Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
COSO: ERM and Internal Control
What internal control means
COSO (the Committee of Sponsoring Organizations of the Treadway Commission) wrote the most widely used definition of internal control: a process, run by the board, management and staff, that gives reasonable assurance that the organisation will achieve its goals in three areas:
- Operations: effective and efficient, including protecting assets
- Reporting: reliable financial and non-financial reporting
- Compliance: following laws and regulations
Notice the word reasonable. People make mistakes, managers can override controls, people can collude, and some controls cost more than they’re worth. No system of control is perfect.
Five components
| Component | What it covers |
|---|---|
| Control environment | Integrity and ethics, board independence and oversight, structure and authority, commitment to competence, accountability. The foundation for everything else. |
| Risk assessment | Setting objectives; identifying and analysing risks, including fraud risk and the effect of changes |
| Control activities | Selecting and building controls, including general controls over technology, carried out through policies and procedures |
| Information and communication | Relevant, good-quality information; communication inside and outside the organisation |
| Monitoring activities | Ongoing and separate evaluations (including internal audit); weaknesses reported and fixed |
The framework has 17 principles spread across these. All five components must be present and working together.
Think of a house again. The control environment is the foundation. You can install the best locks (control activities), but if the foundation is rotten, the whole house is at risk.
Example. A company has well-documented approval limits, but senior managers routinely override them to close deals, and nobody challenges them. Under COSO, the control environment is deficient. The control activities look good on paper, but they can’t be relied on.
Why the exam cares
- The control environment is the foundation. “Most fundamental element of internal control” questions point here, including tone at the top.
- Reasonable assurance, never absolute.
- IT general controls sit under control activities; IT systems also underpin information and communication.
- In the US, COSO is the framework most companies use for Sarbanes-Oxley reporting on internal control over financial reporting.
COSO ERM
COSO ERM (updated in 2017 as Integrating with Strategy and Performance) is a separate framework for managing risk across the whole organisation. Its five components:
- Governance and culture
- Strategy and objective-setting
- Performance
- Review and revision
- Information, communication and reporting
Its big idea is that risk is considered when setting strategy, not only when carrying it out, and is tied to the organisation’s risk appetite.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| The foundation of internal control in COSO | Control environment |
| Component that includes IT general controls | Control activities |
| Level of assurance internal control provides | Reasonable, not absolute |
| Framework used for SOX internal control reporting | COSO Internal Control - Integrated Framework |
| Framework linking risk to strategy and performance | COSO ERM |
In short
- COSO's Internal Control framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities (with 17 principles).
- The control environment (integrity, ethics, tone at the top) is the foundation for everything else.
- Internal control gives reasonable, not absolute, assurance about operations, reporting and compliance.
- IT general controls fall under the control activities component.
- COSO ERM (2017) is a separate framework that links risk to strategy and performance.
- COSO is the framework most US companies use for Sarbanes-Oxley internal control reporting.
Exam traps
- The control environment is the foundation; control activities are just one of five components.
- Internal control gives REASONABLE assurance, never absolute.
- Monitoring in COSO means ongoing and separate evaluations, including internal audit.
- COSO Internal Control and COSO ERM are different frameworks with different purposes.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Five components