The COSO Internal Control Integrated Framework is the most widely used set of criteria in the United States for designing, describing and assessing internal control. It was first issued in 1992 and updated in May 2013. COSO's own page states that the 2013 version superseded the 1992 framework on December 15, 2014.
For a CPA firm, COSO shows up in three places: SOX 404 and ICFR engagements, the auditor's understanding of internal control under AU-C 315, and advisory work where a client wants to know why its controls keep failing. This guide covers the structure, the 17 principles, how they connect to audit standards, and a worked example for a small company.
What COSO defines
COSO defines internal control as a process, effected by an entity's board, management and other personnel, designed to provide reasonable assurance about achieving objectives in three categories:
- Operations: effectiveness and efficiency, including performance goals and safeguarding assets.
- Reporting: internal and external, financial and non-financial.
- Compliance: with laws and regulations that apply to the entity.
"Reasonable assurance" matters. Even a well-designed system cannot guarantee objectives will be met, because of human judgment, collusion and management override. See management override of controls.
The five components and 17 principles
The framework has five components. Under them sit 17 principles that the framework treats as the fundamental concepts of each component.
| Component | Principles |
|---|---|
| Control environment | 1. Commitment to integrity and ethical values. 2. Board independence and oversight of internal control. 3. Structures, reporting lines, authorities and responsibilities. 4. Commitment to attract, develop and retain competent people. 5. Accountability for internal control responsibilities |
| Risk assessment | 6. Specifies suitable objectives. 7. Identifies and analyzes risks. 8. Assesses fraud risk. 9. Identifies and analyzes significant change |
| Control activities | 10. Selects and develops control activities. 11. Selects and develops general controls over technology. 12. Deploys controls through policies and procedures |
| Information and communication | 13. Uses relevant, quality information. 14. Communicates internally. 15. Communicates externally |
| Monitoring activities | 16. Conducts ongoing or separate evaluations. 17. Evaluates and communicates deficiencies |
That is 5 + 4 + 3 + 3 + 2 = 17.
The effectiveness test
The framework's requirement for an effective system of internal control is that each of the five components and the relevant principles are present and functioning, and that the five components operate together. A major deficiency in a component or principle means the entity cannot conclude it has met that requirement. This is why documenting only control activities misses the point: a weak control environment can undermine well-designed reconciliations. See control environment, control activities and monitoring and remediation.
Points of focus
The framework attaches points of focus to each principle. They are implementation guidance, useful for design and assessment, and they are not a checklist that must be completed to conclude on effectiveness. A small entity can meet a principle with fewer or different points than a large one.
How COSO connects to audit standards
- SOX 404 and ICFR audits. Management of an issuer must use a suitable, recognized framework to assess ICFR, and COSO is the default choice in practice. See internal control over financial reporting.
- AU-C 315 (as amended by SAS 145). The auditor obtains an understanding of five components of the entity's system of internal control: the control environment, the entity's risk assessment process, the process to monitor the system of internal control, the information system and communication, and control activities. The structure parallels COSO, though AU-C 315 does not require the entity to use COSO. See SAS 145 risk assessment and AU-C 315.
- Tests of controls. Where the auditor plans to rely on controls, or where substantive procedures alone will not be sufficient, controls are tested. See tests of controls.
- Communicating deficiencies. Under AU-C 265, significant deficiencies and material weaknesses are communicated in writing. COSO's principle 17 is the entity-side counterpart. See control deficiency and material weakness.
COSO in a small entity
Small entities rarely have an audit committee, an internal audit function or written policies for everything. The framework is scalable. A small entity can meet the principles through different, less formal means as long as they are present and functioning.
- Principle 2 (board oversight). A small company without an independent board may rely on an owner who reviews the financial results in detail, or on an outside advisory board. The auditor assesses whether oversight actually occurs.
- Principle 3 (structure and authority). Clear authority limits matter more than an org chart. Who can approve a payment? Who can change vendor bank details?
- Principle 10 (control activities). Segregation of duties may be impractical. Owner review and compensating controls take its place. See segregation of duties and the segregation of duties conflict matrix.
- Principle 16 (monitoring). Owner review of monthly financials compared with budget and prior year is often the primary monitoring control.
Worked example
Illustrative. A 30-person distributor with $14 million of revenue is engaged for its first audit. The owner reviews monthly results. Observations from the walkthrough:
| Observation | Component and principle | Audit consequence |
|---|---|---|
| The owner is the only reviewer of financial results; no board or advisory group | Control environment, principle 2 | Oversight depends on one person; consider management override risk |
| The AR clerk posts invoices, receives mail checks and posts cash receipts | Control activities, principle 10 | No segregation; test the owner's compensating review or increase substantive work on receivables and cash |
| No documented process for closing the books; the bookkeeper makes year-end entries | Control activities, principle 12 | Journal entries need heightened testing |
| Staff turnover in accounting in the last year; no training | Control environment, principle 4 | Raise risk on estimates and cutoff |
| Quarterly bank reconciliations, prepared by the bookkeeper, never reviewed | Monitoring, principle 16 | Reconciliations cannot be relied on as a control; obtain independent reconciliations at year-end |
The auditor takes this into the risk assessment: a weak control environment and limited segregation point to a primarily substantive approach, expanded journal entry testing under AU-C 240, and a written communication of the deficiencies identified. The client's remediation plan would start with the owner-level reconciliation review (principle 16) because it is cheap and addresses several issues.
Building a COSO-based control matrix
- List significant processes (revenue, purchasing, payroll, treasury, close, IT).
- For each, write the risks that financial statement assertions could be misstated.
- Link each risk to controls, noting the owner, frequency and evidence.
- Map controls to components and principles to find components with no coverage.
- Test design and operation, and record deficiencies for evaluation.
The SOX risk and control matrix template follows this layout. Entity-level controls (principles 1 to 9 and 13 to 17) are often missed in matrices that start from transactions. See entity-level controls.
Common mistakes
- Treating COSO as a list of controls instead of a framework of components and principles.
- Concluding "effective" because control activities were tested, with no look at the control environment.
- Treating points of focus as mandatory.
- Applying a large-company control design to a small entity rather than finding compensating controls.
- Mapping controls once and never updating the matrix after a system change.
FAQ
Is COSO required?
For an issuer, management must use a suitable, recognized framework to assess ICFR, and COSO is the usual one. For private companies it is not required, although it is a common reference for design and assessment.
What are the five components of COSO?
Control environment, risk assessment, control activities, information and communication, and monitoring activities.
How many principles does COSO have?
Seventeen, grouped under the five components.
When did the 2013 framework replace the 1992 framework?
COSO states that the 1992 framework was superseded on December 15, 2014.
Does COSO apply to small businesses?
Yes. The framework is scalable, so small entities can meet the principles through simpler and less formal controls, such as owner review.
Sources
- COSO, Internal Control, Integrated Framework (2013) guidance page
- COSO, Internal Control, Integrated Framework (May 2013): five components, 17 principles, points of focus
- AICPA, AU-C section 315 (as amended by SAS No. 145), AU-C section 265, AU-C section 330
- SEC, 17 CFR 240.13a-15 (management's annual report on internal control over financial reporting), eCFR
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error