Organization-Guide/Processes/COSO/CLC.md

Company Level Controls (CLC)

No.	Component	Control Area	Question	Answer	Evidence
	Control Environment	Principle of financial reporting	Do you have basic financial reporting policies?	Yes, the organization follows the German law regarding financial reporting	Financial laws (i.e. HGB, AO, Ustg, ...)
	Control Environment	Understanding accounting policies	Are the selected accounting principles approved?	Yes, employees are required to act according to the the German law	Financial laws (i.e. HGB, AO, Ustg, ...)
	Control Environment	Management philosophy and application	Does management determine the management philosophy, operating style and code of ethics and manifest them to employees?	Yes, all are described in the organization guidelines	Code of Conduct Organization Guidelines Conflict of Interest Policy Confidentiality Policy
	Control Environment	Management philosophy and application	Do you have any procedures or processes to remediate detected behaviors deviating from the management philosophy, operating style and code of ethics	Yes, public email to submit deviating behavior, public discussion and issue tracker to bring forward deviating behavior	Code of Conduct Discussions Issues
	Control Environment	Management philosophy and application	In case you find deviations from the principles, do you deal with them according to the predetermined procedures or processes?	Yes, so far no such case ocured	Code of Conduct Organization Guidelines Conflict of Interest Policy Confidentiality Policy
	Control Environment	Director	Do you have any company rules to clearly specify that the board of directors or a director in charge have responsibilities for appropriately supervising and monitoring the management in regard to the financial reporting and relevant internal controls?	No, apart from the legal obligations
	Control Environment	Director	Does the board of directors or corporate auditors supervise the performance of management regard the financial reporting and relevant internal controls?	Yes, financial controls are audited by independent auditors	Annual year end audit
	Control Environment	Organization	Does the management appropriately improve organizational structures or practices to resolve existing problems considering the size, content of the operations and business objectives of the company?
	Control Environment	Organization	Does the management assign roles in regard to each function and activity unit in the company?
	Control Environment	Organization	Do you have any rules to clarify segregation of duties and appropriately delegate authority and responsibilities to personnel in charge of each function and activity unit in the company?
	Control Environment	Organization	Does the management assign a person in charge for each role?
	Control Environment	Power	Are the assignment of responsibilities and delegation of authority made clear to all employees?
	Control Environment	Power	Is the delegation of responsibilities and authority to employees, etc. kept at appropriate levels, not without limitation?
	Control Environment	Power	Are the delegation of responsibilities and authority to employees, etc. updated on a timely basis in case organizational structures or other fundamentals of the company are changed?
	Control Activities	Business procedure	Are policies and procedures or operating manuals established to ensure the performance of control activities that sufficiently mitigate and address the risks in business operations, especially in regard to the reliability of the financial reporting?
	Control Activities	Business procedure	How do you confirm if employees perform their operations in compliance with policies and procedures or operating manuals?
	Control Environment	Personnel deployment and training	Does the management identify the competencies necessary for the company and procure/dispatch qualified personnel
	Control Environment	Personnel deployment and training	Are the competencies necessary reviewed regularly and maintained appropriately?
	Control Environment	Personnel deployment and training	Does the management provide employees, etc. with the means, training etc. necessary to fulfill their duties and support them in the improvement of their abilities?
	Control Environment	Personnel evaluation	Do you have personnel evaluation standards?
	Control Environment	Personnel evaluation	Are the personnel evaluation standards regularly reviewed and updated appropriately?
	Risk Assessment and Response	Risk assessment structure	Is there an effective risk assessment system that involves appropriate levels of the management and managers?
	Risk Assessment and Response	Risk assessment structure	Does the management asses the risk considering not only superficial facts but also backgrounds, incidents and other substantial elements?
	Risk Assessment and Response	Risk assessment structure	Does the management appropriately assess and address fraud risks based on not only superficial facts regarding fraud, but also incentives, causes, backgrounds and other factors that may result in fraud?
	Risk Assessment and Response	Risk assessment structure	Does the management reassess the risk and take appropriate measures whenever changes occur that may have a significant impact on the company?
	Communication and information	Communicating information	Are the management's or supervisor's instruction communicated to all employees?
	Communication and information	Communicating information	Is a system set in place to ensure that external information on internal controls is properly utilized and adequately communicated to the management or internal audit section?
	Communication and information	Internal reporting	Do you have the Whistleblower System or other internal reporting program?
	Communication and information	Internal reporting	Is the system or program in operation according to its original design?
	Communication and information	Financial information	How does the management acquire or access the accounting and financial information of the company?
	Communication and information	Financial information	How are the accounting and financial information or data from relevant business processes input to your accounting system or application?
	Communication and information	Information sharing with managements	Do you have any internal rules documents which stipulate that the managements should share business an other information with each other
	Communication and information	Information sharing with managements	Does your management share information with each other in actual business?
	Monitoring	Ongoing monitoring	Are ongoing monitoring activities appropriately embedded within the company's overall business operations?
	Monitoring	Ongoing monitoring	Are the ongoing monitoring activities operated appropriately according to the original designs and purposes?
	Monitoring	Independent monitoring	Do you have any independent monitoring system other than ongoing monitoring activities embedded within the company's business operations, such as internal audits?
	Monitoring	Independent monitoring	Are the ongoing monitoring activities operated appropriately according to the original designs and purposes
	Monitoring	Response to results of monitoring	Are errors, material weakness of internal controls, etc. detected through the performance of control activities or noticed from outside the company timely reported to the management or senior managers and appropriately investigated and properly addressed?

2022-01-01 - Version 1.0