COSO, the Committee of Sponsoring Organizations, is an advisory group that designs frameworks to help organizations with risk management issues. One of its most popular frameworks is the COSO framework for effective internal control.
The COSO internal control framework was first introduced in 1992; an overhauled, more modern version arrived in 2013. Perhaps the most well-known image of the framework is the famed COSO cube, a three-dimensional diagram showing how the various elements of an internal control system work together.
COSO also unveiled a companion framework for enterprise risk management in 2017, to help organizations assess and prioritize risks and to forge stronger links among risk, strategy, and business performance. The group has also published various issue-specific pieces of guidance along the way, explaining how to apply the ERM framework to subjects such as ESG, artificial intelligence, cloud computing, and the like.
The “sponsoring organizations” behind COSO are five professional associations that support risk management disciplines. They are:
- American Institute of Certified Public Accountants (AICPA)
- The National Association of Accountants, now called the Institute of Management Accountants (IMA)
- American Accounting Association (AAA)
- The Institute of Internal Auditors (IIA)
- Financial Executives International (FEI)
Understanding the COSO framework can bring your organization significant benefits. It provides guidance on internal controls and how organizations should establish controls throughout their environment. A solid system of internal controls provides reasonable assurance that the organization operates ethically, transparently, and aligned with established industry standards.
The COSO framework classifies internal control objectives into three groups: operations, information, and compliance.
Operational objectives include performance measures and safeguarding the organization’s assets against fraud. They focus on the effectiveness and efficiency of business transactions.
Reporting objectives, including internal and external financial reports and non-financial information, refer to the transparency, timeliness, and trustworthiness of the organization’s reporting habits.
Compliance objectives are internal control targets based on adherence to governmental laws and compliance regulations.
What Are the Five Components of COSO Internal Control?
The five components of COSO internal control are risk assessment, control activities, information and communication, control environment, and monitoring activities.
Risk Assessment
All organizations have risks and are exposed to factors that cause them not to reach their objectives. Risk assessments are performed to evaluate internal and external factors. Assessments provide reasonable assurance that organizations are managing risks to an acceptable tolerance.
Control Activities
Control activities are taken to mitigate risk at all levels of the organization. The COSO framework helps to assure that the control activities performed by organization members are effective for the company to achieve its goals and eliminate unnecessary risks.
Information and Communication
The controls provided by COSO help assure that productive communication occurs. This includes using consistent language and following best practices for sharing appropriate levels of information with the right stakeholders. Formal management business reviews and all-employee meetings, as well as informal chats and emails, fall under this component.
Control Environment
The control environment creates a top-down approach to drive the COSO Framework throughout the organization. It consists of a set of standards, processes, and procedures which are overseen and enforced by management. Establishing controls across the environment assures that standard practices and ethical values are used throughout the organization.
Monitoring Activities
Ongoing monitoring and internal audits of all internal control systems identify early signs of trouble and assure effectiveness. Metrics and reports are provided to management and the board of directors for ongoing evaluation. Information gathered and evaluated by regulators and auditors verify control activities. Audits of financial reporting also help with fraud deterrence.
Benefits of Internal Controls
Risk management executives recognize the importance of internal controls when applying these principles to their business environment. The concepts within the COSO internal control framework enhance the performance and sustainability of the organization.
The implementation of effective internal controls and a cohesive framework can bring many benefits, including:
- Alignment of the organization’s IT and data efforts with its governance policies;
- Improvement of the quality, utility, reliability, and comparability of data;
- Deliver decision-making data to internal management, external investors, resource providers, and other interested parties;
- Strengthen the organization’s understanding of its material risks and mitigating opportunities;
- Support transparency and efficiency required for public companies;
- Provide easier access to capital, especially for long-term investors, at a significantly lower cost of capital.
These benefits will be achieved by organizations that align their efforts with their business strategies, because they are focused on the issues that have the most tangible effects. Metrics linked to an effective system of internal controls provide companies and their stakeholders with enterprise intelligence to support decision-making, manage output, and allocate resources.
What Are the Steps for Implementing the COSO Framework?
Here are five steps to implement the COSO Framework and develop an effective system of internal controls.
Understanding and Learning About the Framework
Companies wishing to apply the COSO framework must start by designating a team to study it and be responsible for implementation. The team should start by reading and comprehending the framework’s 17 principles of internal control.
Develop a Plan
The implementation team must develop a road map and project plan. The plan must address the scope of implementation, organizational structure, stakeholders, and timelines.
Assess
The framework’s implementation will vary from company to company, and the internal assessment will identify risks that need to be addressed. The implementation team will define business objectives, investigate the current system of internal controls, and identify the gaps.
To get a complete picture, senior management and entry-level employees alike should be involved. Broad involvement reinforces a robust control environment, and various perspectives will help the team develop effective internal controls.
Remediation
Remediation solutions and internal controls must be developed to address the weaknesses identified during the assessment. Start with the risks that have the highest likelihood and most significant impacts, and work your way down.
Test, Inform, and Optimize
The organization must perform verifications to assure the controls are working as planned. Stakeholders must be informed about the test results and have the opportunity to provide feedback. If particular controls are deemed ineffective, the team must determine how to improve or replace them.
This process is repetitive and goes on continuously. Ongoing evaluations provide early warning signals to alert you to changes in the operating environment.
Manage Your Internal Controls with RiskOptics ROAR
Adopt ROAR‘s compliance, risk management, and governance platform to streamline evidence and audit management for all of your compliance frameworks. Advanced functionality and templates enable you to map control requirements across various frameworks to save time.
Our risk software heat maps illustrate high, low, and medium risk regions within your organization in a user-friendly, color-coded dashboard, allowing you to take action quickly and share the results with your C-suite, senior management, and board of directors.
For more information about how ROAR can improve your compliance processes, schedule a demo today!