What it is
The 2013 COSO framework describes internal control in five components with seventeen principles. An effective system needs each component and each relevant principle to be present and functioning, and the components to work together. This workbook walks through all seventeen.
For each principle you answer whether it is present in design and whether it is functioning, name the evidence and link any deficiency. The component roll-up shows where there is a gap. The prompts are plain-language aids written for this template and are not the framework’s own wording.
When to use it
- When management evaluates ICFR against COSO.
- When internal audit assesses the control environment.
- When a new finance team or a new entity builds its control framework.
What’s inside
- Seventeen principles by component with two prompts each
- Present and functioning answers with evidence and deficiency link
- Component roll-up and an overall indication
Standard cited
This template follows COSO 2013 Internal Control Integrated Framework. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What do present and functioning mean?
Present means the principle is reflected in the design of controls. Functioning means it is operating, shown by evidence over the period. Both are needed for the principle to count as effective.
Does this conclude on ICFR?
No. It shows which principles and components have gaps. The conclusion on ICFR comes from management’s evaluation, including the severity of the deficiencies.
Related templates
- Risk and Control Matrix: Entity-Level Controls
- Control Self-Assessment Questionnaire
- SOX 404 Management Assessment Memo
- ICFR Management Deficiency Aggregation Matrix
Last updated 11/05/2026. All free templates.