Professional Documents
Culture Documents
Internal Control - Integrated Framework: Executive Summary
Internal Control - Integrated Framework: Executive Summary
Executive Summary
May 2013
ISBN 978-1-93735-239-4
2013 All Rights Reserved. No part of this publication may be reproduced, redistributed, transmitted or displayed in
any form or by any means without written permission. For information regarding licensing and reprint permissions please
contact the American Institute of Certified Public Accountants, licensing and permissions agent for COSO copyrighted
materials. Direct all inquiries to [email protected] or to AICPA, Attn: Manager, Rights and Permissions, 220 Leigh
Farm Rd., Durham, NC 27707. Telephone inquiries may be directed to 888-777-7077.
Committee of Sponsoring Organizations of the Treadway Commission
Executive Summary
May 2013
This project was commissioned by COSO, which is dedicated to providing thought lead-
ership through the development of comprehensive frameworks and guidance on internal
control, enterprise risk management, and fraud deterrence designed to improve organi-
zational performance and oversight and to reduce the extent of fraud in organizations.
COSO is a private sector initiative, jointly sponsored and funded by:
Board Members
David L. Landsittel Mark S. Beasley Richard F. Chambers
COSO Chair Douglas F. Prawitt The Institute of Internal Auditors
American Accounting Association
PwCAuthor
Principal Contributors
Miles E.A. Everson Stephen E. Soske Frank J. Martens
Engagement Leader Project Lead Partner Project Lead Director
New York, USA Boston, USA Vancouver, Canada
Members at Large
Jennifer Burns James DeLoach Trent Gazzaway
Deloitte Protiviti Grant Thornton
Partner Managing Director Partner
In the twenty years since the inception of the original framework, business and operat-
ing environments have changed dramatically, becoming increasingly complex, techno-
logically driven, and global. At the same time, stakeholders are more engaged, seeking
greater transparency and accountability for the integrity of systems of internal control
that support business decisions and governance of the organization.
The experienced reader will find much that is familiar in the Framework, which builds
on what has proven useful in the original version. It retains the core definition of internal
control and the five components of internal control. The requirement to consider the
five components to assess the effectiveness of a system of internal control remains
unchanged fundamentally. Also, the Framework continues to emphasize the importance
of management judgment in designing, implementing, and conducting internal control,
and in assessing the effectiveness of a system of internal control.
At the same time, the Framework includes enhancements and clarifications that are
intended to ease use and application. One of the more significant enhancements is the
formalization of fundamental concepts that were introduced in the original framework. In
the updated Framework, these concepts are now principles, which are associated with
the five components, and which provide clarity for the user in designing and implement-
ing systems of internal control and for understanding requirements for effective internal
control.
The Framework has been enhanced by expanding the financial reporting category of
objectives to include other important forms of reporting, such as non-financial and
internal reporting. Also, the Framework reflects considerations of many changes in the
business and operating environments over the past several decades, including:
This Executive Summary, provides a high-level overview intended for the board of
directors, chief executive officer, and other senior management. The Framework and
Appendices publication sets out the Framework, defining internal control, describing
requirements for effective internal control including components and relevant principles,
and providing direction for all levels of management to use in designing, implementing,
and conducting internal control and in assessing its effectiveness. Appendices within
the Framework and Appendices provide additional reference, but are not considered a
part of the Framework. The Illustrative Tools for Assessing Effectiveness of a System of
Internal Control, provides templates and scenarios that may be useful in applying the
Framework.
COSO previously issued Guidance on Monitoring Internal Control Systems to help orga-
nizations understand and apply monitoring activities within a system of internal control.
While this guidance was prepared to assist in applying the original framework, COSO
believes this guidance has similar applicability to the updated Framework.
COSO may, in the future, issue other documents to provide assistance in applying the
Framework. However, neither the Internal Control over External Financial Reporting: A
Compendium of Approaches and Examples, Guidance on Monitoring Internal Control
Systems, nor any other past or future guidance takes precedence over the Framework.
Finally, COSO would like to thank PwC and the Advisory Council for their contribu-
tions in developing the Framework and related documents. Their full consideration of
input provided by many stakeholders and their insight were instrumental in ensuring
that the core strengths of the original framework have been preserved, clarified, and
strengthened.
David L. Landsittel
COSO Chair
An effective system of internal control demands more than rigorous adherence to poli-
cies and procedures: it requires the use of judgment. Management and boards of direc-
tors1 use judgment to determine how much control is enough. Management and other
personnel use judgment every day to select, develop, and deploy controls across the
entity. Management and internal auditors, among other personnel, apply judgment as
they monitor and assess the effectiveness of the system of internal control.
A means to identify and analyze risks, and to develop and manage appropri-
ate responses to risks within acceptable levels and with a greater focus on
anti-fraud measures
1 The Framework uses the term board of directors, which encompasses the governing body, including
board, board of trustees, general partners, owner, or supervisory board.
For external stakeholders of an entity and others that interact with the entity, application
of this Framework provides:
Internal control is not a serial process but a dynamic and integrated process. The
Framework applies to all entities: large, mid-size, small, for-profit and not-for-profit,
and government bodies. However, each organization may choose to implement internal
control differently. For instance, a smaller entitys system of internal control may be less
formal and less structured, yet still have effective internal control.
This definition is intentionally broad. It captures important concepts that are fundamen-
tal to how organizations design, implement, and conduct internal control, providing a
basis for application across organizations that operate in different entity structures,
industries, and geographic regions.
Objectives
The Framework provides for three categories of objectives, which allow organizations to
focus on differing aspects of internal control:
Control Environment
The control environment is the set of standards, processes, and structures that provide
the basis for carrying out internal control across the organization. The board of directors
and senior management establish the tone at the top regarding the importance of inter-
nal control including expected standards of conduct. Management reinforces expecta-
tions at the various levels of the organization. The control environment comprises the
integrity and ethical values of the organization; the parameters enabling the board of
directors to carry out its governance oversight responsibilities; the organizational struc-
ture and assignment of authority and responsibility; the process for attracting, develop-
ing, and retaining competent individuals; and the rigor around performance measures,
incentives, and rewards to drive accountability for performance. The resulting control
environment has a pervasive impact on the overall system of internal control.
Risk Assessment
Every entity faces a variety of risks from external and internal sources. Risk is defined as
the possibility that an event will occur and adversely affect the achievement of objec-
tives. Risk assessment involves a dynamic and iterative process for identifying and
assessing risks to the achievement of objectives. Risks to the achievement of these
objectives from across the entity are considered relative to established risk tolerances.
Thus, risk assessment forms the basis for determining how risks will be managed.
Control Activities
Control activities are the actions established through policies and procedures that help
ensure that managements directives to mitigate risks to the achievement of objectives
are carried out. Control activities are performed at all levels of the entity, at various
stages within business processes, and over the technology environment. They may be
preventive or detective in nature and may encompass a range of manual and automated
activities such as authorizations and approvals, verifications, reconciliations, and busi-
ness performance reviews. Segregation of duties is typically built into the selection and
development of control activities. Where segregation of duties is not practical, manage-
ment selects and develops alternative control activities.
Monitoring Activities
Ongoing evaluations, separate evaluations, or some combination of the two are used
to ascertain whether each of the five components of internal control, including controls
to effect the principles within each component, is present and functioning. Ongoing
evaluations, built into business processes at different levels of the entity, provide timely
information. Separate evaluations, conducted periodically, will vary in scope and fre-
quency depending on assessment of risks, effectiveness of ongoing evaluations, and
other management considerations. Findings are evaluated against criteria established
by regulators, recognized standard-setting bodies or management and the board of
directors, and deficiencies are communicated to management and the board of direc-
tors as appropriate.
Control Environment
1. The organization2 demonstrates a commitment to integrity and ethical values.
5. The organization holds individuals accountable for their internal control responsibili-
ties in the pursuit of objectives.
2 For purposes of the Framework, the term organization is used to collectively capture the board, man-
agement, and other personnel, as reflected in the definition of internal control.
Risk Assessment
6. The organization specifies objectives with sufficient clarity to enable the identifica-
tion and assessment of risks relating to objectives.
8. The organization considers the potential for fraud in assessing risks to the achieve-
ment of objectives.
9. The organization identifies and assesses changes that could significantly impact the
system of internal control.
Control Activities
10. The organization selects and develops control activities that contribute to the miti-
gation of risks to the achievement of objectives to acceptable levels.
11. The organization selects and develops general control activities over technology to
support the achievement of objectives.
12. The organization deploys control activities through policies that establish what is
expected and procedures that put policies into action.
15. The organization communicates with external parties regarding matters affecting
the functioning of internal control.
Monitoring Activities
16. The organization selects, develops, and performs ongoing and/or separate
evaluations to ascertain whether the components of internal control are present
and functioning.
Each of the five components and relevant principles is present and function-
ing. Present refers to the determination that the components and relevant
principles exist in the design and implementation of the system of internal
control to achieve specified objectives. Functioning refers to the determi-
nation that the components and relevant principles continue to exist in the
operations and conduct of the system of internal control to achieve specified
objectives.
When a major deficiency exists with respect to the presence and functioning of a com-
ponent or relevant principle, or with respect to the components operating together in an
integrated manner, the organization cannot conclude that it has met the requirements
for an effective system of internal control.
Achieves effective and efficient operations when external events are consid-
ered unlikely to have a significant impact on the achievement of objectives or
where the organization can reasonably predict the nature and timing of exter-
nal events and mitigate the impact to an acceptable level
Limitations
The Framework recognizes that while internal control provides reasonable assurance
of achieving the entitys objectives, limitations do exist. Internal control cannot prevent
bad judgment or decisions, or external events that can cause an organization to fail to
achieve its operational goals. In other words, even an effective system of internal control
can experience a failure. Limitations may result from the:
Breakdowns that can occur because of human failures such as simple errors
Ability of management to override internal control
Ability of management, other personnel, and/or third parties to circumvent
controls through collusion
These limitations preclude the board and management from having absolute assurance
of the achievement of the entitys objectivesthat is, internal control provides reason-
able but not absolute assurance. Notwithstanding these inherent limitations, manage-
ment should be aware of them when selecting, developing, and deploying controls that
minimize, to the extent practical, these limitations.