COSO framework
Also called COSO Internal Control – Integrated Framework, COSO 2013
The COSO framework is a model for designing, running and assessing internal control, published by the Committee of Sponsoring Organizations of the Treadway Commission. It sets out five components and 17 principles. Public companies use it to test internal control over financial reporting, and many firms apply it to operations and compliance too.
How it works
The 2013 Internal Control – Integrated Framework, which replaced the 1992 original, has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Under them sit 17 principles, such as board oversight, fraud risk assessment and evaluating deficiencies. A system of internal control is effective only when every component and relevant principle is present, functioning and operating together.
Firms map their key controls to the principles, document how each one works and test it during the year. Gaps are rated as deficiencies, significant deficiencies or material weaknesses and tracked to remediation. COSO also publishes a separate enterprise risk management framework, updated in 2017, which links risk to strategy and performance. Many banks use both, with the internal control framework as the base for audit and attestation work.
The rules
Requires management to evaluate internal control over financial reporting using a suitable, recognised control framework set by a body that followed due process. COSO is the framework most issuers use.
US-listed companies filing annual reports with the SECRequires the board to monitor the risk management and internal control framework and to declare whether material controls were effective at the balance sheet date.
Companies with a UK listing of equity shares, on a comply or explain basisCommon questions
Is the COSO framework a legal requirement?
No law names COSO. US rules require a suitable, recognised framework for internal control over financial reporting, and COSO is the one most companies choose. Regulators and auditors in many countries treat it as the reference model.
What are the five COSO components?
Control environment, risk assessment, control activities, information and communication, and monitoring activities. Each component has principles beneath it, 17 in total, and all must be present and functioning together.
What is the difference between COSO internal control and COSO ERM?
The internal control framework covers how controls are designed and tested to meet objectives. The ERM framework is broader and covers how risk is weighed in strategy, performance and decision making across the whole organisation.
