KnowledgeLeader Blog

    Five Components of the COSO Framework You Need to Know

    Posted by Protiviti KnowledgeLeader on Thu, Mar 12, 2020 @ 08:00 AM

    Screenshot of coso risk assessment image WHAT DOES COSO STAND FOR?

    In 1992, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed a COSO Framework for evaluating internal controls. This model has been adopted as the generally accepted framework for internal control and is widely recognized as the definitive standard against which organizations measure the effectiveness of their systems of internal control. 


    The COSO model defines internal control as “a process effected by an entity’s board of directors, management and other personnel designed to provide reasonable assurance of the achievement of objectives in the following categories:

    • Operational Effectiveness and Efficiency
    • Financial Reporting Reliability
    • Applicable Laws and Regulations Compliance

    In an effective internal control system, the following five components work to support the achievement of an entity’s mission, strategies and related business objectives:

    1. Control Environment
    • Exercise integrity and ethical values.
    • Make a commitment to competence.
    • Use the board of directors and audit committee.
    • Facilitate management’s philosophy and operating style.
    • Create organizational structure.
    • Issue assignment of authority and responsibility.
    • Utilize human resources policies and procedures.
    1. Risk Assessment
    • Create companywide objectives.
    • Incorporate process-level objectives.
    • Perform risk identification and analysis.
    • Manage change.
    1. Control Activities
    • Follow policies and procedures.
    • Improve security (application and network).
    • Conduct application change management.
    • Plan business continuity/backups.
    • Perform outsourcing.
    1. Information and Communication
    • Measure quality of information.
    • Measure effectiveness of communication.
    1. Monitoring
    • Perform ongoing monitoring.
    • Conduct separate evaluations.
    • Report deficiencies.

    These components work to establish the foundation for sound internal control within the company through directed leadership, shared values and a culture that emphasizes accountability for control. The various risks facing the company are identified and assessed routinely at all levels and within all functions in the organization. Control activities and other mechanisms are proactively designed to address and mitigate the significant risks. Information critical to identifying risks and meeting business objectives is communicated through established channels across the company. The entire system of internal control is monitored continuously, and problems are addressed timely.

    KnowledgeLeader offers a number of resources on COSO, including the items listed below. Explore the website for additional knowledge on this topic.

    Entity-Level Controls Risk Assessment Questionnaire
    Entity-Level Controls Fraud Questionnaire
    Entity-Level Controls Environment Questionnaire

    Topics: Enterprise Risk Management, Corporate Governance, COSO, Audit Committee & Board

    Add a Comment:

    About KnowledgeLeader

    KnowledgeLeader, provided by Protiviti, is the premier resource for internal audit and risk management professionals.

    With over 1,400 customizable tools and 1,300 articles by industry experts, we offer the most comprehensive service on the market.

    For more information:

     Tour the Site

    Recent Posts

    Posts by Topic

    see all