COSO Internal Control—Integrated Framework (2013): Components, 17 Principles and Implementation

Who it applies to

• US SEC registrants, for SOX 404 ICFR assessments. The external auditor must use the same framework that management uses (PCAOB AS 2201).
• Private companies, nonprofits and government bodies. The 2013 Executive Summary says the framework applies across entity types and that "a smaller entity's system of internal control may be less formal and less structured, yet still have effective internal control" (COSO Executive Summary).
• Organisations that report on sustainability or adopt AI. They can apply the same framework through COSO's supplemental guidance (COSO; COSO GenAI).

Key requirements

Three objective categories

• Operations: the effectiveness and efficiency of operations, including safeguarding assets.
• Reporting: internal and external, financial and non-financial reporting.
• Compliance: adherence to applicable laws and regulations (COSO Executive Summary).

Five components and 17 principles

Paraphrased from the Executive Summary (COSO Executive Summary):

Control environment

1. Commitment to integrity and ethical values.
2. Board independence from management and oversight of internal control.
3. Structures, reporting lines, authorities and responsibilities.
4. Commitment to attract, develop and retain competent individuals.
5. Holding individuals accountable for their internal control responsibilities.

Risk assessment

1. Specifying objectives clearly enough to identify and assess risks.
2. Identifying and analysing risks across the entity.
3. Considering the potential for fraud.
4. Identifying and assessing significant changes.

Control activities

1. Selecting and developing control activities that mitigate risks.
2. Selecting and developing general control activities over technology. This is the anchor for IT general controls.
3. Deploying controls through policies and procedures.

Information and communication

1. Obtaining or generating relevant, quality information.
2. Communicating internally.
3. Communicating with external parties.

Monitoring activities

1. Ongoing and/or separate evaluations.
2. Evaluating deficiencies and communicating them in a timely way.

Effective internal control and major deficiencies

An effective system requires all five components and relevant principles to be present and functioning, and the components to operate together. When a major deficiency exists, the organisation "cannot conclude that it has met the requirements for an effective system of internal control" (COSO Executive Summary).

For SOX reporting, COSO says management should use the severity criteria set by regulators and standard setters. In practice, these are the SEC and PCAOB definitions of significant deficiency and material weakness (COSO and SOX).

Points of focus

Each principle comes with points of focus, which are important characteristics that help management design controls and assess whether principles are present and functioning. Management can tailor them or add its own (COSO and SOX).

Applying COSO to technology

Principle 11 is where IT teams usually engage with COSO. The SEC's management guidance explains that IT general controls alone "ordinarily do not adequately address financial reporting risks." However, automated controls often depend on effective IT general controls (SEC Release 33-8810).

AS 2201 lists general controls over program changes, access to programs and computer operations as the basis for relying on automated controls over time (PCAOB AS 2201). Map those control families to Principle 11 explicitly, and link them to the process controls they support.

Limitations

COSO recognises that internal control provides reasonable, not absolute, assurance. Limitations include:

• faulty human judgment
• simple errors
• management override
• collusion
• external events (COSO Executive Summary)

Certification process and timeline

There is no organisational COSO certification. Instead, organisations:

1. Adopt the framework formally and document their choice. The 1992 version was superseded after 15 December 2014, and COSO asked entities to disclose which version they used during the transition (COSO and SOX).
2. Map existing controls to the 17 principles. Use the points of focus to identify gaps.
3. Assess the components. Confirm that each principle is present and functioning and that the components work together.
4. Evaluate deficiencies and decide on remediation.
5. Report. For SEC filers, this is the 404(a) management report, plus a 404(b) auditor opinion where required.

The annual cycle follows the reporting calendar. COSO sets no fixed timeline.

Penalties

COSO doesn't impose penalties. Consequences come from the regimes that rely on it. For example, SEC issuers must disclose material weaknesses in ICFR (SEC Release 33-8810), and auditors issue an adverse ICFR opinion when a material weakness exists (PCAOB AS 2201).

Mapping to related frameworks

• SOX 404 and PCAOB AS 2201: COSO is the de facto criteria.
• ISO 27001, SOC 2, NIST CSF: Principle 11 (technology general controls) and Principle 7 (risk assessment) overlap with security control sets.
• COSO ERM: COSO treats it as broader than internal control, and the two are complementary (COSO and SOX).
• Sustainability reporting (ICSR) and GenAI guidance: these apply the same five components (COSO; COSO GenAI).

Readiness checklist

1. Record the framework you've adopted (COSO 2013) in your governance documents.
2. Build a matrix of principles to controls covering all 17 principles.
3. Assess entity-level controls such as tone at the top, board oversight and your code of conduct.
4. Run a fraud risk assessment (Principle 8).
5. Maintain a change-identification process (Principle 9) covering systems, acquisitions and regulation.
6. Document technology general controls (Principle 11).
7. Define your deficiency severity criteria and escalation paths.
8. Schedule ongoing and separate evaluations (Principle 16).
9. Report deficiencies to management and the board on time (Principle 17).

Common pitfalls

• Testing only transaction controls and ignoring control environment principles.
• Treating the points of focus as a mandatory checklist instead of using judgment.
• Missing a principle entirely. COSO's paper notes that organisations under the 1992 framework sometimes missed principles outright (COSO and SOX).
• Overlooking change management at the entity level.
• Ignoring service organisations and new technologies such as RPA and GenAI.

How AssureCore helps

• The Controls Register maps controls to the COSO principles.
• Cross-framework Mapping links COSO to SOX, ISO 27001 and SOC 2.
• Evidence Management keeps your evaluations evidenced.
• The Risk Register supports your risk and fraud assessments.

Frequently asked questions

Official references

• COSO – Internal Control
• COSO – Internal Control—Integrated Framework Executive Summary (2013)
• COSO – The 2013 COSO Framework & SOX Compliance
• COSO – Achieving Effective Internal Control Over Generative AI
• SEC Release 33-8810 – Interpretive guidance for management
• PCAOB – AS 2201

Related frameworks

• PCI DSS guide
• SOX IT guide
• DORA guide
• MAS TRM guide