Question

2. What is meant by concurrent audits and how it could be achieved?

3. In your own words, differentiate between COSO and COBIT in terms of their purpose and application. Why do organizations need to apply both of them not only one. (write 200 words).

Answer 1

Concurrent audits are audits that are conducted simultaneously with transactions and that cover substantial transactions during the year. One example is that all bills are routed through audit department to ensure that the bills are in compliance with the PO, agreements, best practices, law etc.

Concurrent audits are also done in banks meaning that the audit is done throughout the year to check many transactions during the year. Concurrent audits can be done by employing manpower to do the audits on concurrent basis. Where selection is necessary, then the transactions are selected based on criteria set out clearly before start of audit.

COSO provides framework and guidance on enterprise risk management, internal controls and fraud deterence. Applicable to both financial and internal reporting, COSO framework focusses on Governance and Culture, Strategy and objective setting, the Performance, the review and revision, Information, communication and reporting.

COBIT is an IT management framework developed by ISACA to help businesses develop, organise and implement strategies around information management and governance. COBIT incorporates five strategic principles - Meeting stakeholder needs, Covering the enterprise end to end, Applying a single integrated framework, Enabling a holistic approach, Separating Governance and Management.  

COSO is primarily developed to enable Sarbanes-Oxley 404 requirements, restricts itself to a certain area of IT environment in an organisation. COBIT 5 extends beyond financial reporting to the whole environment. So, both complement each other.  

Under COSO organisations must undertake risk assessments to determine critical environments and ensure mitigation. External financial reporting must reflect the underlying transactions and events. COBIT 5 contributes to this requirement by offering specific ways to assess risk.