Rate each of the 17 principles across the five components of internal control. See which components have gaps and which principles are missing or not working consistently. A working aid for management and internal audit, not an opinion on internal control.
The COSO 2013 framework has five components and 17 principles. To say internal control is effective, COSO expects each component and each relevant principle to be present and functioning, and the five components to work together. This tool helps you see where that is and is not true today. Rate what you can evidence, not what you hope is true, and keep the document or test result behind each rating.
COSO's Internal Control — Integrated Framework (2013) organises internal control into five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. The 2013 edition formalised 17 principles under those components: five for the control environment, four for risk assessment, three for control activities, three for information and communication, and two for monitoring.
The framework says an effective system of internal control needs each of the five components and the relevant principles to be present and functioning, and the components to operate together in an integrated way. This tool turns that into a simple rating exercise: for each principle, record whether it is not present, present but not working consistently, or present and functioning.
The result is a gap list, not an opinion. Use it to plan where to test controls, where to improve, and what evidence to collect.
A manufacturing company rates its principles. The board is active and there is a code of conduct, but fraud risk is never formally assessed and nobody reviews user access to the ERP.
