
CONTROLSBOND
³»ºÎÅëÁ¦ (Internal controls) ÀÇ ºñ¿ë ¹× º¹À⼺ °¨¼Ò
¼öµ¿ ¹× ¹Ýº¹ÀûÀÎ (MANUAL & REPETITIVE) ³»ºÎÅëÁ¦ (INTERNAL CONTROLS) ÀÛ¾÷À» ÀÚµ¿ÈÇÏ¿© ºñ¿ëÀ» Àý°¨ÇÏ°í ¾î½´·±½º (ASSURANCE) ¸¦ Çâ»ó½ÃŰ´Â ¼ÒÇÁÆ®¿þ¾î
SOX, ITGC, ICFR ¹× OMB A-123 °ú °°Àº ³»ºÎÅëÁ¦ (internal controls) °ü¸®´Â º¹ÀâÇϸç, ½ºÇÁ·¹µå½ÃÆ® ¹× ±âŸ legacy ÅøÀº ºñÈ¿À²ÀûÀ̸ç ÇÊ¿äÇÑ ¾î½´·±½º (assurance) ¸¦ Á¦°øÇÏÁö ¸øÇÕ´Ï´Ù.
Å×½ºÆ® ¹× ¿öÅ©Ç÷ο츦 ÅëÁ¦ (control) Çϱâ À§ÇØ ÀÚµ¿È (automation) ¸¦ Áß¾Ó¿¡¼ °ü¸®ÇÏ°í µµÀÔÇÔÀ¸·Î½á ,¾î½´·±½º (assurance) °¡ Çâ»óµÇ°í ¾÷¹«·® (workload) ÀÌ º¸´Ù ±ÕµîÇÏ°Ô ºÐ»êµÉ ¼ö ÀÖ½À´Ï´Ù. ¸®½ºÅ© ¾î½´·±½º (Risk assurance) °¡ °³¼±µÇ°í, ÄÄÇöóÀ̾𽺰¡ ´Þ¼ºµÇ¸ç, C-suite (°æ¿µÁø) ¿Í ÅõÀÚÀÚµéÀº ´õ È®½ÅÀ» °®°Ô µË´Ï´Ù.
[Controls testing & oversight]
[Centralized risk & control library]
[Reporting & certification]
ControlsBond ¸¦ ¼±ÅÃÇØ¾ß ÇÏ´Â ÀÌÀ¯?
Áߺ¹ ÀÛ¾÷À» ÃÖ¼ÒÈÇϰí, ¸®½ºÅ©°¡ ³·°Å³ª ºñ-ÇÙ½É ÅëÁ¦ (non-key controls) ¸¦ ÇÕ¸®ÈÇϰí, ¿©·¯ ±ÔÁ¤ (regulations) À» ÁؼöÇÏ´Â ÅëÁ¦ (controls) ¸¦ Á¶È½ÃÄÑ ºñ¿ëÀ» Àý°¨ÇÕ´Ï´Ù.
´ÜÀÏ Ç÷§Æû (single platform) ¿¡¼ ÅëÁ¦ ±â´É (controls) À» Å×½ºÆ®Çϰí À̽´ (issues) ¸¦ ÇØ°áÇÒ ¼ö ÀÖµµ·Ï ÇÁ·Î¼¼½º ´ã´çÀÚ¿Í Ã¹ ¹øÂ° ¹æ¾î¼±À» ±¸ÃàÇÕ´Ï´Ù.
»çÀü ÀûÀçµÈ (Pre-built) ÅÛÇø´ ¹× ÇÁ·¹ÀÓ¿öÅ©¸¦ ÅëÇØ ½Ã°£À» Àý¾àÇÒ ¼ö ÀÖ½À´Ï´Ù.
ÄÄÇöóÀ̾𽺠À̽´ (Compliance issues), Á¶Ä¡ ÀÛ¾÷ (remediation tasks) ¹× ÀÎÁõ »óÅ (certification status) ¿¡ ´ëÇÑ ½Ç½Ã°£ ¾÷µ¥ÀÌÆ®¸¦ °øÀ¯ÇÕ´Ï´Ù.
°ü¸® ¹× ÅõÀÚÀÚÀÇ ½Å·Úµµ¸¦ ³ôÀÔ´Ï´Ù.
"¿ì¸®´Â ÅëÁ¦ (controls) ÀÇ ½Å·Ú¼º (reliability) °ú Àϰü¼º (consistency) Àº ¹°·Ð ÅëÁ¦ ±â´ÉÀÇ ±â¹ÝÀÌ µÇ´Â ÇÁ·Î¼¼½ºÀÇ È¿À²¼ºÀÌ Å©°Ô Çâ»óµÇ¾ú´Ù´Â Á¡À» ÀÎÁöÇϰí ÀÖ½À´Ï´Ù."
Jason A. Gross, CPA, CIA, CFE, CISA, ACDA
Vice President, Controls Management, Siemens Financial Services, Inc.
ÁÖ¿ä±â´É
- ÅëÁ¦ Å×½ºÆ® ¹× °¨µ¶ (CONTROLS TESTING & OVERSIGHT)
´ë½Ãº¸µå ºä (Dashboard view) ¸¦ ÅëÇØ Å×½ºÆ®µÈ Ç׸ñ, Å×½ºÆ®µÇÁö ¾ÊÀº Ç׸ñ, È¿°úÀûÀ¸·Î ÀÛµ¿ÇÏ´Â Ç׸ñ ¹× ±×·¸Áö ¾ÊÀº Ç׸ñ µî ÅëÁ¦ »óÅ (control status) ¸¦ È®ÀÎÇÒ ¼ö ÀÖ½À´Ï´Ù.
ÀÚµ¿ÈµÈ ¿öÅ©Ç÷ο츦 žÀçÇÏ¿© ÇÁ·Î¼¼½º ´ã´çÀÚ (process owners) ¿Í ù ¹øÂ° ¹æ¾î¼±À» ±¸ÃàÇÏ¿© ÅëÁ¦ (controls) Å×½ºÆ®Çϰí, À̽´ ½Äº° ¹× Á¶Ä¡ (identify & remediate) ¸¦ Áö¿øÇÕ´Ï´Ù.
SAP, Concur ¹× Salesforce ¿Í °°Àº ºñÁî´Ï½º ¾îÇø®ÄÉÀ̼ǿ¡¼ µ¥ÀÌÅ͸¦ °¡Á®¿Í °¡´ÉÇÑ °æ¿ì ÅëÁ¦ Å×½ºÆ®¸¦ ÀÚµ¿È (automate control testing) ÇÕ´Ï´Ù.
- Áß¾Ó ÁýÁᫎ ¸®½ºÅ© ¹× ÅëÁ¦ (RISK & CONTROL) ¶óÀ̺귯¸®
Excel ¿¡¼ Á¤º¸¸¦ °¡Á®¿Í ¸®½ºÅ© ¹× ÅëÁ¦ (risk & control) ¶óÀ̺귯¸®¸¦ žÀçÇϰųª ³»ÀåµÈ (built-in) SOX COSO ¹× SOX ITGC ÇÁ·¹ÀÓ¿öÅ©¸¦ »ç¿ëÇÕ´Ï´Ù.
³·Àº ¸®½ºÅ© (low-risk) ¶Ç´Â ºñ-ÇÙ½É ÅëÁ¦ (non-key controls) ¸¦ ÇÕ¸®ÈÇÕ´Ï´Ù.
¿©·¯ ±ÔÁ¤ (regulations) À» ÁؼöÇÏ´Â ÅëÁ¦ (controls) ¸¦ Á¶È½Ãŵ´Ï´Ù.
- ¸®Æ÷ÆÃ ¹× ÀÎÁõ (REPORTING & CERTIFICATION)
¿£Æ¼Æ¼ (Entity), ÇÁ·Î¼¼½º, ÅëÁ¦ »óÅ (control status) ¶Ç´Â À̽´ (issues) º°·Î °ü¸®, PMO ¶Ç´Â ¿ÜºÎ °¨»ç¸¦ À§ÇÑ ¸®Æ÷Æ®¸¦ »ý¼ºÇÕ´Ï´Ù.
ºÎ¼ °£ ¸®´õ (cross-functional leaders) °¡ Å×½ºÆ® °á°ú¸¦ °ËÅäÇϰí SOX 302 ¿¡ ´ëÇÑ ÇÏÀ§ ÀÎÁõ (sub-certified) À» ¹Þ¾Ò´Ù´Â °ÍÀ» CEO ¹× CFO ¿¡°Ô ½Ã¿¬ ¼³¸íÇÕ´Ï´Ù.
½Ç½Ã°£ (Real-time) ¾î½´·±½º ¼ºÀûÇ¥ (assurance report card) ¸¦ ¾ò½À´Ï´Ù.
|