? • Wehavealreadyrealizedthatweneedmore • That‘swherewecome in • General information on ProcessAssessment • Governance Model forTrustedBusinesses • Ourvision on tomorrow‘sbusinessworld

  3. 1. What‘sthebusinessworldcomingto? Bad Bank …… I have lost myhouseandsavingsandhavedebtdifficulttorepayduringtherestofmylife I am 35 yearsold Country bankruptcy FraudulentRepresentation Not limited tofinancialreporting

  4. 2. Do weneedtochangetothebetter? Yesweneed!

  5. 1/2 3. What do wealreadyhave so far? • Sarbanes-OxleyActfor US-SEC registrantsandtheiraffiliatesglobally • Basel Framework • Company Law in the EU • European and national directives for governmental and public sector organizations • etc.

  6. 2/2 3. What do wealreadyhave so far? • Existinglawsandregulationsalreadyrequiretheimplementationofinternationallyaccepted, sophisticatedriskmanagementandinternalcontrolsystemswhichareperiodicallyassesed in termsofeffectivenessandtheresultsoftheassesmentsdisclosedtothestakeholdersand … tobecontinued on thenextpage

  7. 4. Wehavealreadyrealizedthatweneedmore ....financial and governmental sectors and the regulators are keen to extend and further develop the already exisiting mandatory rules and guidelines to all governance related processes which are not yet addressed in the existing set of regulations and thus regain the trust from the stakeholders with trusted businesses

  8. 5. That‘swherewecome in Governance Model forTrustedBusinesses Linking Governancetosustainablevaluecreation Wewanttointroduce a newmethodolologywhichputsourneedtochangeintoaction

  9. 1/4 6. General information on ProcessAssessmentusingthemostacknoledgedcontrolframeworks • An integral part of conducting a process assessment is to use a Process Assessment Model (PAM), related to Process Reference Model(s) (PRM) and conformant with the requirements defined in ISO/IEC 15504-2. • ISO/IEC 15504-2 provides a framework for process assessment and sets out the minimum requirements for performing an assessment in order to ensure consistency and repeatability (objectivity) of the ratings. • The COSO and COBIT based Process Reference Models associated with the process attributes defined in ISO/IEC 15504-2 provide a common basis for performing assessments of governance capability regarding internal controls and reporting of results by using a common rating scale. ISO/IEC 15504 offers not only a transparent method for assessing performance of relevant governance processes, but also tools for assessing control risk areas based on the gaps between target and assessed capability profiles.

  10. 2/4 6. General information on ProcessAssessmentusingthemostacknoledgedcontrolframeworks The Process Assessment Model according to ISO/IEC 15504 Process Assesment (SPICE) defines a two-dimensional model of process capability. In one dimension, the process dimension, the processes are defined and classified into process categories. In the other dimension, the capability dimension, a set of process attributes grouped into capability levels is defined. The process attributes provide the measurable characteristics ofprocesscapability. Figure 1: Components of ISO/IEC 15504 Process Assessment

  11. 6. General information on ProcessAssessmentusingthemostacknoledgedcontrolframeworks 3/4 Within a Process Assessment Model, the measure of capability is based upon the nine process attributes (PA) defined in ISO/IEC 15504-2 which are grouped in six capability levels. Process attributes are used to determine whether a process has reached a given capability. Each attribute measures a particular aspect of the process capability. At each level there is no ordering between the process attributes; each attribute addresses a specific aspect of the capability level. Figure 1: Measurement Framework of ISO/IEC 15504 Process Assessment

  12. 6. General information on ProcessAssessmentusingthemostacknoledgedcontrolframeworks 4/4 • The nine process attributes are evaluated on a four point ordinal scale of achievement, as defined in ISO/IEC 15504-2. They provide insight into the specific aspects of process capability required to support process improvement and capability determination. • The processcapabilityassesmentisbased on assesmentindicators. Process Attribute Indicators (PAI) applyforlevel 1-5, Base Practices and Work Products apply (on top) exclusivelyforlevel 1. Figure 3: Four point ordinal scale for evaluating the achievement of process attribute

  13. 1/8 7. Governance Model forTrustedBusinessesWhatisit? • The Governance Model for Trusted Businesses (Governance SPICE) relates to the capability assessment of processes in the areas of Governance, Risk Management and Internal Control and is based on the following concepts: · Corporate Governance Principles (OECD) · Recognized Control Frameworks (COSO & COBIT) · Risk Tolerance and Risk Appetite (as of COSO ERM) · Performance Measurement (as of COBIT) · Process Capability Assessment (ISO/IEC 15504-2:2003) · Evaluating Process-related Risk (ISO/IEC 15504-4:2004) · Organizational Maturity (ISO/IEC TR 15504-7:2008)

  14. 2/8 7. Governance Model forTrustedBusinessesEleven GovernanceObjectivesas a basisfordetermininggovernanceprocesses • The Governance Model interprets the following elevengovernance objectives for determining governance processes as special applications of the recognized reference models (COSO, COBIT and Enterprise SPICE) and trusted business principles : • Supporting Organization’s Internal Control System • Risk Awareness • Accountability • Competency • Accuracy • Process Integrity • Data Protection • Commitment • Control Efficiency • Supporting Business Sustainability • Competitiveness • Exploitability • Satisfaction

  15. 3/8 7. Governance Model forTrustedBusinessesEleven governanceprocessesclassifiedintotwoapplicationcategories Based on the eleven relevant governance objectives the governance model determines eleven governance processes as special applications of the recognized reference models (COSO, COBIT and Enterprise SPICE) and trusted business principles. The eleven governance processes are classified into the following two Application Categories: Governance of Controlled Business Operation Application Category • Control Risks – The organization and its staff adequately address risks to the governance objectives relevant for financial reporting and trusted business operation and consider those risks in management of business operation. • Control Management – The management of the organization is able to control business processes in a way which is adequate to the objectives of internal control over financial reporting and trusted business operation. • Control Competence – Sufficient skills and knowledge relevant for the objectives of internal control over financial reporting and trusted business operation are available and used. • Information Reliability – Data architecture and disclosure elements relevant for financial reporting objectives and trusted business operation, and for supporting data processing integrity are accurate and consistent. Process Dimension

  16. 4/8 7. Governance Model forTrustedBusinessesEleven governanceprocessesclasifiedintotwoapplicationcategories • Process Control – Design and operation of process-level controls relevant to the objectives of financial reporting and trusted business operation, and processing integrity principle are effective. • Data Protection – The organization and its staff are committed to security, confidentiality and privacy principles to avoid unauthorized access to and misuse of confidential data effected by business operation. • Integrity Assurance – The organization and its staff are committed to comply with ethical and business integrity requirements relevant to the objectives of financial reporting and trusted business operation, and availability principle. • Control Efficiency – Efficient usage of control resources relevant to the objectives of financial reporting and trusted business operation. • – Ensuring user/customer satisfaction based on agreed levels of business operation. Governance of Controlled Business Operation Application Category • Competitive Operation – Ensuring market recognition of the business operation. • Exploitable Operation – Organization realizes optimal value from business operation.  • Satisfactory Operation – Ensuring user/customer satisfaction based on agreed levels of business operation. Process Dimension

  17. 5/8 7. Governance Model forTrustedBusinessesFourmainobjectivecategoriesmappedtocapabilitylevels In themeasurementframeworkoftheGovernance SPICE model themainobjective categoriesofthe COSO model aremapedtothecapabilitylevelsof ISO/IEC 15504. Capability Dimension Figure 13: Mapping ISO/IEC 15504 capability levels to COSO objective categories

  18. 6/8 7. Governance Model forTrustedBusinessesAssessingControlRisk Areas • RiskappetiteandRiskTolleranceaccordingtothe Enterprise Risk Management concept (ERM) aredecisivecriteriaforsettingoftargetprocesscapabilityprofileswhicharemeasured via theratingsoftheprocessattributes. The riskappetiteof an entityis a highlevelviewofthedecisionmakingbodyof a company on howmuchrisktheyarewillingtotake. RiskToleranceistheacceptablelevelofvariationarroundobjectivesandisallignedwiththeriskappetite. • OnlyratingsofFullyachievedorLargelyachievedshouldbeset. • Processrelatedriskresultsfromtheexistenceofgapsbetweenthetargetandtheassesedprocessprofiles

  19. 7/8 7. Governance Model forTrustedBusinessesAssessingControlRisk Areas • The process attribute gap can be categorized into “None”, “Minor” and “Major” categories based on the distance of target and assessed ratings. • The probability of problem occurrence is derived from the extent of process attribute gaps and from the capability level where they occur. Capability level gaps are categorized as follows: • None - No major or minor gaps • Slight - No gap at level 1, and only minor gaps at higher levels • Significant - A minor gap at level 1, or a single major gap above • Substantial - A major gap at level 1, or more than one major gap above • The process related risk depends on both the probability of problem arising from the identified gap and the potential consequence. In general the consequences depend on the capability levels where the gapsoccur.

  20. 8/8 7. Governance Model forTrustedBusinessesThe keybenefitsat a glance • Common, integratedandmostacknoledgedassesment model • Processcapabilitydeterminationapplicableto all relevant processes • Value addingtoolfor all stakeholdersof a company • Desisionmakingbodyof a company • Internal & External Auditors • Customers • Suppliers • Shareholders • Other stakeholders • Improved Corporate Governanceas USP

  21. Ourvisionoftomorrow‘sbusinessworld Good Bank …… I havemyhouse somesavingsand will not burdenthenextgenerationwithmydebt I am 35 yearsold Honest Representation in all relevant activityareas TrustedBusinesses

  22. Annex 1: The 20 basic COSO principles • Control Environment (CE) • 1. Integrity and Ethical Values (IEV). Sound integrity and ethical values, particularly of top • management, are developed and understood and set the standard of conduct for financial • reporting. • 2. Oversight Board (OB). The board of directors and/or audit committee understand and • exercise oversight responsibility related to financial reporting and related internal control. • 3. Management’s Philosophy and Operating Style (MPO). Management’s philosophy and • operating style support achieving effective internal control over financial reporting. • 4. Organizational Structure (OS). The entity’s organizational structure supports effective internal • controloverfinancialreporting. • 5. Financial Reporting Competencies (FRC). The organization retains individuals competent in • financial reporting and related oversight roles. • 6. Authority and Responsibility (AR). Management and employees are assigned appropriate • levels of authority and responsibility to facilitate effective internal control over financial • reporting. • 7. Human Resources (HR). Human resource policies and practices are designed and • implemented to facilitate effective internal control over financial reporting.

  23. Annex 1: The 20 basic COSO principles • RiskAssessment (RA) • 1. Financial Reporting Objectives (FRO). Management specifiesfinancialreportingobjectives • with sufficient clarity and criteria to enable the identification of risks to reliable financial • reporting. • 2. Financial Reporting Risks (FRR). The organization identifies and analyzes risks to the • achievement of financial reporting objectives as a basis for determining how the risks should • bemanaged. • 3. Fraud Risk (FR). The potential for material misstatement due to fraud is explicitly considered • in assessing risks to the achievement of financial reporting objectives. • ControlActivities (CA) • 1. Integration with Risk Assessment (IRA). Actions are taken to address risks to the • achievement of financial reporting objectives. • 2. Selection and Development of Control Activities (SD). Control activities are selected and • developed considering their cost and their potential effectiveness in mitigating risks to the • achievement of financial reporting objectives. • 3. Policies and Procedures (PD). Policies related to reliable financial reporting are established • and communicated throughout the organization, with corresponding procedures resulting in • management directives being carried out. • 4. Information Technology (IT). Information technology controls, where applicable, are designed • and implemented to support the achievement of financial reporting objectives.

  24. Annex 1: The 20 basic COSO principles • Information andCommunication (IC) • 1. Financial Reporting Information (FRI). Pertinent information is identified, captured, used at all • levels of the organization, and distributed in a form and timeframe that supports the • achievement of financial reporting objectives. • 2. Internal Control Information (ICI). Information used to execute other control components is • identified, captured, and distributed in a form and timeframe that enables personnel to carry • out their internal control responsibilities. • 3. Internal Communication (IC). Communications enable and support understanding and • execution of internal control objectives, processes, and individual responsibilities at all levels • of the organization. • 4. External Communication (EC). Matters affecting the achievement of financial reporting • objectives are communicated with outside parties. • Monitoring (MO) • 1. Ongoing and Separate Evaluations (OSE). Ongoing and/or separate evaluations enable • management to determine whether internal control over financial reporting is present and • functioning. • 2. Reporting Deficiencies (RD). Internal control deficiencies are identified and communicated in • a timely manner to those parties responsible for taking corrective action, and to management • and the board as appropriate

More Related