A non-governmental body that is influential in the field of internal control ## Internal control 1. Organisation demonstrates commitment to integrity and ethical values 2. Board shows independence of control from management, and oversees development/performance 3. Management establishes control structures, reporting lines, and appropriate authorities and responsibilities 4. Organisation demonstrates commitment to attract, develop, and retain competent individuals for control 5. Organisation holds individuals accountable for their internal control responsibilities ## [[risk assessment|Risk assessment]] 6. Organisation specifies objectives with sufficient clarity to enable identification and assessment of risks to objectives 7. Organisation identifies risks to achievement of its objectives, and analyses risks as a basis for determining how risks should be managed 8. Organisation considers potential for fraud in assessing risks to the achievement of objectives 9. Organisation identifies and assesses changes that could significantly impact internal control ## Control activities 10. Organisation selects and developers control activities contributing to reducing risks to acceptable levels 11. Organisation selects or developers general control activities over technology to support achievement of objectives 12. Organisation deploys controls by means of policies that set out what's expected, and procedures that implement said policies ## Information and Communication 13. Organisation obtains or generates, and then uses, quality information to support the functioning of other components of internal control 14. Organisation internally communicates information necessary to support the functioning of other components of internal control. This might include objectives and responsibilities for internal control 15. Organisation communicates with external parties regarding matters affecting functioning of other components of internal control ## Monitoring 16. Organisation selects, develops, and performs evaluations to check whether evaluations of internal control are present/functioning 17. Organisation evaluates and communicates internal control deficiencies in a timely manner to parties responsible for (responsible, or accountable?) taking corrective action, including senior management and the board of directors