COSO Internal Control — Integrated Framework

COSO Internal Control — Integrated Framework
Name	COSO Internal Control — Integrated Framework
Developed by	Committee of Sponsoring Organizations of the Treadway Commission
First published	1992
Revised	2013, 2023
Purpose	framework for designing, implementing, and assessing internal control

Contents

COSO Internal Control — Integrated Framework

The COSO Internal Control — Integrated Framework is a widely adopted framework that guides organizations in establishing, maintaining, and evaluating internal control systems. It is used across private sector Securities and Exchange Commission, Public Company Accounting Oversight Board, Committee of Sponsoring Organizations of the Treadway Commission, Financial Accounting Standards Board, and International Auditing and Assurance Standards Board contexts to support financial reporting, compliance, and operational objectives. Regulators, standard-setters, and audit firms from Big Four firms to national Institute of Internal Auditors chapters reference the framework for governance and risk management practices.

Overview

The framework defines internal control as a process effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives related to operations, reporting, and compliance. Influential organizations such as American Institute of Certified Public Accountants, Financial Industry Regulatory Authority, Federal Reserve System, Office of the Comptroller of the Currency, and European Securities and Markets Authority have referenced or aligned guidance with the framework. Academic institutions like Harvard Business School, Stanford Graduate School of Business, London School of Economics, and Wharton School use the framework in curricula on enterprise risk management and corporate governance.

The framework originated from work commissioned by the Committee of Sponsoring Organizations of the Treadway Commission following corporate failures and accounting scandals of the 1970s and 1980s that involved entities such as Enron Corporation, WorldCom, Tyco International, and Arthur Andersen LLP. Key influences included reports and inquiries by Blue Ribbon Committee (1999), the Treadway Commission, and oversight by regulators like the United States Congress during hearings chaired by members of Senate Committee on Banking, Housing, and Urban Affairs and House Committee on Financial Services. The 1992 release aligned with professional guidance from Financial Accounting Standards Board and practices used by Deloitte, Ernst & Young, KPMG, and PricewaterhouseCoopers.

COSO identifies five interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring activities. The framework informs oversight by boards such as those at ExxonMobil, General Electric, Microsoft Corporation, and Apple Inc., and it interacts with governance guidance from Organisation for Economic Co-operation and Development, International Organization for Standardization, and World Bank. Compliance programs in firms regulated by U.S. Securities and Exchange Commission, Commodity Futures Trading Commission, European Banking Authority, and Financial Conduct Authority often map policies, procedures, and controls to these components.

Each component is supported by underlying principles that translate into objectives: operations objectives, reporting objectives, and compliance objectives. Reporting objectives often relate to standards set by the Financial Accounting Standards Board and disclosure requirements enforced by the Securities and Exchange Commission and international rules like those from the International Accounting Standards Board. The principles guide executives, audit committees, and audit committees’ chairs in firms listed on exchanges such as New York Stock Exchange, NASDAQ, London Stock Exchange, and Tokyo Stock Exchange.

Implementation typically involves risk assessments, control design, documentation, testing, and remediation coordinated by roles such as chief audit executives, chief financial officers, and boards of directors. Professional services firms including McKinsey & Company, Boston Consulting Group, Accenture, and accounting firms provide implementation and audit services for multinational corporations such as Siemens, Volkswagen Group, Toyota Motor Corporation, and Samsung Electronics. The framework is applied in sectors regulated by Health Insurance Portability and Accountability Act, Gramm–Leach–Bliley Act, Dodd–Frank Wall Street Reform and Consumer Protection Act, and industry standards like Payment Card Industry Data Security Standard.

The 2013 update refined definitions, emphasized technology and fraud risk, and clarified requirements for principles-based assessments; the revision was considered by regulators including the Public Company Accounting Oversight Board and referenced in guidance from International Federation of Accountants and Financial Stability Board. The 2023 guidance provided supplemental guidance addressing emerging risks, digital transformation, cybersecurity concerns flagged by National Institute of Standards and Technology, and alignment with enterprise risk management frameworks such as those from the Committee of Sponsoring Organizations of the Treadway Commission’s ERM guidance and standards from ISO/IEC. Implementation updates influenced reporting practices at corporations filing with the Securities and Exchange Commission and guided external auditors from PwC, KPMG, Deloitte, and EY in control evaluations.

Critics point to the framework’s complexity, resource intensity, and challenges in applying principles-based guidance to small and medium-sized entities such as those represented by Small Business Administration advocacy groups. Commentators from Harvard Law School, Yale School of Management, and think tanks like the Brookings Institution have debated the framework’s effectiveness in preventing fraud in high-profile failures like Lehman Brothers and Wirecard. Others note difficulties integrating COSO with cybersecurity standards from National Institute of Standards and Technology, privacy regimes such as General Data Protection Regulation, and financial crime controls under Financial Action Task Force recommendations.

Category:Internal control frameworks