What are the COSO Control Objectives?

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework dates back to 1992, providing an internal control framework for organizations. The COSO Internal Control Framework consists of three compliance disciplines, five internal control components, and 17 principles focused on internal controls.

The COSO Framework cube visually represents how all components interrelate. Internal controls are defined as processes influenced by employees, management, and the board of directors, aiming to provide assurance that objectives are achieved in operations, reporting, and compliance.

COSO Framework Objectives

The COSO framework objectives are divided into three disciplines:

• ​Operations
• ​Reporting
• ​Compliance

The goal of internal control systems is to achieve an organization’s overall business objectives and strategy. Supporting this strategy are the five components of the COSO cube, each supported by specific principles:

1. 1.Control Environment
2. 2.Risk Assessment
3. 3.Control Activities
4. 4.Information and Communication
5. 5.Monitoring Activities

Control Environment

The control environment consists of standards and processes that provide the foundation for implementing internal controls. The board and management determine which controls are most important. A proper control environment outlines ethical values and sets the tone for governance.

Principles:

1. 1.Integrity and Ethical Values: Set the ethical tone of the board and organization.
2. 2.Oversight: Determine the board’s independence, governance, oversight, and responsibilities.
3. 3.Organizational Structure: Outline the overall board authority.
4. 4.Commitment to Competence: Ensure employees are trained, retained, and competent in their roles.
5. 5.Accountability: Reinforce accountability for internal control responsibilities to maximize performance.

Risk Assessment

Organizations use risk assessments to determine the effectiveness of internal controls and acceptable risk levels.

Principles:

1. 1.Specifies Suitable Objectives: Set clear objectives to identify and assess risks.
   • ​Operational objectives: Outline financial reporting requirements.
   • ​Reporting objectives: Determine reporting needs and sustainability.
   • ​Compliance objectives: Follow COSO compliance objectives and consider other regulatory requirements.
2. 2.Identifies and Analyzes Risk: Focus on risks across the entity and analyze them to determine management strategies.
3. 3.Assesses Fraud Risk: Conduct fraud risk assessments considering people, processes, and technology.
4. 4.Identifies and Analyzes Significant Change: Assess internal and external changes that might affect risk.

Control Activities

Control activities establish and enforce risk mitigation through management structure. Activities can be detective or preventive and should be automated when possible. An example is the separation of duties (e.g., separating accounts payable and receivable roles).

Principles:

1. 1.Selection and Development of Control Activities: Focus on mitigating risk.
2. 2.Selection and Development of General Controls Over Technology: Support achievement of objectives through technology controls.
3. 3.Deploy Control Activities Through Policies and Procedures: Establish expectations and put policies into action.

Information and Communication

Information supports the proper function of internal controls. Communication enables the gathering, sharing, and organization of information to support controls. Clear communication is necessary for executing board and management requirements.

Principles:

1. 1.Uses Relevant Information: Support internal controls with quality, relevant, and factual information.
2. 2.Communicates Internally: Board and management communicate objectives and roles to support controls.
3. 3.Communicates Externally: Communicate control status and relevant matters to external parties.

Monitoring Activities

Monitoring ensures internal controls are functioning as intended.

Principles:

1. 1.Conduct Ongoing Evaluations: Perform ongoing or separate evaluations to ensure components are present and functioning.
2. 2.Evaluate and Communicate Deficiencies: Timely messaging and corrective action when deficiencies are found; notify board, management, and control owners.

Implementing the Framework

Implementation of the COSO framework can be broken into five phases:

• ​Phase 1: Planning and Scoping
• ​Phase 2: Assessment and Documentation
• ​Phase 3: Remediation Planning and Implementation
• ​Phase 4: Design, Testing, and Reporting Controls
• ​Phase 5: Optimization of the Effectiveness of Internal Controls

Phase 1: Planning and Scoping

Ensure all stakeholders are aligned before implementation. Outside assistance may be required. Properly scope the application of the COSO framework and understand its components and sub-components.

Phase 2: Assessment and Documentation

Review existing controls, even if they differ from COSO recommendations. Industry regulations may impact this phase. Conduct fraud risk assessments and document all findings.

Phase 3: Remediation Planning and Implementation

Identify gaps and begin remediation, focusing on critical issues. This sets the stage for successful implementation.

Phase 4: Design, Testing, and Reporting Controls

Test controls to ensure effectiveness. Avoid testing everything; select a representative sample from each control group. Ensure testing is organized and repeatable.

Phase 5: Optimization of Effectiveness of Internal Controls

Focus on automation for efficiency. Manual optimization is resource-intensive. Monitoring should be integrated and actively reviewed. Control failures provide opportunities for improvement.