The Five Components of COSO Explained
The COSO Internal Control—Integrated Framework is one of the most widely recognized frameworks for designing, implementing, and evaluating internal control.
Originally issued in 1992 and updated in 2013, the Framework provides organizations with a structured approach for achieving objectives related to operations, reporting, and compliance. The COSO Framework is the basis for the current GAO Green Book Standards.
At the center of COSO are five integrated components of internal control:
Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring Activities
Understanding these five components is fundamental for internal auditors, external auditors, compliance professionals, risk managers, management, and anyone responsible for evaluating internal controls.
But the components should not be viewed as five independent boxes on the COSO Cube. They are designed to operate together as an integrated system of internal control.
1. Control Environment: The Foundation
The Control Environment establishes the foundation for the entire internal control system.
It addresses the organization's governance, ethical values, management philosophy, organizational structure, authority, responsibility, accountability, and commitment to competent personnel.
Think of the Control Environment as answering the question:
Does the organization create an environment in which effective internal control is expected and supported?
A company can have hundreds of detailed control procedures and still have a weak internal control system if senior management overrides controls, responsibilities are unclear, employees are not held accountable, or the board provides ineffective oversight.
This is why auditors frequently refer to the "tone at the top."
Examples of Control Environment issues include:
Board and Audit Committee oversight
Management's commitment to integrity and ethical values
Organizational structure
Assignment of authority and responsibility
Employee competence
Performance accountability
Management's attitude toward internal control
Weaknesses at this level can undermine controls throughout the organization.
2. Risk Assessment: What Could Prevent Us from Achieving Our Objectives?
COSO is fundamentally objective-driven and risk-based.
Organizations first need clear objectives. Management then identifies and analyzes risks that could prevent those objectives from being achieved.
The Risk Assessment component addresses this process.
A useful way of thinking about it is:
Objective → Risk → Control
If management does not understand its objectives and risks, it becomes difficult to determine whether the organization has the right controls.
Risk assessment includes identifying and analyzing risks, considering the potential for fraud, and evaluating significant changes that could affect the system of internal control.
Those changes might include:
New technology
Artificial intelligence
Cybersecurity threats
Acquisitions
New regulations
New products
Changes in personnel
Economic conditions
Changes in business processes
Risk assessment therefore should not be treated as a once-a-year compliance exercise.
Risks change. The organization's assessment process needs to change with them.
3. Control Activities: What Are We Doing About the Risk?
Once risks have been identified and evaluated, management needs responses.
Control Activities are the actions established through policies and procedures that help ensure management's directives for addressing risks are carried out.
Examples include:
Approvals
Authorizations
Reconciliations
Segregation of duties
Management reviews
Physical controls
System access controls
Automated application controls
Exception reports
Verification procedures
Control activities may be preventive or detective and may involve manual, automated, or technology-dependent controls.
One common mistake is to equate internal control with control activities.
A reconciliation is a control.
An approval is a control.
A three-way match is a control.
But COSO is much larger than individual control procedures.
An organization can have effective transaction-level controls and still have a deficient overall system if its governance, risk assessment, information flows, or monitoring processes are ineffective.
4. Information and Communication: Getting the Right Information to the Right People
Controls cannot operate effectively without information.
The Information and Communication component addresses how organizations obtain, generate, use, and communicate relevant and quality information.
Information must move:
Up the organization.
Down the organization.
Across the organization.
And when necessary, outside the organization.
For example, employees need information about their internal control responsibilities.
Management needs reliable information about operations and emerging risks. Boards need meaningful information from management. Regulators, investors, customers, vendors, and other external parties may also need appropriate information.
A governance problem can arise when important information exists somewhere inside the organization but never reaches the people responsible for oversight.
The question is therefore not merely: "Does the information exist?"
The better question is: "Does relevant, reliable information reach the right person at the right time so that appropriate action can be taken?"
5. Monitoring Activities: Are the Controls Still Working?
Internal controls do not remain effective automatically.
People change. Systems change. Risks change. Business processes change. Regulations change. Technology changes.
Controls that worked five years ago may no longer address today's risks.
The Monitoring Activities component evaluates whether the components of internal control are present and functioning over time.
Monitoring can include:
Ongoing management supervision
Control self-assessments
Internal audit reviews
Compliance monitoring
Exception reporting
Management reviews
Separate evaluations
External assessments
Corrective-action tracking
Monitoring should also identify deficiencies and ensure they are communicated to individuals who can take corrective action.
Finding a control deficiency is only part of the process.
An effective organization also asks:
Who owns the corrective action?
When will it be completed?
Has the corrective action actually resolved the problem?
The Five Components Must Work Together
This is one of the most important concepts in COSO.
Organizations should not evaluate the five components as independent compliance requirements.
They are interconnected.
Consider a cybersecurity risk.
The Control Environment establishes accountability for cybersecurity.
Risk Assessment identifies cyber threats and evaluates their potential impact.
Control Activities establish access controls, authentication, configuration requirements, backups, and other safeguards.
Information and Communication provide management and the board with relevant cybersecurity information.
Monitoring Activities determine whether those controls continue to operate effectively.
Remove one component and the overall system becomes ineffective.
COSO Goes Beyond SOX Compliance
COSO is frequently associated with Sarbanes-Oxley and internal control over financial reporting, but its application is broader.
The Framework addresses objectives involving:
Operations — effectiveness and efficiency of operations.
Reporting — internal and external financial and nonfinancial reporting.
Compliance — adherence to applicable laws and regulations.
That makes COSO useful well beyond publicly traded companies.
Governmental entities, private businesses, nonprofits, financial institutions, healthcare organizations, educational institutions, and other organizations can use its principles to improve governance, risk management, compliance, and operational performance.
The Five Components Are Supported by 17 Principles
Understanding the five components is only the beginning.
COSO's 2013 Framework establishes 17 principles supporting the five components.
Those principles provide greater detail for evaluating whether each component is present and functioning.
For auditors and management, this provides a much stronger evaluation methodology than simply asking: "Do we have controls?"
The more meaningful question is: "Do we have an effective system of internal control capable of providing reasonable assurance that our objectives will be achieved?"
That is the real purpose of COSO.
Learn COSO with Corporate Compliance Seminars
Corporate Compliance Seminars provides several CPE training programs for professionals who want to move from simply knowing the names of the five COSO components to actually applying the Framework.
Understanding COSO Framework Compliance — 2 CPE
The CCS Understanding COSO Framework Compliance program provides a practical introduction to the COSO Framework, including the five components, principles and points of focus, top-down risk-based assessment, internal-control classifications, control effectiveness, fraud considerations, and SOX compliance.
This program is particularly useful for professionals who need a focused introduction or refresher on COSO.
Effective Use of the COSO Framework — 16 CPE
For professionals who need a deeper understanding, CCS offers Effective Use of the COSO Framework, an intensive two-day program.
The training moves beyond basic definitions and focuses on how organizations can apply the five components and 17 principles to design, evaluate, document, and improve their systems of internal control.
Using the COSO Framework for Compliance and SOX
CCS also offers Using the COSO Framework for Compliance and SOX, designed for auditors, compliance professionals, and others responsible for applying COSO within a compliance and internal-control environment.
The program focuses on practical application of COSO to internal controls, governance, risk management, and SOX compliance.
The objective of COSO training should not be memorizing five component names.
It should be understanding how the components work together to create an effective system of internal control—and how to recognize when that system is failing.
Comments