COSO Internal Control Framework

Why does it matter?

The Framework gives management, boards and auditors one shared test of whether internal control is effective. It names the components, the 17 principles that make them concrete and the point at which a deficiency prevents a conclusion of effectiveness, which is why auditors and public companies use it as their ICFR criteria.

Key benefits include:

• A defined test of effectiveness

Each of the five components and relevant principles must be present and functioning, and the components must operate together. A major deficiency in any of these means the organization cannot conclude that internal control is effective.

• Principles make gaps visible

The 2013 edition turned concepts implicit in 1992 into 17 stated principles, so management can see what is covered and what is missing in its documentation.

• More than financial reporting

Three categories of objectives apply: operations, reporting and compliance. Reporting now includes internal and external reporting and financial and non-financial reporting.

• Fraud and technology are named

Principle 8 requires the organization to consider the potential for fraud when assessing risks, and principle 11 requires general control activities over technology.

• Accepted by auditors

PCAOB standards describe the COSO framework as suitable and available for management's annual assessment, and the audit report templates cite it as an example of control criteria.

How does it work?

The Framework is often drawn as a cube. The three categories of objectives are the columns, the five components are the rows, and the entity's structure (operating units, legal entities and other) is the third dimension. All 17 principles apply to operations, reporting and compliance objectives, and COSO says an entity can achieve effective internal control by applying all of them.

"Present" means a component or principle exists in the design and implementation of the system. "Functioning" means it continues to exist in operation. COSO also lists limitations that prevent absolute assurance: the suitability of objectives, faulty human judgment, human error, management override, collusion and external events. Points of focus support judgment but are not a checklist.

In a SOX 404 assessment, management assesses its controls and the auditor applies PCAOB AS 2201. The auditor uses a top-down approach that starts at the financial statement level and entity-level controls (paragraph .21). If one or more material weaknesses exist, ICFR cannot be considered effective (paragraph .02). A material weakness is a deficiency, or combination, with a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis (Appendix A, .A7).

Key Elements

• Control Environment (principles 1 to 5)

Commitment to integrity and ethical values, board independence and oversight, structures and authorities, commitment to competence, and accountability. The board and senior management set the tone at the top.

• Risk Assessment (principles 6 to 9)

Specifying objectives clearly, identifying and analyzing risks, considering the potential for fraud, and identifying and assessing changes that could significantly affect internal control. Risk is the possibility that an event will occur and adversely affect achievement of objectives.

• Control Activities (principles 10 to 12)

Selecting and developing control activities that mitigate risk to acceptable levels, general controls over technology, and deploying controls through policies and procedures. Segregation of duties is typically built in.

• Information and Communication (principles 13 to 15)

Using relevant, quality information, communicating internally, including objectives and responsibilities for internal control, and communicating with external parties on matters affecting internal control.

• Monitoring Activities (principles 16 and 17)

Ongoing and separate evaluations to ascertain whether the components are present and functioning, and timely evaluation and communication of deficiencies to those responsible for corrective action, including senior management and the board.

What does it cover?

The Framework applies to any entity and at the level of the entity, an operating unit or a function. Its operations, reporting and compliance objectives are broader than financial reporting. For SOX 404, the relevant scope is internal control over financial reporting: management's report under 404(a) in each annual report, and an auditor attestation under 404(b), which does not apply to emerging growth companies or to issuers that are neither large accelerated nor accelerated filers (15 U.S.C. 7262).

What are its objectives?

The Framework sets out what an effective system of internal control requires and gives management a principles-based basis for judgment.

Provide reasonable assurance of achieving operations, reporting and compliance objectives.

Show how the five components and 17 principles must be present and functioning and operate together.

Apply internal control at the entity, operating unit and function levels.

Extend reporting objectives to non-financial and internal reporting.

Support a stronger focus on anti-fraud measures in risk assessment.

Help organizations remove ineffective, redundant or inefficient controls.

Framework in Context

COSO also issued the Internal Control over External Financial Reporting Compendium and the Illustrative Tools for Assessing Effectiveness alongside the Framework, and later guidance on internal control over sustainability reporting (2023), robotic process automation (2024) and generative AI (2026). Its Enterprise Risk Management framework is a separate publication, and neither supersedes the other. The 1992 original has been superseded.

Common Framework Mappings

Organizations map COSO Internal Control to risk, control and assurance frameworks to align control objectives, evidence and testing across audit and compliance programs.

Mapped frameworks include:

COBIT 2019

COSO ERM 2017

ISO 31000:2018

ISO 27001:2022

NIST CSF 2.0

NIST 800-37 Rev.2

SOX

SOC 1