The COSO Internal Control Framework: The Five Components and 17 Principles with Examples

What is the COSO internal control framework?

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued the updated Internal Control — Integrated Framework in May 2013. It defines internal control as a process effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance about achieving objectives in three categories: ^[1]

• Operations: effectiveness and efficiency of operations, including safeguarding assets against loss.
• Reporting: internal and external, financial and non-financial reporting.
• Compliance: adherence to the laws and regulations to which the entity is subject.

The 2013 update kept the core definition and the five components, but set out the underlying concepts as 17 principles associated with the components. ^[2] COSO considers the original 1992 framework superseded after 15 December 2014. ^{[2, 3]} The framework applies to any entity: public or private, large or small, governmental or not-for-profit. ^[2]

Control environment: the foundation for everything else

The control environment is the set of standards, processes and structures that provide the basis for carrying out internal control, including the tone set at the top. ^[1] Its five principles:

1. Commitment to integrity and ethical values.
2. A board that is independent of management and oversees internal control.
3. Structures, reporting lines and authorities set by management with board oversight.
4. Attracting, developing and retaining competent people.
5. Holding individuals accountable for their internal control responsibilities. ^[1]

In practice: a code of conduct signed by staff, an approved delegation of authority stating who approves purchases and payments and up to what limit, and an audit committee that discusses control reports with management and holds it to account. If senior management itself bypasses procedures “to save time”, no later control will rescue the system.

Risk assessment: from objectives to fraud and change

Risks cannot be assessed until objectives are clear, which is why this component starts there. Its four principles: ^[1]

6. Specifying objectives clearly enough to identify and assess the related risks.
7. Identifying risks across the entity and analysing them to decide how they should be managed.
8. Considering the potential for fraud when assessing risks.
9. Identifying and assessing changes that could significantly affect the system of internal control.

In practice: when moving to a new ERP system (a significant change), the organisation reviews the related risks: migrating supplier master data, user access rights, and manual controls that relied on the old system.

Control activities: policies, procedures and technology controls

Control activities are the policies and procedures that help ensure management’s directives to mitigate risks are carried out. ^[1] Their principles:

10. Selecting and developing control activities that reduce risks to acceptable levels.
11. Selecting and developing general controls over technology.
12. Deploying controls through policies that set out what is expected and procedures that put them into action. ^[1]

Common examples: separating who requests a purchase, who approves it and who pays; matching the purchase order, goods received note and invoice; monthly bank reconciliations; and managing and periodically reviewing system access rights. A good control is linked to a specific risk in the register, not added because it is “usual”.

Information and communication, and monitoring activities

The information and communication component has three principles: obtaining or generating and using relevant, quality information (13); communicating information internally, including objectives and control responsibilities (14); and communicating with external parties on matters affecting internal control (15). ^[1] Examples include a whistleblowing channel staff actually know about, and telling suppliers that the organisation never changes a supplier’s bank details on the strength of an email alone.

Monitoring activities cover ongoing and/or separate evaluations to confirm the components are present and functioning (16), and evaluating and communicating deficiencies in a timely manner to those responsible for corrective action, including senior management and the board (17). ^[1] Ongoing evaluation is part of daily work, such as monthly exception reports; separate evaluation comes from internal audit or self-assessment.

Hypothetical example: a supplier’s bank account change

The procurement team at a hypothetical organisation receives an email that appears to come from an approved supplier, asking for payments to go to a new account. This is how each component deals with the risk:

If the control exists in the procedures but is not actually performed, or is performed but the exception report reaches no one, control is ineffective even though it exists on paper.

When is internal control effective?

The framework requires each component and each relevant principle to be present (existing in design and implementation) and functioning (continuing to operate), and the five components to operate together as an integrated system. Where a major deficiency exists in any component or relevant principle, the organisation cannot conclude that its system is effective. ^[1]

However well designed, internal control provides reasonable, not absolute, assurance. Human judgement can be faulty, simple errors happen, management can override controls, two or more people can collude to circumvent them, and external events can prevent objectives being achieved. ^[1]

Regulatory requirements in the Gulf vary by country and sector. In Saudi Arabia, the Capital Market Authority’s Corporate Governance Regulations require the board of a listed company to approve an internal control system and task the audit committee with examining and reviewing the internal and financial control systems and risk management system. ^[4] Check the regulations in force with the regulator for your country and sector.

COSO continues to publish guidance applying the framework to new areas, including sustainability reporting (2023), robotic process automation (2024) and generative AI (2026). ^[3]

How to start assessing internal control in your organisation

The framework does not prescribe an assessment process, nor does it require each point of focus to be assessed separately. ^[2] The following steps are nevertheless a practical starting point for any organisation:

1. Set the scope: choose one important process, such as purchasing and payments or payroll, rather than assessing the whole organisation at once.
2. Write down objectives and risks: what the process must achieve and what could prevent it, including fraud and recent changes.
3. Link controls to risks: every significant risk has a documented control and a clear owner, and every control has a risk that justifies it.
4. Test operation: ask for evidence from a sample of real transactions, such as approval records and reconciliation reports, not just the written procedure.
5. Evaluate and report deficiencies: rank findings by impact and send the significant ones to whoever has authority to fix them.
6. Follow up remediation: set a date and an owner for each finding, and retest after correction.

After one or two processes you will have a repeatable assessment model, and common patterns will emerge whose source is often the control environment rather than the control itself.

Conclusion

The COSO internal control framework is not a list of controls; it is a way of checking whether an organisation knows its objectives and risks, puts controls in place that are linked to them, and detects and fixes its deficiencies. Use the 17 principles as a self-assessment checklist, and look for evidence that each control actually works, not merely that it appears in the manual.