COSO Internal Control Framework

Why the COSO Internal Control Framework Matters for the CRMA

The Certification in Risk Management Assurance (CRMA) tests your ability to provide assurance over governance, risk management and control processes. The COSO Internal Control – Integrated Framework (most recently updated in 2013) is the globally dominant model for designing, implementing and evaluating internal control. It is referenced throughout the IIA's International Professional Practices Framework (IPPF) and Global Internal Audit Standards, it is the de facto benchmark for Sarbanes-Oxley Section 404 compliance in the United States, and it underpins how boards, management, regulators and internal auditors communicate about control. For a CRMA candidate, COSO is not simply one framework among many: it is the shared vocabulary of the risk management governance domain. Questions in the Risk Management Governance section frequently ask you to identify which component a control belongs to, which principle has failed in a scenario, or how an internal auditor should evaluate the effectiveness of a system of internal control. Without a firm grasp of COSO, these questions are nearly impossible to answer reliably.

What the COSO Framework Is

COSO stands for the Committee of Sponsoring Organizations of the Treadway Commission, a joint initiative of five private-sector organisations: the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute of Management Accountants (IMA) and The Institute of Internal Auditors (IIA). COSO first issued the Internal Control – Integrated Framework in 1992 and released a revised version in 2013 that retained the original core definition and five components but added 17 explicit principles and updated the guidance for today's business environment (technology, outsourcing, globalisation and fraud).

COSO defines internal control as: a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.

Every phrase in this definition is examinable:
• A process – internal control is a continuous series of actions, not a single event, document or department.
• Effected by people – it is carried out by the board, management and all other personnel; people at every level are responsible, not just controllers or auditors.
• Reasonable assurance – not absolute assurance. Inherent limitations mean no system of internal control can guarantee success.
• Achievement of objectives – internal control exists to help an organisation reach its goals; it is a means to an end, not an end in itself.
• Three categories of objectives – operations, reporting and compliance.

The COSO Cube: Three Dimensions

COSO depicts the framework as a cube to show the direct relationship between what an organisation is trying to achieve, what is needed to achieve it, and where in the entity controls operate.

1. Objectives (top face of the cube)
• Operations – effectiveness and efficiency of operations, including operational and financial performance goals and safeguarding of assets.
• Reporting – reliability, timeliness and transparency of internal and external, financial and non-financial reporting. The 2013 update deliberately broadened this from financial reporting alone.
• Compliance – adherence to applicable laws and regulations.

2. Components (front face of the cube)
Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities. A popular mnemonic is CRIME (Control environment, Risk assessment, Information and communication, Monitoring, Existing control activities) or simply remembering the order in which COSO lists them.

3. Organisational structure (side face of the cube)
Entity level, division, operating unit and function. Internal control applies at every level of the organisation, and controls at a lower level roll up to support entity-level objectives.

The Five Components and 17 Principles

The 2013 Framework states that each of the 17 principles is fundamental to its component. If a relevant principle is not present and functioning, the related component cannot be present and functioning, and the system of internal control cannot be considered effective. Learn the principles by component.

Component 1: Control Environment – the set of standards, processes and structures that form the foundation for carrying out internal control across the organisation. Often referred to as tone at the top.
• Principle 1 – Demonstrates commitment to integrity and ethical values.
• Principle 2 – The board exercises oversight responsibility, independent of management.
• Principle 3 – Management establishes structures, reporting lines, authorities and responsibilities.
• Principle 4 – Demonstrates commitment to attract, develop and retain competent individuals.
• Principle 5 – Holds individuals accountable for their internal control responsibilities.

Component 2: Risk Assessment – a dynamic and iterative process for identifying and analysing risks to achieving objectives, forming the basis for how risks should be managed.
• Principle 6 – Specifies suitable objectives with sufficient clarity to enable identification of risks.
• Principle 7 – Identifies and analyses risks across the entity as a basis for determining how they should be managed.
• Principle 8 – Considers the potential for fraud in assessing risks.
• Principle 9 – Identifies and assesses changes that could significantly impact the system of internal control (external environment, business model, leadership).

Component 3: Control Activities – actions established through policies and procedures that help ensure management's directives to mitigate risks are carried out. They may be preventive or detective, manual or automated, and include authorisations, approvals, verifications, reconciliations, performance reviews, physical controls and segregation of duties.
• Principle 10 – Selects and develops control activities that contribute to mitigating risks to acceptable levels.
• Principle 11 – Selects and develops general controls over technology.
• Principle 12 – Deploys control activities through policies that establish expectations and procedures that put policies into action.

Component 4: Information and Communication – information is necessary for the entity to carry out internal control responsibilities; communication is the continual, iterative process of providing, sharing and obtaining it.
• Principle 13 – Obtains or generates and uses relevant, quality information.
• Principle 14 – Internally communicates information, including objectives and responsibilities for internal control.
• Principle 15 – Communicates with external parties regarding matters affecting internal control.

Component 5: Monitoring Activities – ongoing evaluations, separate evaluations, or a combination, used to ascertain whether each component is present and functioning.
• Principle 16 – Selects, develops and performs ongoing and/or separate evaluations.
• Principle 17 – Evaluates and communicates internal control deficiencies in a timely manner to those responsible for corrective action, including senior management and the board as appropriate.

Points of Focus
Beneath each principle, COSO provides points of focus – important characteristics of the principle. Unlike principles, points of focus are not mandatory criteria; management uses judgement to decide which are relevant. Exam questions sometimes test this distinction: components and principles are required for effective internal control, points of focus are guidance.

How the Framework Works in Practice

The components do not operate in isolation. COSO describes them as an integrated system in which the control environment sets the foundation, risk assessment identifies what could go wrong in achieving objectives, control activities respond to those risks, information and communication keeps everyone informed, and monitoring determines whether the whole system is working and feeds back improvements. A weakness in one component (for example, poor tone at the top) undermines the others even if they appear strong on paper.

Requirements for an effective system of internal control
COSO states that internal control is effective when it provides reasonable assurance of achieving the entity's objectives. To conclude this, two conditions must be met:
1. Each of the five components and all relevant principles are present (exist in design and implementation) and functioning (continue to operate as designed).
2. The five components operate together in an integrated manner to reduce the risk of not achieving an objective to an acceptable level.

A major deficiency exists when the organisation cannot conclude that a component and relevant principles are present and functioning, or that components operate together. A major deficiency means the system of internal control is not effective. Lesser shortcomings are simply called internal control deficiencies.

Roles and responsibilities
• Board of directors – oversight; sets expectations for integrity and ethics, transparency and accountability.
• Management – owns internal control; the CEO has ultimate responsibility and sets the tone at the top.
• Other personnel – everyone has some role in internal control.
• Internal audit – provides independent, objective assurance on the effectiveness of internal control; evaluates but does not own controls. This links directly to the IIA Three Lines Model, in which internal audit is the third line.
• External parties (external auditors, regulators, customers) – may contribute information but are not part of the entity's system of internal control.

Inherent limitations
Reasonable, not absolute, assurance exists because of: human judgement that can be faulty; simple errors and mistakes; management override of controls; collusion among two or more people to circumvent controls; external events beyond the organisation's control; and the need to consider costs relative to benefits. Exam questions often test which limitation explains a scenario – collusion defeats segregation of duties, override defeats approval controls, and so on.

COSO Internal Control vs COSO ERM
CRMA candidates must distinguish the Internal Control – Integrated Framework (2013) from COSO Enterprise Risk Management – Integrating with Strategy and Performance (2017). Internal control is a subset of ERM. ERM is broader: it addresses strategy setting, risk appetite, portfolio view of risk and performance, and is organised into five components with 20 principles (Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication and Reporting). Internal control focuses on providing reasonable assurance of achieving operations, reporting and compliance objectives through five components and 17 principles. If a question mentions risk appetite, strategy selection or portfolio view, think ERM; if it mentions control activities, segregation of duties or reporting reliability, think Internal Control.

Exam Tips: Answering Questions on COSO Internal Control Framework

Tip 1 – Memorise the five components in order and the 17 principles by component. A large proportion of COSO questions simply ask you to classify an activity. Whistleblower hotline? Control environment (ethics) or information and communication (external communication) depending on wording. Fraud risk consideration? Risk assessment (Principle 8). IT general controls? Control activities (Principle 11). Reporting deficiencies to the board? Monitoring (Principle 17).

Tip 2 – Watch for the word foundation. When a question describes something as the foundation or basis for all other components, the answer is the control environment.

Tip 3 – Know the three objective categories precisely. Safeguarding of assets falls under operations objectives. Reporting now covers internal and external, financial and non-financial reporting. Compliance relates to laws and regulations, not internal policies (adherence to internal policies is an operations matter).

Tip 4 – Distinguish principles from points of focus. Principles are required for effectiveness; points of focus are illustrative and management decides which are relevant.

Tip 5 – Recognise the effectiveness test. If asked when internal control is effective, the answer combines: all components and relevant principles present and functioning, and components operating together in an integrated manner. A major deficiency means not effective.

Tip 6 – Remember reasonable assurance and the limitations. Any option promising absolute assurance, elimination of all risk or guaranteed achievement of objectives is wrong. When a scenario shows controls being defeated, identify whether the cause is override, collusion, human error, cost-benefit or external events.

Tip 7 – Who is responsible? Management, led by the CEO, owns internal control. The board oversees. Internal audit evaluates and provides assurance but does not design, implement or own controls (doing so impairs independence). Options that make internal audit responsible for operating controls are distractors.

Tip 8 – Read the question for level. Entity-level controls (tone at the top, board oversight, enterprise-wide policies) differ from transaction-level controls (reconciliations, approvals). The cube's third dimension reminds you that internal control operates at all levels.

Tip 9 – Separate Internal Control from ERM. If the question mentions strategy, risk appetite or 20 principles, it is COSO ERM. If it mentions 17 principles, three objective categories or control activities, it is COSO Internal Control.

Tip 10 – Apply the internal auditor's perspective. CRMA questions often ask what the internal auditor should do. The best answer usually involves evaluating the design and operating effectiveness of controls against the framework, reporting deficiencies to management and the board, and recommending (not implementing) improvements. Choose answers that preserve independence and objectivity.

Tip 11 – Eliminate extremes. Options containing words like always, never, all or eliminates are usually incorrect in a framework built on judgement and reasonable assurance.

Tip 12 – Use the integration concept. When a scenario shows strong individual controls but a poor ethical culture or weak monitoring, the correct conclusion is that the system may not be effective because the components do not operate together.

Quick Recall Summary
• Issued by COSO; revised 2013; IIA is one of five sponsoring organisations.
• Definition: a process, effected by people, providing reasonable assurance regarding operations, reporting and compliance objectives.
• Cube: 3 objective categories × 5 components × organisational levels.
• 5 components: Control Environment (Principles 1-5), Risk Assessment (6-9), Control Activities (10-12), Information and Communication (13-15), Monitoring Activities (16-17).
• Effective when all components and relevant principles are present and functioning and operate together; a major deficiency means not effective.
• Limitations: judgement, error, override, collusion, external events, cost-benefit.
• Management owns; board oversees; internal audit provides independent assurance.
• Internal control is a subset of ERM; ERM adds strategy, risk appetite and performance.

Master these points, practise classifying real-world controls into components and principles, and approach each scenario by asking which objective is at risk, which component or principle is involved, and what the internal auditor's independent role should be. That disciplined approach will carry you through the COSO questions on the CRMA exam.