Internal control, as defined by the COSO framework, has five components that work as an integrated system: the control environment, risk assessment, control activities, information and communication, and monitoring activities. The Committee of Sponsoring Organizations of the Treadway Commission first published the framework in 1992 and updated it in 2013 to reflect changes in business complexity and technology.1COSO. Internal Control – COSO Publicly traded companies must maintain adequate internal accounting controls under federal securities law, and private companies, nonprofits, and government agencies widely use COSO as the standard for building reliable operations and financial reporting.
Control Environment
The control environment is the foundation the other four components rest on. It reflects the organization’s commitment to integrity and ethical behavior, starting with the board of directors and senior leadership. When executives treat compliance as a genuine priority rather than a box-checking exercise, that attitude filters through the organization. When they don’t, no amount of detailed policy compensates.
A strong control environment requires a clear organizational structure where authority and responsibility are well defined. People at every level need to know what they are accountable for and who they report to. Human resources reinforces this by setting standards for hiring, training, evaluating, and compensating employees based on the competencies each role demands. A finance team that lacks the skills to execute controls will produce failed controls regardless of design quality.
Ethical expectations should be spelled out in a code of conduct and reinforced through consistent discipline when violations occur. Selective enforcement quietly tells everyone that the rules are optional.
The board plays a critical role through its audit committee. Federal law requires public companies to disclose whether at least one audit committee member qualifies as a “financial expert,” meaning someone with experience in accounting principles, financial statement preparation or auditing, internal accounting controls, and audit committee functions.2Office of the Law Revision Counsel. 15 U.S. Code 7265 – Disclosure of Audit Committee Financial Expert An independent, financially literate audit committee provides the oversight that keeps management honest.
Risk Assessment
Risk assessment is the process of identifying what could go wrong and figuring out how much it matters. Organizations set objectives across three categories: operational performance, reliable financial reporting, and compliance with laws and regulations. Risk assessment examines what could prevent the organization from hitting those objectives.
Risks come from both inside and outside. Internal risks include IT system failures, turnover in key roles, or gaps in segregation of duties. External risks include economic downturns, new competitors, regulatory changes, and supply chain disruptions. Each identified risk needs to be evaluated for how likely it is and how severe the impact would be.
Inherent Risk Versus Residual Risk
Inherent risk is the exposure that exists before any controls are in place. It represents the natural risk of doing business in a particular area. Residual risk is what remains after controls are implemented. If the residual risk is still too high, management needs to add controls or change the approach.
After analyzing risks, management chooses among four basic responses: avoid the risk by discontinuing the activity, reduce it through additional controls, share it by transferring exposure through insurance or outsourcing, or accept it when the cost of mitigation outweighs the potential impact. This analysis is never finished. Rapid growth, new product lines, acquisitions, and regulatory changes all introduce fresh risks.
Fraud Risk
The 2013 COSO update explicitly requires organizations to consider the potential for fraud when assessing risk. That means evaluating the types of fraud that could occur — fraudulent financial reporting, misappropriation of assets, and corruption — and then examining three factors that tend to be present when fraud happens: incentive or pressure on individuals, opportunity created by weak controls, and attitudes or rationalizations that let people justify dishonest behavior. Organizations also need to consider fraud risks that arise specifically from IT systems and access to sensitive information.
Control Activities
Control activities are the specific policies and procedures that carry out management’s risk responses. They occur at every level and across every function, from transaction processing to financial statement preparation.
Segregation of Duties
The most fundamental control activity is segregation of duties. No single person should be able to initiate a transaction, approve it, record it, and have custody of the resulting asset. Separating those functions means errors or fraud require collusion between multiple people, which dramatically reduces the likelihood of either going undetected. In smaller organizations where full separation isn’t practical, a detailed supervisory review of related activities serves as a compensating control.
Other Key Control Activities
Beyond segregation of duties, control activities include physical safeguards over assets such as restricted access to warehouses and data centers. Performance reviews that compare actual results to budgets or forecasts act as detective controls, catching problems after they occur. Authorization and approval procedures ensure transactions only go through when they meet criteria set by management. Independent reconciliations, such as matching bank statements to the general ledger, catch discrepancies before they compound.
Each control activity should directly address an identified risk. A control that doesn’t map to a specific risk is wasted effort. A risk with no corresponding control is an open exposure.
IT General Controls
Modern financial reporting depends heavily on technology, which makes IT General Controls a critical subset of control activities. They support the reliability of data produced by the systems that generate financial reports and typically fall into four categories: access controls over programs and data (who can log in, what they can see and change), program change management (making sure software changes are tested and approved before going live), program development (controls over building new systems), and computer operations (job scheduling, backup procedures, incident management). Weaknesses in IT General Controls can undermine every application-level control that depends on those systems, which is why auditors test them early in any assessment.
Information and Communication
The other four components can’t function without the right information reaching the right people at the right time. This component addresses how operational, financial, and compliance data flows through the organization.
Internally, employees need to understand their roles in the control system and have access to the information required to carry them out. That happens through policy manuals, training, and open reporting channels. If a frontline employee spots a potential control weakness but has no clear path to report it, the weakness festers.
External communication matters just as much. Public companies must include internal control disclosures in their annual 10-K filings under Item 9A, which covers both disclosure controls and procedures and management’s assessment of internal control over financial reporting.3SEC.gov. Investor Bulletin – How to Read a 10-K Management must state its responsibility for establishing adequate internal controls and provide its assessment of their effectiveness as of the end of the fiscal year.4Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls External communication also covers timely responses to regulatory inquiries and clear information sharing with auditors, customers, and vendors.
Monitoring Activities
Controls degrade over time. People leave, processes change, systems get updated, and workarounds become habits. Monitoring activities continuously assess whether internal controls are still working as designed and catch deficiencies before they cause real damage.
Monitoring takes two forms. Ongoing monitoring is built into normal operations: supervisory reviews, automated exception reports, and system-generated alerts that flag unusual transactions in real time. Separate evaluations are periodic assessments, typically performed by internal audit or outside consultants, that take a deeper look at whether controls are designed properly and operating effectively.
The Internal Audit Function
Internal audit is the primary mechanism for separate evaluations. The function operates under a formal charter approved by the board or audit committee that defines its purpose, authority, scope, and reporting relationships. Internal auditors test specific controls, report their findings to management and the audit committee, and follow up on whether corrective actions are actually taken. Independence from the operations being audited is essential. If internal audit reports to the CFO whose department it evaluates, its objectivity is compromised.
Whistleblower and Reporting Channels
The Sarbanes-Oxley Act requires public companies to establish procedures for employees to submit confidential, anonymous concerns about questionable accounting or auditing practices. These channels feed directly into the monitoring function by surfacing problems that routine testing might miss. The audit committee oversees these procedures, including how complaints are received, retained, and addressed. Monitoring that relies solely on top-down testing without any bottom-up reporting mechanism has a significant blind spot.
Any control deficiency that surfaces through monitoring must be communicated to the appropriate level of management, and significant deficiencies and material weaknesses require escalation to the audit committee.5U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports Prompt reporting gives management the window to fix problems before they result in a material misstatement or regulatory action.
How the Five Components Work Together
The five components aren’t a checklist to complete sequentially. They operate as an integrated system where weakness in any one area compromises the others. A strong control environment without adequate monitoring will eventually deteriorate as people find workarounds. Excellent monitoring can’t save an organization with no meaningful control activities to monitor. Risk assessment that ignores fraud scenarios leaves a gap that no amount of reconciliation will fill.
The 2013 update added 17 supporting principles distributed across the five components.1COSO. Internal Control – COSO Those principles provide more granular guidance on what effective internal control looks like in practice.
Who the Framework Applies To
Public companies face the most rigorous requirements. Section 13(b)(2)(B) of the Securities Exchange Act of 1934 requires them to maintain systems sufficient to ensure that transactions are properly authorized, recorded accurately enough to prepare reliable financial statements, and that recorded assets are periodically compared to what actually exists.6Office of the Law Revision Counsel. 15 U.S. Code 78m – Periodical and Other Reports Sarbanes-Oxley Section 404(a) then requires management to include an assessment of internal controls in the annual report, and Section 404(b) requires the external auditor to attest to that assessment.4Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls Smaller reporting companies with annual revenues below $100 million and non-accelerated filers with a public float below $75 million are generally exempt from the auditor attestation requirement, though management’s own assessment is still required.7eCFR. 17 CFR 240.12b-2 – Definitions
Private companies, nonprofits, and government entities face no federal mandate to follow COSO, but many adopt it voluntarily. The framework’s principles are broad enough to scale down for a mid-sized nonprofit or up for a multinational. Organizations that accept federal funding, seek external financing, or plan an eventual IPO often find that implementing COSO early saves significant cost compared to retrofitting controls under pressure.