COSO Control Environment Explained: Tone at the Top | CPA AUD

Learn the COSO control environment and why tone at the top matters in an audit. Professor Farhat connects leadership behavior, ethics, hiring, audit committee oversight and accountability to a historical Wells Fargo sales-pressure case. For auditing students and CPA AUD candidates, with useful internal-control review for CMA candidates. Study resources: https://farhatlectures.com WHAT YOU WILL LEARN • Identify management actions and incentives that can strengthen or weaken the control environment. • Evaluate ethical standards, employee competence, board oversight and organizational responsibilities. • Recognize questions auditors ask about internal audit resources, reporting lines and follow-up. CHAPTERS 00:00 Control environment in the COSO framework 00:34 The lecture’s 10–80–10 illustration 01:25 Tone at the top and management behavior 01:43 Six areas discussed in this lesson 02:23 Wells Fargo: historical sales-pressure case 04:57 Management philosophy and operating style 06:26 Integrity and ethical values 07:52 Code of ethics: training and enforcement 08:27 Hiring and commitment to competence 09:29 Ethical employees and internal controls 10:16 Human resources and performance incentives 10:44 Board and audit committee oversight 11:51 Audit committee and other auditor services 12:45 Evaluating the internal audit function 14:08 Internal audit reporting and objectivity 15:13 Organizational structure and authority 16:17 Reporting lines and accountability 16:46 Recap and next COSO component QUICK ANSWERS What is the control environment? It is the organization-wide foundation for internal control: leadership conduct, ethical expectations, oversight, people and assigned responsibilities. Tone at the top concerns what leaders do as well as what they say. Does COSO have six control-environment principles? No. This lecture organizes its discussion into six practical areas. COSO’s five formal principles address ethics; independent board oversight; organizational authority and reporting; capable personnel; and accountability. Internal audit can support oversight and monitoring; it is not a sixth formal control-environment principle. COSO has five overall internal-control components, of which the control environment is one. What does the Wells Fargo example illustrate? The historical case shows how sales incentives and pressure can undermine ethical behavior. The CFPB’s September 2016 enforcement action concerned unauthorized customer accounts. The lesson is about incentives, oversight and culture; it does not describe the bank’s current practices. STUDY CLARIFICATIONS • At 00:34, treat the 10–80–10 proportions as a teaching illustration, not a validated employee distribution or a COSO rule. The recording does not identify the claimed research. • Ethical hiring complements control procedures; trustworthy employees do not eliminate the need for controls. • The discussion of audit committee responsibilities needs an engagement-specific context. SEC requirements for listed-company audit committees include auditor oversight, subject to applicable exceptions. Preapproval can cover permissible nonaudit services; it cannot authorize prohibited services or remove independence requirements. • External auditors do not automatically rely on an internal audit department. For PCAOB audits, AS 2605 requires consideration of competence, objectivity and relevant work. The external auditor remains responsible for the audit opinion. CONTINUE STUDYING Internal Control & COSO Framework course:    • Internal Control & COSO Framework | CPA AU...   REFERENCES COSO in the Cyber Age, Figure 2: https://www.coso.org/_files/ugd/3059f... CFPB historical enforcement announcement: https://www.consumerfinance.gov/archi... SEC auditor independence requirements: https://www.sec.gov/files/rules/final... PCAOB AS 2605: https://pcaobus.org/oversight/standar... #ControlEnvironment #COSO #CPAAUD