COSO Internal Control — Integrated
Framework (2013)
The COSO Internal Control Framework is a globally accepted model used to design,
implement, and evaluate internal controls in organizations. It helps organizations achieve their
objectives by managing risks and ensuring controls are present, effective, and integrated into
daily operations.
The framework has five interrelated components supported by 17 principles. These
components are not sequential steps — they interact and work together to build a strong internal
control system.
1⃣ Control Environment — The Foundation of Internal
Control
The Control Environment sets the tone at the top of an organization. It establishes the culture
of integrity, ethical values, and accountability — the groundwork on which all other control
activities are built.
Key Elements (Principles)
COSO lists five principles under this component:
1. Commitment to integrity and ethical values
2. Board and audit committee oversight
3. Organizational structure, authority, and responsibility
4. Commitment to competence
5. Accountability for internal control
These principles emphasize that management must lead by example and create an
environment where internal control is a priority.
Class Discussion Points
• The importance of ethics and integrity — if leaders cut corners, controls are weakened.
• How competence and accountability influence staff behavior.
• Role of board/audit committee oversight in reducing risk and ensuring control culture.
• How an environment with unclear responsibilities leads to confusion and control gaps.
Example: A company that publicly rewards ethical behavior and enforces consequences for
policy breaches strengthens its control environment and encourages compliance.
2⃣ Risk Assessment — Identifying What Could Go Wrong
Once the environment is set, organizations must understand the risks that could prevent them
from achieving objectives. Risk Assessment involves identifying internal and external events or
conditions that could impact operations, reporting, or compliance.
Key Activities
• Specify suitable objectives — clear goals make it easier to identify risks.
• Identify and analyze risks — list potential problems that could arise.
• Consider fraud risks — intentional misstatement or theft risks must be evaluated.
• Identify significant changes — such as economic changes, new technology, or
regulations.
Class Discussion Points
• Risk types: strategic, operational, reporting, and compliance.
• Why fraud risk must be part of every risk assessment.
• How risks evolve — new technology, regulations, or processes introduce new
vulnerabilities.
Example: In a retail business, risks might include inventory shrinkage, cyberattacks, supply
chain disruptions, and pricing errors. Risk assessment prioritizes the biggest threats so controls
can be designed appropriately.
3⃣ Control Activities — Doing the Work to Manage Risk
Control Activities are the specific policies, procedures, and actions that ensure management
directives are carried out and risks are mitigated. This is where theory becomes action.
Three Types of Controls
1. Preventive Controls — stop problems before they happen (e.g., segregation of duties,
approvals).
2. Detective Controls — discover problems that have already occurred (e.g.,
reconciliations).
3. Corrective Controls — fix problems once detected (e.g., revising procedures).
Control Activities Examples
• Segregation of duties — one person should not handle everything in a transaction.
• Authorization & approvals — ensure only authorized transactions occur.
• Reconciliations & reviews — review balances and detect differences.
• System access controls — restrict who can change critical data.
Class Discussion Points
• Explain why duties should be separated — reduces fraud and error risk.
• Discuss how IT controls help in modern organizations (passwords, access levels,
backups).
• Show how control activities translate risk assessment into actionable processes.
Example: If risk assessment identifies cash theft risk, control activities might include two-
person custody of cash, daily reconciliation, and periodic surprise counts.
4️⃣ Information & Communication — Ensuring the Right
Data Flows
Information and communication link the control system to the people who need it. This
component ensures that relevant, accurate, and timely information is available and
communicated properly within and outside the organization.
COSO Principles
• Uses relevant information to support control functions.
• Communicates internally — departments and teams understand controls and
responsibilities.
• Communicates externally — stakeholders (e.g., regulators, auditors) receive appropriate
information.
Class Discussion Points
• The role of communication in making sure people know what to do.
• How poor communication can lead to misunderstanding and control breakdowns.
• Why both internal (staff) and external (stakeholders, regulators) communication matter.
Example: A whistleblower system that allows anonymous reporting helps the organization
surface control issues early and reinforces transparency.
5️⃣ Monitoring Activities — Making Sure Controls Work
Over Time
Finally, organizations must ensure that controls continue to operate as intended. Monitoring
involves ongoing evaluations and separate periodic assessments that detect deficiencies and
prompt corrective action.
Two Monitoring Principles
1. Ongoing and/or separate evaluations — continuous checks or periodic reviews of the
control system.
2. Evaluate and communicate deficiencies — issues must be reported to the right level for
action.
Class Discussion Points
• Compare ongoing monitoring (built into daily work) vs separate evaluations (periodic
checkups).
• Discuss the role of internal audit in monitoring controls independently.
• How monitoring leads to improvement and adaptation to change.
Example: Management might review weekly performance dashboards, while internal audit
conducts a quarterly review of key control areas.
⭐ Putting It All Together: How the Components Connect
COSO isn’t a linear checklist — it’s a holistic system:
• The Control Environment sets the culture.
• Risk Assessment identifies what could go wrong.
• Control Activities put policies and procedures in place to handle those risks.
• Information & Communication ensures everyone knows what to do with the data.
• Monitoring checks that everything continues to work and communicates failures.
Think of it like a sport team:
• Culture and leadership = coach and team attitude.
• Risk assessment = scouting opponents and game-planning.
• Control activities = drills and plays.
• Information & communication = play calls and feedback.
• Monitoring = watching game footage and making corrections.
Why This Matters in Operations Auditing
When you audit operations, you are testing whether these five components are present and
functioning. A strong COSO framework means fewer surprises, fewer errors, better risk
management, and more effective operations — exactly what operational auditing seeks to ensure.
Summary for Class
Component What It Means Classroom Example
Control Environment Tone and culture of controls Leadership communicates ethics
Risk Assessment Identify and assess risks Cash handling risk assessment
Control Activities Policies/procedures to manage risks Segregation of duties
Info & Quality info flows Staff informed about control
Communication internally/externally changes
Monitoring Ensuring controls continue to work Regular internal audit checks