The COSO framework is the common name for the Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). It was first published in 1992 and revised and reissued in May 2013 (COSO: About Us). It defines internal control and sets out three categories of objectives, five components, seventeen principles and the requirements for an effective system. This guide explains the Framework from its official Executive Summary (May 2013), the source of everything below unless another source is named.
Who is COSO and what does it issue?
COSO is a private-sector initiative jointly sponsored and funded by five organisations: the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute of Management Accountants (IMA) and The Institute of Internal Auditors (IIA) (COSO: Executive Summary). Its mission is to help organisations improve performance by developing thought leadership that enhances internal control, risk management, governance and fraud deterrence (COSO: About Us).
| Publication | What COSO's website says |
|---|---|
| Internal Control—Integrated Framework (1992) | The original framework, superseded on 15 December 2014 by the 2013 Framework |
| Internal Control—Integrated Framework (2013) | Revised and reissued in May 2013 |
| Enterprise Risk Management—Integrated Framework (2004) | Issued by COSO in 2004; updated in 2017 |
| Enterprise Risk Management—Integrating with Strategy and Performance (2017) | The update to the 2004 ERM framework, highlighting the importance of considering risk in both the strategy-setting process and in driving performance |
The internal control framework and the ERM framework are separate documents; this guide covers the first. In the Executive Summary, COSO says the original framework gained broad acceptance and is widely used around the world.
The definition of internal control
The Framework defines internal control as follows: "Internal control is a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance."
The definition reflects five fundamental concepts. Internal control is:
- geared to the achievement of objectives in one or more categories: operations, reporting and compliance;
- a process of ongoing tasks and activities, a means to an end and not an end in itself;
- effected by people, not merely policy manuals, systems and forms;
- able to provide reasonable assurance, not absolute assurance, to senior management and the board; and
- adaptable to the entity structure: the entire entity or a subsidiary, division, operating unit or business process.
"Board of directors" in the Framework covers the governing body in whatever form, including an owner.
Three categories of objectives
| Category | What it covers |
|---|---|
| Operations | Effectiveness and efficiency of the entity's operations, including operational and financial performance goals and safeguarding assets against loss |
| Reporting | Internal and external financial and non-financial reporting; may encompass reliability, timeliness, transparency or other terms set by regulators, recognised standard setters or the entity's policies |
| Compliance | Adherence to laws and regulations to which the entity is subject |
The 2013 Framework expanded the financial reporting category to include other forms of reporting, such as non-financial and internal reporting.
The five components
Internal control consists of five integrated components:
- Control Environment: the set of standards, processes and structures that provide the basis for carrying out internal control. The board and senior management establish the tone at the top, including expected standards of conduct; the control environment has a pervasive impact on the whole system.
- Risk Assessment: a dynamic and iterative process for identifying and assessing risks to the achievement of objectives, considered relative to established risk tolerances. Risk is the possibility that an event will occur and adversely affect the achievement of objectives; establishing objectives is a precondition to risk assessment.
- Control Activities: actions established through policies and procedures that help ensure management's directives to mitigate risks are carried out. They may be preventive or detective, manual or automated, such as authorisations and approvals, verifications, reconciliations and business performance reviews. Segregation of duties is typically built in; where it is not practical, management selects and develops alternative control activities.
- Information and Communication: relevant, quality information from internal and external sources, and continual communication flowing up, down and across the entity, and to and from external parties.
- Monitoring Activities: ongoing evaluations built into business processes, separate periodic evaluations, or a combination, to ascertain whether each component, including the controls that effect its principles, is present and functioning. Deficiencies are communicated to management and the board as appropriate.
The COSO cube
The Framework depicts the relationship between objectives, components and the entity's organisational structure as a cube: the three categories of objectives are the columns, the five components are the rows, and the organisational structure (operating units, legal entities and other) is the third dimension.
The seventeen principles
The Framework sets out seventeen principles representing the fundamental concepts associated with each component; all of them apply to operations, reporting and compliance objectives. "Organization" means the board, management and other personnel collectively. The principles, verbatim:
Control Environment
- The organization demonstrates a commitment to integrity and ethical values.
- The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
- Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
- The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.
- The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.
Risk Assessment 6. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives. 7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. 8. The organization considers the potential for fraud in assessing risks to the achievement of objectives. 9. The organization identifies and assesses changes that could significantly impact the system of internal control.
Control Activities 10. The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. 11. The organization selects and develops general control activities over technology to support the achievement of objectives. 12. The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.
Information and Communication 13. The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. 14. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. 15. The organization communicates with external parties regarding matters affecting the functioning of internal control.
Monitoring Activities 16. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. 17. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
When is internal control effective?
An effective system provides reasonable assurance regarding the achievement of objectives and reduces the risk of not achieving an objective to an acceptable level. It requires that:
- each of the five components and relevant principles is present (in design and implementation) and functioning (in operation); and
- the five components operate together in an integrated manner rather than being considered discretely.
When a major deficiency exists in the presence and functioning of a component or relevant principle, or in the components operating together, the organisation cannot conclude that it has met the requirements for an effective system. The Framework requires judgement in designing, implementing and conducting internal control and in assessing its effectiveness; judgement enhances management's ability to make better decisions about internal control but cannot guarantee perfect outcomes.
Limitations
Even an effective system can fail, which is why it gives reasonable, not absolute, assurance. The Framework lists limitations resulting from:
- the suitability of objectives established as a precondition to internal control;
- human judgement in decision making that can be faulty and subject to bias;
- breakdowns caused by human failures such as simple errors;
- management's ability to override internal control;
- the ability of management, other personnel or third parties to circumvent controls through collusion; and
- external events beyond the organisation's control.
Who is responsible?
The Executive Summary sets out what each party should do; among the parties it names:
- Board of directors: discusses the state of the system with senior management and provides oversight; is apprised of risks and of assessments of deficiencies; challenges management, seeking input from internal auditors, external auditors and others.
- Senior management: is accountable for internal control and to the board, and should assess the system in relation to the Framework.
- Internal auditors: review their internal audit plans and how they applied the 1992 edition, and the changes in the updated version and their possible implications for audit plans and evaluations.
- Independent auditors: in some jurisdictions are engaged to audit or examine the effectiveness of internal control over financial reporting in addition to the financial statements, and can assess it in relation to the Framework.
See also Internal audit.
Applying the Framework
The Executive Summary asks senior management to assess internal control by focusing on how the organisation applies the seventeen principles in support of the components. The Framework applies to large, mid-size and small entities, for-profit and not-for-profit entities and government bodies, and a smaller entity's system may be less formal and less structured yet still effective (COSO: Executive Summary).
An illustrative mapping in the purchases and payments cycle (the mapping is ours, not the Framework's):
| Risk | Control (illustrative) | Type | Related principle |
|---|---|---|---|
| Payment to a fictitious supplier | New supplier master data is set up by someone other than the person who prepares payments | Preventive (segregation of duties) | 10 and 12 |
| Unauthorised change to a supplier's bank account | Monthly independent review of the supplier master-data change report | Detective | 10 |
| Both controls stop working unnoticed | Periodic internal audit testing, with deficiencies reported | Separate evaluation | 16 and 17 |
A payment to a fictitious supplier is a fraud risk, which principle 8 requires the organisation to consider when assessing risks. For designing controls and segregation of duties, see Designing internal control procedures; for fraud, see Financial fraud.
Controls and technology
Principle 11 covers general control activities over technology and principle 13 the quality of information. The Executive Summary lists the use of, and reliance on, evolving technologies among the changes the updated Framework reflects. For the practical side, see Accounting information systems and Common challenges of implementing accounting systems.
What is new around the Framework?
- 2013 and 2014: the updated Framework superseded the 1992 framework on 15 December 2014 (COSO: Guidance on Internal Control).
- 2023: COSO issued supplemental guidance on achieving effective internal control over sustainability reporting (ICSR) using the same Framework (COSO: Internal Control); the document describes itself as nonauthoritative, expressing its authors' interpretations.
- 2024: a paper commissioned by COSO on achieving effective internal control over robotic process automation, aligned with the Framework (COSO: Internal Control; the paper).
- 2026: Achieving Effective Internal Control Over Generative AI, a paper commissioned by COSO that adapts the five components and 17 principles to generative AI uses (COSO: Generative AI paper).
The 2013 Framework retained the core definition of internal control and the five components from the original framework, and formalised the fundamental concepts introduced in it as principles associated with the components (COSO: Executive Summary).
A practical tool
To document control activities and authorities: the Financial Policies and Procedures Manual with Authority Matrix and Internal Controls. It is a Word manual with procedures for eleven accounting cycles, each with steps, controls and documents, and an Excel file with an authority matrix for thirty processes, conflicting-duty pairs, a matrix of 52 controls (risk, type, frequency, owner and evidence) and a register of 29 risks with likelihood and impact. The content is a template to adapt and have approved by the authorised person; it is written for companies, not associations or non-profit entities, and it does not replace the entity's own assessment against the principles.
Sources
- Committee of Sponsoring Organizations of the Treadway Commission (COSO): Internal Control — Integrated Framework: Executive Summary (May 2013).
- COSO: Internal Control.
- COSO: Guidance on Internal Control.
- COSO: About Us.
- COSO: Achieving Effective Internal Control Over Sustainability Reporting (ICSR): Building Trust and Confidence through the COSO Internal Control—Integrated Framework (2023).
- COSO: Achieving Effective Internal Control Over Robotic Process Automation: Aligning with the COSO Internal Control-Integrated Framework (2024).
- COSO: Achieving Effective Internal Control Over Generative AI (GenAI) (2026).