COSO Framework

When public companies in the United States assess their internal control over financial reporting, they need a recognized standard to assess it against. For most of them, that standard is the COSO framework. It describes what effective internal control looks like through a small set of objectives, components and principles that apply to any organization, whether a global corporation, a government agency or a nonprofit. Auditors, regulators and boards all understand it, which makes it a common language for discussing whether controls are working. Its principles-based design lets organizations of different sizes apply it in proportion to their needs.

COSO stands for the Committee of Sponsoring Organizations of the Treadway Commission. It was formed in 1985 to support the National Commission on Fraudulent Financial Reporting, known as the Treadway Commission, and is sponsored by five professional bodies representing accountants, auditors and financial executives. COSO published its Internal Control Integrated Framework in 1992 and updated it in 2013. It also publishes a separate framework for enterprise risk management. For finance, audit, risk and compliance teams, COSO is the foundation on which most internal control programs are built.

Definition of COSO Framework

The COSO Internal Control Integrated Framework defines internal control as a process, carried out by an organization's board, management and other personnel, designed to provide reasonable assurance about achieving objectives relating to operations, reporting and compliance, and organizes it into five components supported by 17 principles.

It is the most common basis for internal controls and SOX compliance, and COSO's separate risk framework underpins much of enterprise risk management practice.

Objectives, Components and the COSO Cube

The framework has three categories of objectives: operations, which concern effective and efficient use of resources; reporting, which covers internal and external financial and non-financial reporting; and compliance, which covers adherence to laws and regulations.

It has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

These apply across the organization's structure, from the entity as a whole to divisions, operating units and functions. An effective system needs controls at each level, not only at the top or only in transactions.

The three dimensions are often shown as a cube, illustrating that every component applies to every objective at every level of the organization.

The 17 Principles

The control environment has five principles, including commitment to integrity and ethical values, board independence and oversight, and accountability for internal control responsibilities.

Risk assessment has four principles, including specifying clear objectives, identifying and analyzing risks, assessing fraud risk and identifying significant changes.

Control activities have three principles, covering the selection of control activities, general controls over technology and deployment through policies and procedures.

Information and communication has three principles, covering quality information, internal communication and external communication.

Monitoring activities has two principles, covering ongoing and separate evaluations and the communication of deficiencies.

For internal control to be effective, each component and each relevant principle must be present and functioning, and the five components must operate together.

Importance of the COSO Framework in Risk and Compliance

COSO provides a recognized standard. The US Securities and Exchange Commission accepts it as a suitable framework for management's assessment under SOX, and it is used by most US public companies.

It looks beyond individual controls. By including the control environment, risk assessment and monitoring, COSO recognizes that controls depend on culture, governance and oversight, not only on specific checks. A strong control set can still fail if leaders set a poor tone or ignore warning signs.

It also gives a common language. Boards, auditors, regulators and management can discuss control strengths and gaps using the same structure.

The COSO Framework and Financial Management

COSO is most often applied to internal control over financial reporting, guiding controls over revenue, expenses, assets and the general ledger.

Mapping key controls to the 17 principles helps confirm that the control set is complete without adding unnecessary controls.

The principle on general controls over technology connects financial reporting to IT general controls, which often drive a large share of control testing costs.

The fraud risk principle encourages specific assessment of how financial results could be manipulated, which can prevent costly restatements.

Common Challenges

Organizations may focus on control activities and give less attention to the control environment and monitoring components. These components are harder to test but often explain why control failures happen.

Mapping hundreds of controls to the principles can become a paperwork exercise unless it is used to find real gaps.

Some organizations still describe their controls using terms from the 1992 version, which can confuse auditors and staff. Aligning documentation with the 2013 version avoids this confusion.