Understanding Corporate Governance

Search in book...
Toggle Font Controls
Create new playlist

Name your new playlist

Playlist description (optional)
Sign In

Email address

Password

Forgot Password?

or

Continue with Facebook

Continue with Google
Sign Up

Full Name

Email address

Confirm Email Address

Password

or

Continue with Facebook

Continue with Google

Understanding Corporate Governance

Corporate governance combines the processes, policies, laws, and controls that effect the way a company operates. The governance guides the company’s decision-making and administrative processes. The corporate governance, as shown in FIGURE 15-1, is complex and involves people, processes, systems, and more.

The innermost circle represents Board. The next immediate circle represents management and the next immediate circle represents system policies and controls. The penultimate circle is divided into five equal sections representing creditors, stakeholders, employees, vendors, and suppliers. The outermost circle is divided into three equal sections representing government, shareholders, and legal. — FIGURE 15-1 Components that comprise the corporate-governance process.

Understanding Business Strategy

A strategy is a plan of action designed to achieve one or more particular goals. A business strategy, therefore, consists of the plans upon which a company executes to achieve business goals which may include the following:

Maximize shareholder value
Reduce or manage costs to maximize profits
Provide a quality work environment which attracts and retains employees
Maintain a high degree of customer satisfaction
Support environmentally friendly operations
Develop a sustainable, competitive advantage
Provide accurate reporting of company operations

Measure What Is Important

After a business defines its strategic plans, the company must determine ways to measure each goal. The initial measurement will establish a baseline for the company’s current level of operations and future measurements will establish the company’s level of improvement.

CASE 15-2 Capability Maturity Model (CMM)

As companies begin to govern IT operations, the companies often need to identify their current level of capability. The company might apply measures with respect to software development, security, operations, user support, and more.

The capability maturity model (CMM) was developed at Carnegie Mellon University to help businesses measure and improve upon their current capabilities. Over time, as a business matures and its skills improve, the company’s CMM scores should increase. As the score increases, so too should the business’ predictability and reliability.

To help businesses integrate the CMM process, Carnegie Mellon created the capability maturity model integration (CMMI) process. In fact, the CMMI group has defined processes for common industry activities, such as acquisitions, security, software design, and system design.

The CMM has five levels of maturity, as shown in TABLE 15-1.

TABLE 15-1 Maturity levels within the CMM.

Level	Description	Characteristics
1	Initial	Processes are typically changing. Those that are static are likely undocumented. Many operations are reactive.
2	Repeatable	Some processes are repeatable, ideally with consistent results. Many defined systems are still lacking.
3	Defined	Many processes are now static and documented. Some processes are under evaluation for improvement opportunities.
4	Capable/Managed	Most processes are controlled and adjusted to improve quality.
5	Efficient/Optimized	Focus is on continuous improvement of existing processes.

A company evaluates its processes using the levels to define its current capabilities and can then set goals for moving the processes to the next level.

Case Study: Select an organization that you know or at which you can interview a manager. Identify the organization’s key operational tasks. Using the CMM model, rate the company’s current capabilities.

Inspect What You Expect

After a company defines its business goals and metrics, the company must inspect the underlying factors that drive the business result. In other words, rather than take the company financials at face value, the company should examine the sources from which the values come to ensure each is accurate and free from fraud. The inspection process is also known as auditing.

The auditing process can be internal (done by the company) or external (done by a third-party company), as shown in FIGURE 15-3.

A circle represents company with data center placed within the circle. Process 1 internal control over the data center extends inside the circle and process 2 external control over the data center extends outside the circle which is done by third party auditor. — FIGURE 15-3 Companies must audit the source of the values they measure and report using internal or external auditors.

Understanding Internal Controls

The auditing process will identify key stages within processes which the auditor should frequently inspect. To support the process, the company should put in place its own internal controls (policies and procedures) at each of these key stages, as shown in FIGURE 15-4.

The horizontal axis of the graph represents processing and the vertical axis represents time. A curve starts from the origin and increases in processing steadily as time increases. The curve passes over control 1, control 2, control 3, and control 4 at regular distances and leads up to result. — FIGURE 15-4 Internal controls allow a company auditor to inspect data values at key stages.

CASE 15-3 Committee of Sponsoring Organizations of the Treadway Commission (COSO)

A key aspect of corporate governance is internal controls. In general, an internal control is a process that provides confidence and assurance that the objectives of the company’s operational goals, accuracy of the reporting of operations, and legal compliance requirements are being met. COSO has defined a model companies can use to evaluate their internal controls.

The original COSO model’s framework consisted of five key components, defined in TABLE 15-2.

TABLE 15-2 The original five key components of the COSO model.

COSO Component	Description
Control environment	The organization creates an environment supportive of controls, which includes ethical operations, managerial integrity, and compliant operations.
Risk assessment	Opportunities and existing processes are evaluated with respect to potential risks and ways to mitigate the risks.
Control activities	Business operations include control activities such as approvals, authorizations, reviews, and audits.
Information and communication	Reliable and truthful communication flows up, down, and across the organization as well as outside of the organization.
Monitoring	Existing processes and internal controls are monitored on a consistent basis.

To meet demand for companies to address risk management, the COSO framework has been expanded to support eight components as listed in TABLE 15-3.

TABLE 15-3 The components of the expanded COSO model.

COSO Component	Description
Internal environment	The organization creates an environment supportive of controls, which includes ethical operations, managerial integrity, and compliant operations.
Objective setting	The business established defined and measurable objectives for operations.
Event identification	The business watches for, recognizes, and responds to events that will impact operations.
Risk assessment	Opportunities and existing processes are evaluated with respect to potential risks and ways to mitigate the risks.
Risk response	Management accepts risks based upon a consistent approach to risk tolerance.
Control activities	Business operations include control activities such as approvals, authorizations, reviews, and audits.
Information and communication	Reliable and truthful communication flows up, down, and across the organization as well as outside of the organization.
Monitoring	Existing processes and internal controls are monitored on a consistent basis.

To download a variety of documents focused on internal controls, risk management, or to order the COSO Guidebook, visit www.coso.org.

Case Study: Select a company whose operations you are familiar with. List five potential internal controls you would expect to see in place within the company’s IT group.

CASE 15-4 Control Objectives for Information and Related Technology (COBIT)

COBIT is an information-technology governance framework defined by the Information Systems Audit Control Association (ISACA). COBIT defines dozens of processes an IT manager and staff can use to plan, acquire, implement, deliver, support, monitor, and evaluate IT solutions. The first version of COBIT was released in 1996 and has continued to evolve to support new IT capabilities and governance needs. COBIT is used by small-business owners to structure their IT processes and by larger companies and organizations (public and governmental) to align the IT and business strategies to conform with regulations such as Sarbanes/Oxley and to implement information-technology best practices. You can purchase the COBIT guide from the ISACA website, shown in FIGURE 15-5.

FIGURE 15-5 The COBIT guide is available from the ISACA website.

Case Study: COBIT defines processes a company’s IT staff should consider when performing common operations. Assume you must write the COBIT processes for selection of a cloud provider. List the processes you would recommend.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.

Table of Contents for Understanding Corporate Governance

Create new playlist

Sign In

Sign Up

Understanding Corporate Governance

Understanding Business Strategy

Measure What Is Important

Inspect What You Expect

Understanding Internal Controls

Table of Contents for
Understanding Corporate Governance