Definition
The COSO framework is the Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission, updated in 2013. It organizes internal control into five components: control environment, risk assessment, control activities, information and communication, and monitoring. Seventeen principles sit under the components.
Why it matters in an audit or review
Management uses COSO as the criteria to assess whether ICFR is effective, and it is the default framework in US practice for SOX 404 work. The five components in AU-C 315 mirror the COSO components, so the auditor's understanding of the entity's system of internal control follows the same structure. Using it also gives a client and its auditor a common vocabulary when discussing deficiencies.
Example
A client is building its first control documentation. The finance lead maps controls to the five components: ethics policy and board oversight under the control environment, a fraud risk assessment under risk assessment, reconciliations and approvals under control activities, monthly close reporting under information and communication, and a quarterly self-review under monitoring.
Common mistakes
Documenting only control activities. A gap in the control environment or monitoring can undermine good activities.
Sources
- COSO, Internal Control, Integrated Framework (2013): five components and 17 principles
- AICPA, AU-C Section 315 (as amended by SAS No. 145), components of the system of internal control
- SEC, 17 CFR 240.13a-15(c) and SEC Release No. 33-8810 (management's evaluation of ICFR using a suitable, recognized framework)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error