a. Go to the the second table. Identify (by circling in Column B) whether the action listed in Column A on the next page is either an entity or process level control.

b. Identify (by circling in Column C) the nature of the control activity or activities involved in the action (e.g., control environment, monitoring, risk assessment, etc.).

c. Identify from the list below the principle or principles associated with the action shown in Column A on the next table from the list below.

COSO Component		COSO Principles
Control Environment		1. The organization demonstrates a commitment to integrity and ethical values.
		2. The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
		3. Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
		4. The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.
		5. The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.
	Risk Assessment	6. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
		7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.
		8. The organization considers the potential for fraud in assessing risks to the achievement of objectives.
		9. The organization identifies and assesses changes that could significantly impact the system of internal control.
	Control Activities	10. Selects and develops control activities
		11. Selects and develops general controls over technology
		12. Deploys through policies and procedures
	Information and Communication	13. The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.
		14. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
		15. The organization communicates with external parties regarding matters affecting the functioning of internal control.
	Monitoring Activities	16. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
		17. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

	Column A. Control Action	Column B. Circle all that apply: Entity Level (EL) or Process-Level (PLC) Control		Column C. Circle the Internal Control component(s) that apply to the action: Control Environment (CE), Risk Assessment (RA), Monitoring (M), Control Activities (CA), Information and Communication (IC)	Column D. Identify the NUMBER of the underlying principle or principles associated with action in Column A from list of 17 above
1	Internal audit reports to the audit committee of the board of directors	EL PLC		CE RA M CA IC
2	Reported revenues are compared to budgeted revenues on a monthly basis by the Controller.	EL PLC		CE RA M CA IC
3	Exception reports are generated daily that summarize transactions by employees that exceed certain established levels (e.g., price overrides exceed expected overrides by more than 10 percent).	EL PLC		CE RA M CA IC
4	IT employees are unable to enter transactions into the purchasing or payroll systems.	EL PLC		CE RA M CA IC
5	Internal audit is staffed with Certied Internal Auditors who maintain their certications by meeting biannual CPE requirements.		EL PLC	CE RA M CA IC
6	All payments are supported by an invoice, purchase order, and receiving document that have been reconciled and approved. PLC, CA		EL PLC	CE RA M CA IC
7	The organizational chart is updated annually.		EL PLC	CE RA M CA IC
8	A whistleblower phone line enables employees, customers, and vendors to report potential fraud. The phone line, which is advertised on the companys website, is monitored by the Chief Compliance Ofcer who reports activity to the board of directors each quarter.	EL PLC		CE RA M CA IC
9	All key policies and procedures are documented and updated annually.	EL PLC		CE RA M CA IC
10	Salary adjustments and bonuses are based on the results of annual employee evaluations.	EL PLC		CE RA M CA IC