ISACA IS Standards, Guidelines and Procedures for Auditing and Control Professionals resource Guides OCEG Reviewed
AICPA, Statement on Auditing Standards No. 115, Communicating Internal Control Related Matters Identified in an Audit, Executive Summary (2008) resource Guides OCEG Reviewed
The Auditing Standards Board has issued Statement on Auditing Standards (SAS) No. 115, Communicating Internal Control Related Matters Identified in an Audit. SAS No. 115 supersedes SAS No. 112 of the same title and was issued to eliminate differences within the AICPA’s Audit and Attest Standards resulting from the issuance of Statement on Standards for Attestation Engagements (SSAE) No. 15, An Examination of an Entity’s Internal Control Over Financial Reporting That Is Integrated With an Audit of Its Financial Statements. SSAE No.
Read more
Enterprise Risk Management: Tools and Techniques for Effective Implementation (IMA, 2007) resource Guides OCEG Reviewed
This Statement on Management Accounting on ERM, along with the earlier one published by IMA, provides guidance for the leaders of organizations in identifying, assessing, and managing risk, while at the same time growing their business. ERM requires strong commitment from C-level executives and an effective process tailored to each organization’s unique culture.
Institute of Management Accountants
Read more
INTOSAI Guidance for Good Governance (INTOSAI GOV) resource Guides OCEG Reviewed
INTOSAI GOV 9100-9199 - Internal control
INTOSAI GOV 9200-9299 - Accounting standards
Read more
AICPA, Risk Assessment Standards Nos. 104-111 resource Guides OCEG Reviewed
In March 2006, the AICPA Auditing Standards Board (ASB) issued Statement on Auditing Standards (SAS) Nos. 104-111, commonly referred to as the "Risk Assessment Standards". These SASs are effective for audits of financial statements for periods beginning on or after December 15, 2006.
Read more
COSO, Internal Control - Integrated Framework Guidance on Monitoring, Internal Control Systems, Volume III - Application Techniques (Exposure Draft, June 2008) resource Guides OCEG Reviewed
Public Comment Period Closed August 15, 2008
This volume (Application Techniques or Volume III) of COSO’s Guidance on Monitoring Internal Control Systems illustrates techniques used by organizations in applying principles outlined in Volume II (the Guidance).
This material is designed to be useful to those seeking to apply internal control monitoring techniques.
Read more
COSO, Internal Control - Integrated Framework, Guidance on Monitoring Internal Control Systems: Volume II - Guidance (Exposure Draft, 2008) resource Guides OCEG Reviewed
COSO Exposure Draft, June 2008. Public Comment Period Closed August 15, 2008
The primary factor leading to the development of this guidance was the observation by COSO that many organizations were not effectively utilizing the monitoring component. Some organizations had effective monitoring in certain areas, but were not optimizing the results of that monitoring to support their conclusions about the effectiveness of internal control.
Read more
BIS, Sound Practices for the Management and Supervision of Operational Risk (Basel Committee on Banking Supervision, 2003) resource Guides OCEG Reviewed
Abstract: The purpose of this paper, prepared by the Risk Management Group of the Basel Committee on Banking Supervision, is to outline a set of principles that provide a framework for the effective management and supervision of operational risk, for use by banks and supervisory authorities when evaluating operational risk management policies and practices.
Read more
AICPA, Trust Services Principles, Criteria and Illustrations for Security, Availability, Processing Integrity, Confidentiality, and Privacy (Including WebTrust® and SysTrust®) (2006) resource Guides OCEG Reviewed
The Trust Services Principles, Criteria, and Illustrations present criteria established by the Assurance Services Executive Committee of the AICPA for use by practitioners when providing attestation services on systems in the subject matters of security, availability, processing integrity, privacy, confidentiality, and certification authorities.
Read more
