COSO's Internal Control: Integrated Framework, released in 2013 and treated as superseding the 1992 version as of December 15, 2014, keeps five components of internal control and adds 17 principles that support them. For effective internal control, each component and each relevant principle must be present and functioning, and the components must operate together. This post lists the principles and turns each into a question and an evidence prompt a small company can answer in an afternoon.
What the framework requires
The framework's three categories of objectives are operations, reporting and compliance, and the financial reporting objective covers both internal and external reporting. "Present" means the component and principles exist in the design and implementation of the system of internal control. "Functioning" means they continue to exist in operation. The framework provides example characteristics for each principle, called points of focus, to help management judge whether a principle is present and functioning. Management judgment in designing, implementing and assessing controls has not changed from the 1992 version. The glossary entries /us/glossary/coso-framework and /us/glossary/points-of-focus cover the terms.
The checklist
Control environment
| # | Principle | Question | Evidence |
|---|---|---|---|
| 1 | The organization demonstrates a commitment to integrity and ethical values | Is there a code of conduct and does leadership act on it? | Signed acknowledgments; disciplinary log |
| 2 | The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control | Does the board or audit committee meet without management and review control matters? | Minutes; private session notes |
| 3 | Management establishes, with board oversight, structures, reporting lines and appropriate authorities and responsibilities in the pursuit of objectives | Are roles and approval limits written down? | Org chart; delegation of authority policy |
| 4 | The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives | Do finance roles have defined qualifications and training? | Job descriptions; training records |
| 5 | The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives | Are control duties in performance reviews? | Review forms; exceptions followed up |
Risk assessment
| # | Principle | Question | Evidence |
|---|---|---|---|
| 6 | The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives | Are financial reporting objectives stated, with materiality? | Planning memo with materiality |
| 7 | The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed | Is there a risk register or RCM? | Risk register; RCM |
| 8 | The organization considers the potential for fraud in assessing risks to the achievement of objectives | Has someone assessed fraud schemes by account? | Fraud risk matrix |
| 9 | The organization identifies and assesses changes that could significantly impact the system of internal control | Is there a process to capture new products, systems, acquisitions or staff turnover? | Change assessment log |
Control activities
| # | Principle | Question | Evidence |
|---|---|---|---|
| 10 | The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels | Does each key risk have a control? | RCM linking risks to controls |
| 11 | The organization selects and develops general control activities over technology to support the achievement of objectives | Are access, change and operations controls in place for systems that matter? | ITGC matrix; access review |
| 12 | The organization deploys control activities through policies that establish what is expected and procedures that put policies into action | Are controls written down, with owners and frequencies? | Policies; procedures |
Information and communication
| # | Principle | Question | Evidence |
|---|---|---|---|
| 13 | The organization obtains or generates and uses relevant, quality information to support the functioning of internal control | Are reports used in controls complete and accurate? | IPE tests |
| 14 | The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control | Do staff know their control duties and how to report problems? | Training; hotline poster |
| 15 | The organization communicates with external parties regarding matters affecting the functioning of internal control | Are there channels with auditors, lenders, regulators and vendors? | Auditor communications; lender reports |
Monitoring activities
| # | Principle | Question | Evidence |
|---|---|---|---|
| 16 | The organization selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning | Is there routine monitoring and periodic testing? | Test plan; results |
| 17 | The organization evaluates and communicates internal control deficiencies in a timely manner to those responsible for taking corrective action, including senior management and the board of directors, as appropriate | Is there a deficiency log and escalation path? | Log; audit committee minutes |
Worked self-assessment: a 60-person company
A company with $45 million of revenue answers the checklist. Results:
- Principles 1, 3, 12 and 14: present and functioning. Code, delegation of authority, written procedures and annual training are in place.
- Principle 2: partially. There is no audit committee; the board meets three times a year and has never met privately with the outside accountants. Action: hold a private session at the next meeting and record it.
- Principle 8: not present. No fraud risk assessment exists. Action: build a matrix. See /us/blog/fraud-risk-assessment-for-icfr-override-and-antifraud-controls.
- Principle 11: partially. User access is reviewed annually but there is no change control over the ERP. Action: add change tickets with approval.
- Principle 13: not documented. Reports used in the allowance and inventory reviews have never been tested. Action: test them. See /us/blog/ipe-and-it-dependent-controls-testing-reports-used-in-key-controls.
- Principle 17: partially. Deficiencies are fixed informally; no log. Action: start a log reviewed quarterly by the CEO and the board chair.
A component with a missing principle is not effective as a whole, by the framework's own condition. The company prioritizes the missing and partial principles by risk, not by their number.
Scaling
In a small company, many controls are performed by owners and managers rather than by documented separate functions. The SEC's interpretive guidance for management recognizes that daily involvement may provide evidence of control operation where operations are centralized and personnel limited. The evidence must still be documented. See /us/blog/smaller-company-icfr-evidence-from-daily-interaction-with-controls.
For the broader framework discussion, see /us/blog/coso-internal-control-framework-guide and /us/blog/control-environment-assessment-guide.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- COSO, Internal Control: Integrated Framework (2013); transition to the 2013 framework (the 1992 framework superseded December 15, 2014): https://www.coso.org/guidance-on-ic
- Journal of Accountancy (AICPA), COSO updates its internal control framework (May 2013): https://www.journalofaccountancy.com/news/2013/may/20137970/
- SEC, Release No. 33-8810, Section II.A.2.b (smaller companies): https://www.sec.gov/rules/interp/2007/33-8810.pdf
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error