Using COSO to Mitigate Service Learning Project Risk
Service learning helps students learn by applying accounting concepts and ethics principles to real accounting tasks in community service organizations. Despite the benefits of service learning, few instructors use it (Abes, 2002). We identify risks instructors face while facilitating service learning projects and present a model of the COSO Internal Control–Integrated Framework (2013) as a mechanism for risk mitigation. We also provide a handbook with guidance and document templates to help mitigate service learning project risk and to facilitate project implementation.Abstract
In this paper, we identify risks instructors face with the implementation of service learning projects and suggest the application of the COSO Internal Control–Integrated Framework (Committee of Sponsoring Organizations of the Treadway Commission & PwC, 2013) to mitigate such risks and improve the benefits of these projects. We also use the COSO principles to create an instructor's handbook for service learning project implementation Our recommendations include strategies to integrate student participation in the risk management process as an applied learning experience in internal control frameworks cited to be important in AIS courses (Garnsey et al., 2019).
Service learning integrates meaningful community service aligned with the learning outcomes of a course to benefit both the student and the community organization (Furco, 1996). Necessary partners in service learning are community-based organizations (CBOs), which are “a public or private non-profit organization of demonstrated effectiveness that—a) is representative of a community or significant segments of a community; and, b) provides educational or related services to individuals in the community” (Elementary and Secondary Education Act, 20 USC § 7801(5) et seq., 1965). Examples of CBOs include healthcare clinics, homeless shelters, food banks, and community foundations.
Service learning can enhance accounting students' education by providing them with real-world applications of classroom knowledge in a community setting that supports their ethical and professional development (Calvert et al., 2011). It can also improve students' interpersonal skills and leadership development (Eyler et al., 2001; Taylor et al., 2019; Zamora, 2011), social responsibility, and citizenship (Cabedo et al., 2018; Eyler et al., 2001; Eyler & Giles, 1999; Huda, Jasmi et al., 2018; Huda, Teh et al., 2018), and augment academic learning outcomes (Berman, 2006; Christensen & Woodland, 2016; Dietz, 2018; Eyler & Giles, 1999; O'Brien et al., 2017; Sangpikul, 2017; Still & Clayton, 2004).
Blewitt et al. (2018) suggest that experiential learning can enhance individuals' awareness of their school's value-based education, ultimately leading students toward ethical decision-making. Ethical decision-making is relevant for students seeking a purpose-driven philosophy in their education (Aziz, 2020; Wright & Church, 2020).
The Association to Advance Collegiate Schools of Business recommends giving students opportunities for contextual reflection on practical experience and community engagement (AACSB, 2020). However, despite these AACSB recommendations, business instructors seldom implement service learning projects (Abes, 2002). Andrews (2007) identifies this lack of curriculum alignment as a barrier to adoption. Calvert et al. (2011) note that operational challenges, such as project management and workload, also dissuade instructors from implementing service learning projects (Garnsey et al., 2019).
Service Learning Risks
If not properly executed, service learning projects can fail (Cyphert, 2006), jeopardize student learning (Warner et al., 2012), or negatively impact the various participating stakeholders (Kolenko et al., 1996; Reams, 2003; Warner et al., 2012). Kolenko et al. (1996) raised concerns about academic integrity, institutional support, and student safety. This section outlines typical risks categorized by their associated service learning stakeholders.
Student Risk
Students bring different skill sets and levels of motivation to service learning projects. Thus, professors must consider students' commitment level, competence in the subject area, and the likelihood that students will be at risk. Student-related sources of risk include unproductive team dynamics, students dropping out of the course before project completion, violations of safety policies and procedures, accidents, and improper conduct (such as sexual harassment, inappropriate language, or theft) by or toward students (Reams, 2003).
Instructor Risk
Instructors' lack of organization, coordination, communication, and controls can lead to risk. Some instructors might not know their school's service learning requirements. Others might lack the time or skill set to do the required preparation, corrective actions, or post-project evaluations (Calvert et al., 2011; Van Leuven, 2018).
Community-Based Organization Risk
CBOs chosen for service learning projects will have their own inherent risk. For example, a CBO might underestimate the time or resources needed to facilitate the project. There might also be safety risks for the students associated with the CBO's premises (Berman, 2006; Bugg & Collins, 2018).
Risk-Mitigation
Instructors who understand the risks associated with service learning might be reluctant to adopt these projects. Responding to Warner et al. (2012), we argue that a well-designed service learning project can mitigate risk sufficiently to provide a net benefit to CBOs and students. Thus, instructors must intentionally design risk management into service learning projects (Reams, 2003). Since most AIS courses teach the COSO framework (Bain et al., 2002; Garnsey et al., 2019; Groomer & Murthy, 1997; Premuroso & Houmes, 2012), we suggest that AIS instructors practice what we preach to mitigate risk in service learning projects. Instructors' understanding of COSO makes it a natural solution for guiding AIS service learning.
COSO Principles Applied to AIS Service Learning Projects
In this section, we make recommendations for instructors to follow when implementing AIS service learning projects grounded on each of the 17 COSO principles. We then organize these recommendations into an “implementation handbook” that includes a checklist for instructors, implementation recommendations, and associated templates to facilitate service learning projects.
Control Environment
The COSO framework's control environment has five principles that guide the standards, processes, and structures that facilitate internal control implementation across an organization (COSO, 2013).
Principle 1: The organization demonstrates a commitment to integrity and ethical values (COSO, 2013). Commitment to integrity and ethical values occurs at all levels. Leaders can encourage service learning by recognizing these efforts during faculty promotions. These incentives send a clear message to instructors of the institutional commitment to service learning. Instructors should teach students the importance of the societal impact students achieve in performing the service learning project.
Principle 2: The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal controls (COSO, 2013). A service learning committee can oversee activities at a higher organizational level. We recommend universities have a center that supports instructors engaged in service learning. This center should promulgate policies and procedures, best practices, and project review standards. It can also develop community partnerships that facilitate service learning projects. Finally, this committee should monitor the effectiveness of internal controls for service learning curricula and ensure compliance with university policies.
Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in pursuit of objectives (COSO, 2013). Understanding everyone's responsibilities is critical to better service learning outcomes. Instructors must establish suitable roles and responsibilities for each stakeholder. For example, students must understand their assignments and unique responsibilities before engaging with the CBO. We recommend that students create a team contract (such as the example in Appendix A) that holds them accountable, establishes engagement norms, and assigns roles that fit their skills, abilities, personalities, and preferences. Instructors should create service learning plans as individual contracts between the CBO and each student (see example in Appendix B). Such plans state learning objectives, service deliverables, and stakeholder responsibilities and reinforce the academic integrity of business ethics in the classroom (Kolenko et al., 1996). Students should complete a confidentiality agreement (such as the example we provide in Appendix C, subject to approval by university legal counsel) that defines their responsibility to protect the confidentiality of client data.
Principle 4: The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives (COSO, 2013). AIS instructors should design service learning projects that align with the course learning objectives to ensure students benefit from practicing course skills. Course content should enable students to accomplish project tasks and include soft skills training, such as team building, time management, and delineating roles (Rebele & Pierre, 2019). The team contract should prompt team members to do this planning. Instructors should also guide CBOs to follow best practices when working with students.
Principle 5: The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives (COSO, 2013). Instructors should introduce the COSO framework to their students and describe the risk management responsibilities of each stakeholder. Students will learn how COSO operates as they perform and control project risks. Instructors should explain the institutional policies to students that they must follow to mitigate risks.
Risk Assessment
The COSO framework includes four risk assessment principles that can help identify and analyze organizations' exposure to risk, the likelihood and degree of such liability, and any potential changes that may impact the assessment. (COSO, 2013).
Principle 6: The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives (COSO, 2013). Instructors should ensure that the learning objectives are clear to the students and applicable to AIS content. Clarity of project deliverables and other responsibilities helps instructors identify and assess the project's risks.
Principle 7: The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed (COSO, 2013). Before beginning work, instructors and students should jointly assess project risks using the COSO framework. This assessment, facilitated using checklists or questionnaires, should identify any safety, reputational, or operational risks. Appendix D describes how to use a class discussion to involve students in this risk assessment. This discussion can help students learn how internal controls can mitigate each identified risk.
Principle 8: The organization considers the potential for fraud in assessing risks to the achievement of objectives (COSO, 2013). The project risk assessment should consider potential fraud, including attempts to circumvent established controls. Frauds might include misreporting of engagement hours or the extent of the student contributions. Instructors should use internal control documents, such as the provided timesheet logs with CBO signoff (Appendix E), meeting minutes (Appendix F), and peer evaluations (Appendix G).
Principle 9: The organization identifies and assesses changes that could significantly impact the system of internal control (COSO, 2013). Students should provide periodic status reports (Appendix H) that report any material changes that could affect internal control. Instructors should work with students to adjust control procedures in response to those changes.
Control Activities
The COSO framework includes three control activities principles that relate specifically to achieving objectives (COSO, 2013).
Principle 10: The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels (COSO, 2013). The students and instructor should jointly determine responses to any identified risks. Documents in the appendices can facilitate these determinations. For example, the Initial Reflection and Engagement Report in Appendix I prompts students to identify any concerns regarding operational risks, such as the lack of project clarity, incomplete CBO documentation, or missing contact information at an early stage.
Principle 11: The organization selects and develops general control activities over technology to support the achievement of objectives (COSO, 2013). Technology can be a part of almost any service learning project. Instructors should verify that students use technology appropriately, such as for data retention and information sharing.
Principle 12: The organization deploys control activities through policies that establish what is expected and procedures that put policies into action (COSO, 2013). Instructors must ensure students understand all institutional policies and procedures, such as confidentiality, data privacy, and proper software use. The California State University System provides examples of policies and good practices relevant to service learning (Center for Community Engagement, 2011, pp. 56–61).
Information and Communication
The COSO framework includes three information and communication principles related to generating and disseminating information throughout the organization to support the effectiveness of internal controls (COSO, 2013).
Principle 13: The organization obtains or generates and uses relevant, quality information to support the function of internal control (COSO, 2013). Instructors should design student deliverables that include information needed to assess the effectiveness of internal controls. For example, progress reports and meeting minutes can help verify students' progress. Requiring students to use cloud-based documentation accessible to the instructor can also help monitor their engagement.
Principle 14: The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal controls (COSO, 2013). Instructors should communicate the purpose of policies and procedures related to service learning and who is responsible for their execution. In addition, instructors should actively respond to relevant information collected from student reports and other internal controls (e.g., accident reports, student or CBO attrition). Instructors should engage the institutional channels (e.g., a risk management division) for support when necessary.
Principle 15: The organization communicates with external parties regarding matters affecting the functioning of internal control (COSO, 2013). Instructors should meet with CBO personnel before the project, establish preferred forms of communication, and explain the importance of project schedule adherence. Instructors should receive a copy of all student correspondence with the CBO. An action plan should be in place to guide students and instructors if communication with the CBO becomes impaired.
Monitoring Activities
The COSO framework includes two monitoring principles that relate to an organization's continuous assessment of the effectiveness of the system of internal controls and the determination of any necessary adjustments (COSO, 2013).
Principle 16: The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning (COSO, 2013). Instructors should continuously evaluate policies and procedures for risk-mitigation effectiveness and student adherence. For example, instructors can verify the accuracy of project status reports and the details recorded in meeting minutes as the project progresses to ensure any established internal controls are working. In addition, faculty should document internal control deficiencies or project failures when they occur and determine internal control changes needed.
Principle 17: The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate (COSO, 2013). Instructors should create a manageable system to quickly and efficiently communicate lessons learned to stakeholders. They must share any negative experiences and potential solutions with other instructors. We recommend recording deficiencies in a centralized mechanism, such as a service learning peer-review committee or university center, available to all stakeholders during future risk assessments. Future projects will benefit from adjustments that address weaknesses or failures.
Service-Learning Implementation Handbook
Tables 1, 2, 3, 4, and 5 provide detailed implementation guidance organized by the five project phases: Planning, Orientation, Performing, Reporting, and Post-Project, respectively. Instructors can use these tables to guide development of their own operational handbooks for service-learning implementations. The first column in each table contains questions instructors should ask as they design their service learning projects. The second column summarizes our guidance, which includes suggested templates (see the referenced appendices) to facilitate implementation.
Summary and Takeaways
Accountants and auditors have used the COSO framework to develop and implement risk mitigation strategies for decades, managing uncertainty while adding value to organizations of all sizes. We propose the adoption of the COSO Internal Control–Integrated Framework that AIS instructors know well. We provide examples and templates readers can use to design service learning projects that follow AACSB societal impact guidance and the purpose-driven orientation of today's students. We also recommend making this framework a class discussion topic to teach students about its broad applicability beyond strictly financial processes.
We have adopted this framework for service learning in AIS courses over two semesters at two institutions, each with different governance structures, incentives, and resources dedicated to service learning. Since using this framework, we have anecdotally seen an increase in service learning benefits and a reduction in risk for students, instructors, universities, and CBOs. We saw a better alignment of projects with learning objectives, reduced unanticipated adverse incidents, increased completion of projects without disruptions, and full compliance with university policies governing these activities. We encourage instructors to develop students' professional integrity and ethics using service learning projects.
Conclusion
For many students, a service learning project will be their first experience as professional accountants whose opinion is respected by the organization they serve. We want the service-learning experience to be positive and effective in motivating them to continue their accounting education and contribute to their communities throughout their careers. We believe implementing the COSO framework in service learning projects will mitigate risks to all stakeholders. In this way, service learning projects can improve the chances of providing a worthwhile experience for students that meets learning objectives, broadens students' understanding of philanthropy, and helps build the next generation of business leaders to be more impactful in their communities.
