COSO Internal Control Framework

The Committee of Sponsoring Organizations of the Treadway Commission first issued the framework in 1992 and updated it in 2013. It describes five components: control environment, risk assessment, control activities, information and communication, and monitoring. Seventeen principles sit under them and say what each component should look like in practice. A system of control counts as effective only when all five components are present and working together. The framework covers three kinds of objective: operations, reporting and compliance. It is often drawn as a cube. It is separate from COSO's ERM framework, which deals with risk in strategy and performance. Listed companies in the US and elsewhere use this framework as the usual yardstick when management assesses internal control over financial reporting, and auditors borrow its language to describe weaknesses. Without a shared yardstick, two auditors can look at the same weak reconciliation and disagree on whether it counts as a deficiency.

A listed packaging company wants to assess its financial reporting controls. Finance maps its controls to the five components and finds the control environment and monitoring sound. Information and communication is weaker: plants send inventory counts by email with no check on completeness. Management records this as a deficiency, names an owner and tests a new reconciliation before year-end.