COSO Internal Control Framework

Introduction to the COSO Internal Control Framework

The COSO Internal Control - Integrated Framework, published by the Committee of Sponsoring Organisations of the Treadway Commission, is the most widely adopted model in the world for designing, implementing, operating and evaluating a system of internal control. First issued in 1992 and comprehensively updated in 2013, the framework provides a principles-based structure that helps organisations of any size, sector or geography to achieve objectives across operations, reporting and compliance while managing risk to acceptable levels.

For CyberSigma clients, COSO matters for two distinct but connected reasons. First, it is the de facto benchmark that external auditors and regulators expect management to use when asserting that internal control over financial reporting (ICFR) is effective - most notably under the U.S. Sarbanes-Oxley Act (SOX) Sections 302 and 404, but increasingly referenced by boards, audit committees and regulators worldwide. Second, and less obviously, COSO is a foundational control philosophy that underpins many cybersecurity and information-security governance efforts: SOC 2 (whose Trust Services Criteria are explicitly mapped to the seventeen COSO principles), COBIT, and enterprise risk programmes all draw directly on the COSO components. Understanding COSO therefore gives an organisation a common vocabulary for control across finance, IT, security and operations.

This guide is written for audit committees, chief financial officers, chief information security officers, internal audit leaders, control owners and process managers who need an auditor-grade understanding of how COSO is structured and how to assess an internal control system against it. It walks through the five components, the seventeen principles and the associated points of focus, then provides a master assessment checklist, a phased implementation approach, a maturity model, an evidence request list and mappings to adjacent frameworks. Throughout, we distinguish the design of controls (are the right controls in place?) from their operating effectiveness (do they work consistently over the period under review?).

What is COSO

COSO is a private-sector, not-for-profit initiative jointly sponsored by five major professional associations in the United States: the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute of Management Accountants (IMA) and the Institute of Internal Auditors (IIA). It was formed in 1985 to support the National Commission on Fraudulent Financial Reporting (the Treadway Commission) and has since become the leading authority on internal control, enterprise risk management and fraud deterrence.

The COSO Internal Control - Integrated Framework defines internal control as a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in three categories: operations (effectiveness and efficiency of operations, including performance and safeguarding of assets), reporting (reliability, timeliness and transparency of internal and external financial and non-financial reporting) and compliance (adherence to applicable laws and regulations). Several ideas embedded in this definition are important. Internal control is a process, not a one-off event; it is effected by people at every level, not just policy documents; it can provide only reasonable, not absolute, assurance; and it is geared to the achievement of objectives, meaning control is a means to an end, not an end in itself.

The 2013 update introduced the most significant change to the framework's usability: the codification of seventeen principles distributed across the five long-standing components. Each principle represents a fundamental concept associated with its component, and COSO's position is that all seventeen principles are relevant to every entity. For an internal control system to be deemed effective, each of the five components and each of the seventeen relevant principles must be present and functioning, and the five components must operate together in an integrated manner. "Present" means the components and principles exist in the design and implementation; "functioning" means they continue to operate as designed. A major control deficiency in a component or principle - meaning it is not present or not functioning - precludes management from concluding that the entity has met the requirements for effective internal control.

It is important to distinguish the Internal Control framework from COSO's companion Enterprise Risk Management (ERM) framework, most recently updated in 2017 as "Enterprise Risk Management - Integrating with Strategy and Performance." The ERM framework is broader, addressing how risk is considered in strategy-setting and performance across the whole enterprise, and is organised into five components and twenty principles. This guide focuses primarily on the Internal Control framework, which is the version referenced for SOX and SOC 2, while noting ERM where it adds value.

Who must comply with COSO

COSO is a voluntary framework - no law mandates COSO by name. However, it is effectively required in many contexts because regulators and auditors expect management to use a suitable, recognised control framework, and COSO is the overwhelmingly dominant choice. The table below summarises the populations that in practice must, or strongly should, adopt COSO.

• Boards and audit committees carry ultimate oversight responsibility and must understand whether management's COSO-based system is effective.
• Management (from the CEO and CFO down to process owners) designs, implements and operates the controls and makes the effectiveness assertion.
• Internal audit provides independent evaluation of the system but does not own the controls.
• Every employee has some role in internal control - controls are effected by "people at every level."

Structure of COSO

The COSO Internal Control - Integrated Framework is visualised as a three-dimensional cube. The three objective categories (operations, reporting, compliance) form the columns across the top; the entity's organisational structure (entity level, division, operating unit, function) forms the third dimension; and the five components form the horizontal rows. The seventeen principles are nested within the five components. The table below sets out the five components and their constituent principles - this is the backbone against which any COSO assessment is performed.

Master assessment checklist

This is the core of the guide. Below, each of the five components is broken out with its principles, and for every principle we provide a table of what to verify (the auditor's test objectives, informed by COSO's points of focus) and the typical evidence a control owner should be able to produce. Work through every row: skipping a principle risks an undetected major deficiency. For each principle, assess both design adequacy (would the control, if operating, prevent or detect the relevant risk?) and operating effectiveness (did it operate consistently throughout the period?).

Component 1 - Control Environment (Principles 1 to 5)

The control environment is the set of standards, processes and structures that provide the foundation for carrying out internal control across the organisation. It sets the tone at the top and influences the control consciousness of all personnel.

Component 2 - Risk Assessment (Principles 6 to 9)

Risk assessment is the dynamic and iterative process for identifying and analysing risks to the achievement of objectives, forming a basis for determining how risks should be managed. It presupposes that objectives have been clearly set.

Component 3 - Control Activities (Principles 10 to 12)

Control activities are the actions established through policies and procedures that help ensure management's directives to mitigate risks are carried out. They occur throughout the organisation, at all levels and in all functions, and include a range of preventive and detective activities such as authorisations, verifications, reconciliations, reviews of operating performance, and segregation of duties.

Component 4 - Information and Communication (Principles 13 to 15)

Information is necessary for the entity to carry out internal control responsibilities in support of the achievement of objectives. Communication is the continual, iterative process of providing, sharing and obtaining necessary information, both internally and with external parties.

Component 5 - Monitoring Activities (Principles 16 to 17)

Monitoring activities are the ongoing evaluations, separate evaluations, or some combination of the two, used to ascertain whether each of the five components of internal control is present and functioning, and to communicate deficiencies for correction.

Scoping the COSO assessment

Scoping determines which objectives, entities, processes, accounts and IT systems are in scope for a COSO-based evaluation. For an ICFR/SOX assessment, scoping is typically driven by a top-down, risk-based approach: start with financial reporting objectives, identify material accounts and disclosures, trace to significant business processes and the relevant assertions, and then identify the controls (entity-level, process-level, and IT general controls) that address the risks of material misstatement.

• Define objectives in scope - operations, reporting (external financial, external non-financial, internal), and compliance. For SOX the focus is external financial reporting.
• Determine materiality and set a scoping threshold to identify significant accounts, disclosures and relevant assertions (existence, completeness, accuracy, valuation, rights/obligations, presentation).
• Identify in-scope locations/business units using quantitative coverage and qualitative risk factors; multi-location scoping should reflect risk concentration.
• Map significant processes (e.g. order-to-cash, procure-to-pay, payroll, treasury, financial close) to the accounts and assertions they affect.
• Identify relevant IT systems and the IT general control domains supporting automated and IT-dependent controls.
• Include entity-level controls (control environment, risk assessment, monitoring) that operate across the whole organisation.
• Consider outsourced service providers and reliance on SOC 1/SOC 2 reports, including complementary user entity controls.
• Document and obtain sign-off on the scope, rationale and any exclusions.

Implementation approach

A COSO implementation or uplift programme is best delivered in phases. The phases below assume an organisation moving towards a defensible ICFR/internal control assertion; adapt the emphasis for a pure governance or SOC 2 readiness effort.

Phase 1 - Mobilise and govern

• Activities: secure board/audit committee and executive sponsorship; establish a steering committee and programme management office; agree objectives, scope and reporting framework; confirm COSO 2013 as the evaluation basis; define roles across finance, IT, risk and internal audit.
• Deliverables: programme charter, RACI, governance structure, high-level plan and budget, communication plan.

Phase 2 - Assess current state and scope

• Activities: perform top-down risk-based scoping; document objectives, material accounts, assertions and significant processes; map existing controls to the seventeen principles; conduct a gap assessment against components, principles and points of focus.
• Deliverables: scoping memorandum, risk-and-control matrices, principle-by-principle gap assessment, prioritised remediation backlog.

Phase 3 - Design and remediate

• Activities: design new or enhanced controls to close gaps; strengthen entity-level controls and ITGCs; formalise policies, procedures and process narratives; assign control owners; establish segregation of duties and compensating controls.
• Deliverables: updated control documentation, remediation plans with owners and dates, revised policies and procedures, control ownership register.

Phase 4 - Test and validate

• Activities: test design adequacy and operating effectiveness of controls over the assessment period; validate IPE; evaluate deficiencies and classify severity; coordinate with external auditors on reliance and testing.
• Deliverables: test plans and working papers, deficiency evaluation, aggregated deficiency assessment, evidence repository.

Phase 5 - Report, monitor and sustain

• Activities: report conclusions to management and the audit committee; support the effectiveness assertion; embed ongoing and separate evaluations (continuous monitoring); establish an annual refresh cycle covering changes and new risks.
• Deliverables: management assertion support pack, audit committee report, continuous monitoring framework, sustainability/annual-refresh plan.

Maturity and capability model

COSO itself does not prescribe a maturity model - effectiveness is assessed as present-and-functioning against each principle. However, a capability maturity model is a valuable management tool for prioritising uplift and demonstrating progress over time. The five-level model below is a practical CyberSigma scale applicable to the control system as a whole or to individual components and principles.

Assessment and audit approach

The following ordered steps describe how CyberSigma conducts a COSO-based internal control assessment, whether for an ICFR/SOX programme, a SOC 2 readiness engagement or a broader governance review.

1. Confirm objectives, reporting framework and the COSO 2013 basis with the audit committee and management sponsor.
2. Perform top-down, risk-based scoping to identify in-scope objectives, entities, accounts, assertions, processes and IT systems.
3. Understand and document the design of entity-level controls, process-level controls and IT general controls, mapping each to the relevant COSO principle and risk.
4. Assess design adequacy - would the control, if operating as designed, mitigate the risk to an acceptable level?
5. Develop a risk-based test plan specifying sample sizes, timing, nature of testing (inquiry, observation, inspection, re-performance) and IPE validation.
6. Test operating effectiveness across the assessment period, gathering and cross-referencing evidence to working papers.
7. Identify and evaluate deficiencies, determining severity as a control deficiency, a significant deficiency, or a material weakness, and aggregating related deficiencies.
8. Evaluate whether each of the five components and seventeen principles is present and functioning, and whether the components operate together in an integrated manner.
9. Report findings, root causes and recommendations; agree remediation plans with owners and target dates.
10. Support management's effectiveness assertion and coordinate with the external auditor; establish ongoing monitoring and an annual refresh.

Evidence request list

The following categorised evidence request supports a COSO assessment. Provide current, dated and version-controlled documents, and be prepared to demonstrate operation across the full period, not just at a point in time.

• Governance and control environment: board and audit committee charters and minutes, code of conduct and acknowledgements, organisation charts, delegation-of-authority matrix, HR competency and training records, whistle-blower policy and logs.
• Risk assessment: enterprise and process-level risk registers, risk-scoring methodology, fraud risk assessment, change management records, materiality memoranda, financial statement assertion analysis.
• Control activities: risk-and-control matrices, process narratives and flowcharts, policies and standard operating procedures, segregation-of-duties matrices, control performance evidence (approvals, reconciliations, exception reports).
• IT general controls: change management tickets and approvals, logical access provisioning and periodic access reviews, privileged access records, backup and recovery evidence, SDLC and configuration documentation.
• Information and communication: data governance and retention policies, IPE completeness and accuracy support, management and board reporting packs, internal and external communication records.
• Monitoring: internal audit plan and reports, management self-assessment results, continuous-monitoring outputs, deficiency logs, remediation trackers and closure evidence.
• Third parties: SOC 1/SOC 2 reports for outsourced providers, vendor contracts and control clauses, complementary user entity control documentation.

Roles and responsibilities

COSO is explicit that internal control is a shared responsibility. The table below clarifies the principal roles in a COSO-based control system.

KPIs to track

• Percentage of the seventeen principles assessed as present and functioning.
• Number of control deficiencies by severity (deficiency, significant deficiency, material weakness) and trend over time.
• Percentage of key controls tested and passed on first attempt (control pass rate).
• Average time to remediate deficiencies and percentage of remediations closed by target date.
• Percentage of controls with documented, approved procedures and assigned owners.
• Segregation-of-duties conflicts identified versus resolved or compensated.
• IT general control exceptions (access, change, operations) per period.
• Percentage of automated versus manual key controls (automation coverage).
• Whistle-blower/ethics reports received, investigated and resolved within target time.
• Coverage of the internal audit / monitoring plan actually completed in the period.
• Timeliness and completeness of information produced by the entity (IPE) used in controls.

Readiness checklist

• COSO 2013 Internal Control - Integrated Framework confirmed as the evaluation basis and approved by the audit committee.
• Financial reporting and other in-scope objectives documented with materiality and relevant assertions.
• Top-down, risk-based scoping completed and signed off, including locations, processes and IT systems.
• Enterprise and process-level risk registers current, including an explicit fraud risk assessment.
• Each of the seventeen principles mapped to controls, with owners assigned and gaps identified.
• Entity-level controls, process-level controls and IT general controls documented in risk-and-control matrices.
• Segregation of duties assessed and conflicts remediated or compensated.
• Policies, procedures and process narratives approved, version-controlled and communicated.
• Design adequacy and operating effectiveness testing plan agreed, including IPE validation.
• Deficiency evaluation and severity classification methodology defined.
• Monitoring plan (ongoing and separate evaluations) in place and resourced.
• Third-party (SOC 1/SOC 2) reliance assessed and complementary user entity controls implemented.
• Reporting to management and the audit committee, and support for the effectiveness assertion, prepared.
• Annual refresh and continuous-monitoring approach established to sustain effectiveness.

Common gaps

• Treating COSO as a documentation exercise rather than demonstrating that principles are actually functioning over the whole period.
• Weak entity-level controls - poorly evidenced tone at the top, board oversight or accountability (Principles 1-5) - that undermine reliance on process controls.
• Fraud risk assessment (Principle 8) omitted or reduced to a checkbox, with no consideration of management override.
• Inadequate IT general controls (Principle 11), especially access reviews, privileged access and change management, invalidating reliance on automated controls.
• Failure to validate information produced by the entity (IPE) - reports and spreadsheets used in controls without completeness and accuracy testing.
• Segregation-of-duties conflicts unresolved and without documented compensating controls.
• Objectives not specified with enough clarity (Principle 6), so risk assessment cannot be anchored to assertions.
• Deficiencies identified but not aggregated or escalated, so a cluster of small issues masks a material weakness (Principle 17).
• Over-reliance on internal audit as the only monitoring, with no ongoing management-level monitoring embedded in processes.
• Ignoring integration - components operating in silos so that risk assessment does not drive control activities or monitoring.
• Change assessment (Principle 9) neglected, so new systems, acquisitions or regulations erode existing controls unnoticed.
• Outsourced processes covered by outdated or scope-limited SOC reports, with complementary user entity controls not implemented.

COSO mapped to other frameworks

COSO's components and principles map naturally onto the control and governance expectations of many other frameworks, which is why it functions as a lingua franca for control. The table below shows indicative relationships; mappings are directional aids, not exact equivalences.

Frequently asked questions

Need help with COSO?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.