The COSO 2013 Internal Control: Integrated Framework describes internal control as five components supported by 17 principles: control environment, risk assessment, control activities, information and communication, and monitoring activities. Management uses it as the standard to judge whether internal control over financial reporting is effective. Auditors use it to decide what evidence to ask for.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of the COSO 2013 framework (five components, 17 principles) as described in secondary summaries. We confirmed the split of principles by component (5, 4, 3, 3 and 2) and the end of the 1992 framework's transition on 15 December 2014 against several secondary sources. The framework itself is a primary document that was not opened for this guide, so check its current text and any later COSO updates. Wording of individual principles below is paraphrased, not quoted.
What COSO is
COSO is the Committee of Sponsoring Organizations of the Treadway Commission. It first published its internal control framework in 1992 and issued an updated version in 2013. The update kept the five components but spelled out 17 principles to make the framework easier to apply.
COSO defines internal control as a process, run by the board, management and other people, to give reasonable assurance on three kinds of objectives: operations, reporting and compliance. For SOX work, the focus is the reporting objective. The framework is commonly used by US-listed companies. Other frameworks are allowed in principle, but COSO is what most companies pick. India's rules do not name one; see SOX controls vs IFC in India.
A control can be effective only if all five components are present and working together. Reasonable assurance is not absolute assurance. People make mistakes and can collude to override controls.
The five components in practice
1. Control environment
This is the tone and structure of the organisation. It is the foundation for the other four.
Five principles sit here. In plain words: integrity and ethical values, board oversight, clear structure and authority, commitment to competence, and accountability.
- Auditor asks: Is there a code of conduct and is it enforced? Does the audit committee meet and challenge management? Are roles written down?
- Example evidence: Code of conduct acknowledgements, audit committee minutes, organisation charts, job descriptions, disciplinary records.
2. Risk assessment
This is how the company finds and analyses what could stop it reporting reliably.
Four principles: clear objectives, identifying and analysing risks, considering fraud risk, and spotting changes that affect internal control.
- Auditor asks: Does management link risks to specific financial statement lines? Is fraud risk considered, such as management override or revenue manipulation? What happens after a new system, acquisition or accounting standard?
- Example evidence: Risk register, fraud risk assessment, a change log showing controls updated after a new ERP module.
3. Control activities
These are the policies and procedures that act on the risks: approvals, reconciliations, segregation of duties, system checks.
Three principles: selecting controls that reduce risk, selecting general controls over technology, and deploying controls through policies and procedures.
- Auditor asks: Does each key risk have a control? Is the control precise enough to catch an error? Who performs it and how often?
- Example evidence: Process narratives, risk and control matrix, signed reconciliations, system configuration screenshots. For technology controls see SOX IT general controls testing.
4. Information and communication
Good controls need good information, and people need to know their role.
Three principles: using relevant quality information, communicating internally, and communicating externally.
- Auditor asks: Are reports used in controls complete and accurate? Can staff report concerns? Are control responsibilities and policy changes communicated?
- Example evidence: Report parameter checks, whistleblower channel logs, policy circulation records, communications to the audit committee.
5. Monitoring activities
This is checking whether controls keep working.
Two principles: ongoing or separate evaluations, and evaluating and communicating deficiencies on time.
- Auditor asks: Who tests controls and how often? When a deficiency is found, who tracks it to closure?
- Example evidence: Internal audit reports, deficiency log with owners and dates, management review dashboards.
The 17 principles at a glance
| Component | Number of principles |
|---|---|
| Control environment | 5 |
| Risk assessment | 4 |
| Control activities | 3 |
| Information and communication | 3 |
| Monitoring activities | 2 |
| Total | 17 |
Under the 2013 framework, management is expected to conclude that each principle is present and functioning, and that the five components operate together. A missing or failing principle is a serious finding.
How auditors use it
- Map the key risks to financial statement assertions.
- Link each risk to controls in components 3 and 4.
- Judge the entity-level controls in components 1, 2 and 5. Strong entity-level controls make process controls more believable, but they do not replace testing.
- Test the controls. See walkthroughs and testing.
- Evaluate gaps. See how to classify deficiencies.
Frequently Asked Questions
What is the difference between COSO 1992 and COSO 2013?
The components stayed the same. The 2013 version added 17 principles and more guidance on technology, fraud and outsourcing.
Is COSO mandatory under SOX?
SOX requires a suitable, recognised framework. COSO is the one most companies use in practice.
Does India require COSO?
No Indian law names a framework. The ICAI guidance on internal financial controls uses its own approach, and COSO is common in practice. See our ICFR automation guide.
Do small companies need all 17 principles?
The framework scales. A smaller company can meet a principle with simpler controls, but each principle should still be considered and documented.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error