Updated 2013 COSO Framework —fraud risk …

1 Updated 2013 . coso Framework . fraud risk assessments Fraud Investigation & Dispute Services Updated 2013 coso Framework . fraud risk assessments In May 2013 , the Committee of Sponsoring Organizations of the Treadway Commission ( coso ) issued its Updated Framework for the What is not changing What is changing design, implementation and conduct of systems of internal controls and the assessment of their effectiveness. The new Framework takes Core definition of internal Changes in business and much of the structure of the original Framework issued in 1992 control operating environments and highlights new areas of focus and concern.

2 coso has Updated Three categories of considered the Framework to address the numerous changes in business and objectives and five Operations and reporting operating environments, including: components of internal objectives expanded control Fundamental concepts Expectations for governance oversight Each of the five underlying five Globalization of markets and operations components of internal components articulated Changes and greater complexities of business control is required as principles Demands and complexities in laws, rules, regulations and standards Important role of Additional approaches Expectations for competencies and accountabilities judgment in designing, and examples relevant Use of, and reliance on, evolving technologies implementing and to operations.

3 Compliance Expectations relating to preventing and detecting fraud conducting internal and non financial control and assessing its reporting objectives The 2013 Framework , effective December 15, 2014, places emphasis effectiveness added on fraud risks and compliance and will be the new standard for assessing the effectiveness of internal controls as part of FY14 audits. 1992 components 2013 principles Control environment 1. Demonstrates commitment to integrity and ethical values Principle 8 The organization considers the 2. Exercises oversight responsibility potential for fraud in assessing risks to the 3. Establishes structure, authority and achievement of objectives.

4 Responsibility 4. Demonstrates commitment to competence Fraud risks are considered in the context that individuals 5. Enforces accountability or entities may act outside of the organization's expected standards of ethical conduct. 6. Specifies suitable objectives Risk assessment General risks under Principle 7 are considered in the context 7. Identifies and analyzes risk of management, employees and third parties adhering to the 8. Assesses fraud risk entity's expected standards of ethical conduct. 9. Identifies and analyzes significant change Fraud risk assessments are now considered distinct from 10. Selects and develops control activities general risk assessments.

5 Because fraud risk is a separate Control activities 11. Selects and develops general controls principle, an otherwise robust and well-functioning enterprise over technology risk assessment process that does not adequately consider 12. Deploys through policies and procedures fraud will likely not allow the organization to fully comply with the Updated 2013 coso Framework . Information and 13. Uses relevant information communication 14. Communicates internally 15. Communicates externally 16. Conducts ongoing and/or separate Monitoring activities evaluations 17. Evaluates and communicates deficiencies Updated 2013 coso Framework fraud risk assessments Elements of an effective Benefits of an anti-fraud program anti fraud program Management is ultimately responsible for detecting, preventing and responding to fraud.

6 An anti-fraud program, aligned with a company's compliance Framework , demonstrates that management is setting the proper tone at the top to address its fraud and compliance risks. An anti-fraud program will not provide assurance against fraud, but it can help mitigate Code of conduct the risk of fraud by allowing management to identify and prioritize fraud risks and allocate resources to address them. Setting the proper tone EY fraud risk assessment approach We leverage our fraud investigation and industry-specific experience to identify fraud risks Fraud prevention and assess the likelihood of occurrence and potential impact on the company's strategic, policies operational and financial objectives.

7 We assess management's understanding of its key fraud risks and its ability to proactively deal with them. We provide our observations and recommendations to improve fraud-risk management and to leverage the company's data to better detect and prevent fraud. Fraud awareness training Plan Assess Respond Report 1 Confirm goals and schedule 2 Assess current state of fraud 3 Identify strengths, gaps and 4 Present findings and finalize report risks recommendations recommendations Fraud risk Continuous coordination between management and assessment team assessment Proactive Assemble the Conduct interviews Map the identified Determine proper team, Lead facilitated risks to internal and document considering.

8 Sessions controls management's Key stakeholders Distribute Assess the response to Fraud controls questionnaires and effectiveness of residual risk Technical monitoring experience surveys the controls Avoid Industry Review documents Compare to Transfer knowledge and transactions leading practices Mitigate Understand the Identify fraud risks Perform sample Assume fraud risk universe present in the testing Determine plan Reactive Communicate organization Determine the for continuous Fraud response plan the goals of the Assess the level of residual monitoring of assessment to the potential impact of risk and assign identified risks organization the identified risks priority ratings to to the organization each risk identified The assessment incorporates a multilevel approach to fully assess the company's risk of fraud.

9 Interactions with government/SOEs Event reporting/whistle-blower Entity- hotlines Formal anti-bribery policies and procedures level Gift and entertainment policy Compliance resources/staffing review Employee training/awareness initiatives Compliance monitoring plan Process- Cash disbursements Sales and marketing activities level Purchasing/vendor selection Accounts receivable review Contracts Licensor relationships Travel and entertainment expenses Marketing and promotion expense Transaction Agent/broker commissions Petty cash level Service vendor disbursements Rebates/discounts/aging Charitable contributions Updated 2013 coso Framework fraud risk assessments EY | Assurance | Tax | Transactions | Advisory Fraud Investigation & Dispute Services About EY.

10 For further information, please contact: EY is a global leader in assurance, tax, transaction and advisory services. The Douglas Tymkiw Jeff Ferguson insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding Partner, Ernst & Young LLP Partner, Ernst & Young LLP. leaders who team to deliver on our promises to all of our stakeholders. In so +1 504 592 4837 +1 214 969 8994. doing, we play a critical role in building a better working world for our people, for our clients and for our communities. Ryan Pratt EY refers to the global organization, and may refer to one or more, of the Principal, Ernst & Young LLP.