COSO

COSO
Name	Committee of Sponsoring Organizations of the Treadway Commission
Abbreviation	COSO
Formation	1985
Type	Private sector initiative
Purpose	Internal control framework; enterprise risk management
Headquarters	United States

Contents

COSO is a private-sector initiative that developed widely used frameworks for internal control and enterprise risk management. The organization produced reports and frameworks adopted by auditors, corporations, regulators, and standard-setters across United States, International Organization for Standardization, Public Company Accounting Oversight Board, Financial Accounting Standards Board, and Securities and Exchange Commission constituencies. Its frameworks influence practices in Ernst & Young, PricewaterhouseCoopers, KPMG, Deloitte, Bank of America and other major firms.

Overview

The COSO frameworks articulate principles for designing, implementing, and evaluating internal control and risk management systems used by General Electric, Walmart, IBM, JP Morgan Chase, Ford Motor Company, Apple Inc., Microsoft, and other corporations. They link control objectives to operations in contexts like Sarbanes–Oxley Act of 2002, Dodd–Frank Wall Street Reform and Consumer Protection Act, Basel Committee on Banking Supervision, International Financial Reporting Standards, and U.S. Generally Accepted Accounting Principles. Practitioners such as Arthur Andersen-trained auditors, compliance officers from UnitedHealthcare, and consultants from McKinsey & Company and Booz Allen Hamilton use COSO when mapping controls to standards from Committee of Sponsoring Organizations, Institute of Internal Auditors, and regulators including the Inspector General offices.

Founded in 1985 by six sponsoring organizations, the committee responded to corporate scandals and audit failures involving firms like Enron, WorldCom, Tyco International, and Arthur Andersen. The initiative built on governance discussions involving Treadway Commission leaders and linked to reports from entities such as Financial Executives International, American Institute of Certified Public Accountants, Institute of Internal Auditors, Association of Accountants and Financial Professionals in Business, National Association of Corporate Directors, and Securities and Exchange Commission staff. Major updates included the 1992 internal control guidance, the 2004 Enterprise Risk Management framework, and the 2013 revision of the Internal Control—Integrated Framework, reflecting influences from Committee on Capital Markets Regulation, International Organization of Securities Commissions, and responses to legislation like Sarbanes–Oxley Act of 2002.

The Internal Control—Integrated Framework defines components commonly applied by corporations such as ExxonMobil, Citigroup, Goldman Sachs, Procter & Gamble, and Johnson & Johnson. The five components—Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities—are used alongside principles derived from practitioners in PwC, Ernst & Young, KPMG, Deloitte, and academic researchers from Harvard Business School, Stanford Graduate School of Business, Wharton School, London Business School, and INSEAD. The Enterprise Risk Management framework expands concepts through governance roles seen in boards of Boeing, United Airlines, Marriott International, and Target Corporation and aligns with principles expressed by OECD and International Monetary Fund guidance. The frameworks reference reporting channels used by Internal Revenue Service-regulated entities, audit committees chaired by former officials from U.S. Department of Justice and Department of the Treasury, and compliance programs influenced by Federal Trade Commission and Office of the Comptroller of the Currency expectations.

Implementation occurs across sectors—banking institutions supervised by Federal Reserve System and FDIC, insurers like AIG and MetLife, healthcare systems including Mayo Clinic and Kaiser Permanente, and technology firms such as Google and Amazon.com. Audit firms map COSO components to testing procedures used in financial statement audits performed under Public Company Accounting Oversight Board inspections and engage with external auditors from Grant Thornton and BDO International. Risk officers integrate COSO with enterprise risk tools from providers like SAP, Oracle Corporation, and IBM and with compliance frameworks used in HIPAA and Payment Card Industry Data Security Standard contexts. Boards reference COSO when aligning with director duties described in Delaware General Corporation Law and when responding to enforcement actions by U.S. Securities and Exchange Commission and Department of Justice.

Scholars and practitioners at New York University, University of Chicago, Columbia Business School, and Massachusetts Institute of Technology have critiqued COSO for being principles-based in ways that can be subjective for issuers like Enron-era counterparts. Critics from think tanks such as Brookings Institution and Heritage Foundation argue COSO can be difficult to operationalize for small businesses like regional Community Banks and nonprofits reviewed by Charity Navigator and Guidestar. Regulators including Public Company Accounting Oversight Board and academics highlight challenges in demonstrating effectiveness under Sarbanes–Oxley Act of 2002 Section 404 testing and in quantifying residual risk in firms covered by Basel III capital rules. Implementation costs cited by controllers from General Motors and Sprint Corporation have prompted calls for simplified approaches from organizations like Small Business Administration.

COSO frameworks are used alongside standards from International Organization for Standardization (ISO 31000), guidance from the Institute of Internal Auditors (IIA's International Professional Practices Framework), and auditing standards issued by AICPA and PCAOB. They intersect with financial reporting rules from Financial Accounting Standards Board and International Financial Reporting Standards Foundation and with prudential guidance from the Basel Committee on Banking Supervision, European Banking Authority, and Bank for International Settlements. Compliance programs often map COSO to legal regimes including U.S. Foreign Corrupt Practices Act, UK Bribery Act, Health Insurance Portability and Accountability Act, and sectoral frameworks promoted by International Association of Insurance Supervisors.

Category:Risk management