COSO stands for Committee of Sponsoring Organizations of the Treadway Commission — the committee that developed the framework (framework) to help companies manage internal control and risk in a structured way.
Effective internal control is the key to successful risk management and corporate governance.
In a dynamic and uncertain business environment, companies are required to focus not only on profitability, but also on their operational sustainability and resilience.
Therefore, internal control and risk management systems must be strategically designed and implemented.
One approach that has been globally recognized in the management Governance, Risk, and Compliance (GRC) is COSO Framework.
COSO (Committee of Sponsoring Organizations of the Treadway Commission) it has become an international standard that helps organizations strengthen internal control structures, proactively manage risk, and improve overall corporate governance.
However, how can companies effectively implement COSO in internal audits? This article will explore COSO implementation strategies Framework in internal audit, as well as how this supports the achievement of the company's objectives in a sustainable way.
What is COSO Framework?
COSO stands for Committee of Sponsoring Organizations of the Treadway Commission. The Framework was first introduced in 1992 and updated in 2013.
The framework was developed in response to corporate failures and financial scandals to provide a structure that can help organizations create a strong internal control system.
What is the main purpose of the COSO Framework?
Main objectives of COSO Framework includes the following:
- Improve the effectiveness of internal control of the company
- Assist organizations in identifying and managing risks
- Ensure compliance with regulations such as SOX (Sarbanes-Oxley Act)
- Support good governance-based decision making
What Are the Main Components of the COSO Framework?
COSO Framework consists of five interrelated components:
- Control Environment (Control Environment) - The foundation of all other components, including integrity, ethical values, management style, and organizational structure.
- Risk Assessment (Risk Assessment) - The process of identifying and analyzing risks relevant to the achievement of organizational goals.
- Control Activities (Control Activities) - Policies and procedures that help ensure management directives are implemented.
- Information and communication (Information and Communication) - Systems that identify, capture and communicate relevant information in a form and time frame that allows people to carry out their responsibilities.
- Monitoring Activity (Monitoring Activities) - Processes that assess the quality of the performance of internal controls over time.
How Are the 17 COSO 2013 Principles Mapped to Real Control Examples?
The guidance referred to here is Internal Control, Integrated Framework (ICIF) 2013 edition. Each component is supported by principles, 17 in total. The table below summarizes those principles in simple language, complete with examples of controls common in companies. A more general discussion is in the article on internal control.
| Components | Principle of | Real control examples |
|---|---|---|
| Control Environment | 1. Commitment to integrity and ethical values | The code of ethics is signed every year, and violations are acted on regardless of position. |
| Control Environment | 2. Oversight by an independent board | An independent audit committee reviews the financial statements and audit findings. |
| Control Environment | 3. Structure, reporting lines, and authority | A written approval authority matrix and job descriptions. |
| Control Environment | 4. Commitment to competence | Job qualification standards, regular training, succession plans. |
| Control Environment | 5. Individual accountability | Performance appraisals include compliance with controls, with sanctions if they are violated. |
| Risk Assessment | 6. Clear and measurable objectives | Operational, reporting, and compliance targets are formulated in writing. |
| Risk Assessment | 7. Risk identification and analysis | A risk register with likelihood and impact assessments. |
| Risk Assessment | 8. Fraud risk assessment | Fraud scenarios, pressures, and opportunities are reviewed in each key process. |
| Risk Assessment | 9. Identification of significant changes | Risks are reassessed when systems change, new regulations arise, or acquisitions occur. |
| Control Activities | 10. Selecting and developing control activities | Tiered approvals, segregation of duties, reconciliations. |
| Control Activities | 11. General controls over technology | Access rights reviews, data backups, system change management. |
| Control Activities | 12. Deployment through policies and procedures | Written SOPs with clear process owners. |
| Information and communication | 13. Relevant, quality information | Reports come from accurate, complete, and timely data. |
| Information and communication | 14. Internal communication | A whistleblowing channel and communication of control objectives to all staff. |
| Information and communication | 15. External communication | Customer and vendor complaint channels, official reporting to regulators. |
| Monitoring Activity | 16. Ongoing and/or separate evaluations | Routine supervisor reviews, periodic internal audits. |
| Monitoring Activity | 17. Evaluating and communicating deficiencies | Weaknesses are reported to the responsible parties on time and follow-up is monitored. |
Important note: if one principle is not operating, the component it falls under is considered not yet functioning. For this reason, auditors test per principle, not only per component.
Exercise: which COSO component does this control belong to?
Answer the following six items by stating the component and principle number. All entities below are fictional and for illustration only.
- The board of directors of PT Contoh Logistik signs the code of ethics every year. Violations by managers and staff receive the same sanctions.
- Every quarter, the finance team of PT Contoh Logistik reviews opportunities for collusion with vendors in the procurement process.
- Vendor payments above Rp100 million must be approved by two different officers in the system before funds are disbursed.
- Internal audit tests the inventory process every semester, then reports the weaknesses found to management and the audit committee.
- Accounting system access rights are reviewed every month, and accounts of departed employees are deactivated immediately.
- Employees can report suspected violations through a dedicated channel that protects the reporter's identity.
Answers and explanations
| Item | Components | Principle of | Explanation |
|---|---|---|---|
| 1 | Control Environment | 1 and 5 | There is a commitment to ethics (principle 1) and the same sanctions for all levels (principle 5). |
| 2 | Risk Assessment | 8 | What is reviewed is the opportunity for fraud, so it falls under fraud risk assessment. |
| 3 | Control Activities | 10 and 12 | Two-party approval is segregation of duties and authorization, implemented through procedures. |
| 4 | Monitoring Activity | 16 and 17 | The semiannual audit is a separate evaluation (16), and reporting weaknesses is principle 17. |
| 5 | Control Activities | 11 | System access control is part of general controls over technology. It is not risk assessment, because what is examined is the control in operation, not the risk. |
| 6 | Information and communication | 14 | The internal reporting channel is part of internal communication. |
If an item has an answer different from yours, first check what is actually being assessed: the objectives and risks (risk assessment), the control being performed (control activities), or the testing of that control (monitoring).
What is the difference between COSO ICIF 2013 and COSO ERM 2017?
Both are COSO publications, but their content differs. COSO ERM 2017 does not replace ICIF, so the two complement each other. A broader discussion of risk is in the article risk management.
| Aspect | COSO ICIF 2013 | COSO ERM 2017 |
|---|---|---|
| Focus | Internal control over operations, reporting, and compliance objectives | Risk management integrated with strategy and performance |
| Number of components | 5 | 5 |
| Component names | Control Environment, Risk Assessment, Control Activities, Information and Communication, Monitoring Activities | Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, Information, Communication, and Reporting |
| Number of principles | 17 | 20 |
| Suitable for | Assessing the design and effectiveness of controls, including in internal audit engagements | Building and evaluating the enterprise risk management process |
Why COSO Framework Relevant to Internal Audit?
Internal Audit plays an important role in evaluating the effectiveness of the company's internal control system and risk management. COSO Framework provide a systematic and measurable structure for evaluating and improving internal controls. By implementing COSO, internal auditors can:
- Identify system weaknesses in a more structured manner.
- Improve efficiency and effectiveness audit.
- Support the achievement of the organization's strategic goals.
- Increase transparency and accountability.
What Are the Challenges in Implementing the COSO Framework?
1. Lack of understanding of framework and its application
It is true that many organizations face difficulties understanding COSO Framework thoroughly. This often happens because:
- The complexity of a framework that includes many components and principles
- Knowledge gap between internal audit team and operational business units
- Difficulty translating theoretical concepts into everyday business practice
- Limited resources for staff competency training and development
2. Difficulties in integrating internal control
The integration of internal control into existing systems and processes is challenging due to the following factors:
- Resistance to change from employees who have become accustomed to the old system
- The complexity of technology and diverse information systems in organizations
- High cost of changing or modifying an existing system
- Challenges in designing controls that do not interfere with operational efficiency
3. Absence of an automatic monitoring system to detect weaknesses
The absence of an automatic monitoring mechanism can cause several things including:
- Delay in identification and response to control failure
- Over-reliance on error-prone manual supervision
- Difficulty in analyzing trends and patterns of control violations real-time
- Challenges in ensuring corrective actions are implemented in a timely manner
4. Difficulties in audit reporting according to COSO standards
Reporting and documentation in accordance with COSO standards is often an obstacle because:
- The need for extensive and detailed documentation
- Complexity in categorizing findings based on COSO components
- Challenges in communicating audit results effectively to management
- Difficulty in tracking follow-up on audit findings
What Are the Additional Challenges in Implementing the COSO Framework?
Besides the four main challenges above, organizations often also face:
- Organizational culture issues: Creating the “tone at the top” and an effective control culture
- Limited resources: Budget and personnel constraints for full implementation
- Rapidly changing business dynamicsDifficulty adapting control frameworks to changing business models or technologies
- Synchronization with other frameworks: The challenge of integrating COSO with other frameworks such as ISO, ITIL, or COBIT
Addressing these challenges requires a structured approach, top management support, adequate allocation of resources, and implementation strategies tailored to the specific needs of the organization.
How Audithink helps COSO implementation Framework?
Audithink is internal audit management software, not a GRC system and not an automated COSO assessment tool. Assessing the effectiveness of controls remains the auditor's job. Audithink helps prepare audit material and monitor its follow-up through six main features:
- Risk assessment: maps high-risk areas as the basis for audit planning.
- Audit planning: prepares audit programs and schedules based on risk priorities.
- Work program templates: standardizes testing procedures across engagements.
- Notifications: reminds auditors and follow-up owners of task deadlines.
- Follow-up monitoring: tracks corrective actions on findings until they are completed.
- Automatic report: prepares audit reports from the data already recorded.
That way, findings on the control environment, risk assessment, control activities, information and communication, and monitoring can be planned, recorded, and followed up in an orderly way.
FAQ About COSO Framework
What does COSO stand for?
COSO stands for Committee of Sponsoring Organizations of the Treadway Commission, the committee that publishes this internal control framework. That name also serves as the name of the framework (COSO Framework).
What is the COSO Framework?
COSO Framework is a framework developed by the Committee of Sponsoring Organizations of the Treadway Commission to help companies manage internal control and risk. The framework was first introduced in 1992 and updated in 2013 in response to corporate failures and financial scandals.
What is the main purpose of the COSO Framework?
Improving the effectiveness of corporate internal control, helping organizations identify and manage risk, ensuring compliance with regulations such as SOX (Sarbanes-Oxley Act), and supporting decision-making based on good governance.
What are the components of the COSO Framework?
Five interrelated components: the control environment (control environment) as the foundation, risk assessment (risk assessment), control activities (control activities), information and communication, and monitoring activities (monitoring activities).
Why is COSO relevant to internal audit?
Because it provides a systematic, measurable structure for evaluating internal control. With COSO, internal auditors can identify system weaknesses in a more structured way, improve audit efficiency, support the organization's strategic goals, and strengthen transparency and accountability.
What are the challenges in applying the COSO Framework?
A lack of understanding of the framework and its application, difficulty integrating internal control into running systems, the absence of automated monitoring systems to detect control weaknesses, and difficulty preparing audit reports to the COSO standard.
What additional challenges often arise?
Organizational culture problems in creating tone at the top, budget and personnel limitations, fast-changing business dynamics making the control framework hard to adapt, and the challenge of aligning COSO with other frameworks such as ISO, ITIL, or COBIT.
Conclusion
Application of COSO Framework internal audit is a strategic step to strengthen the organization's risk management and control system.
By thoroughly understanding and implementing the five components of COSO, companies can improve the effectiveness of internal audits, support the achievement of strategic objectives, and strengthen business competitiveness in the midst of rapidly changing market dynamics.
For internal auditors, COSO is not only an auxiliary tool, but also a comprehensive guide that aligns the audit process with the principles of good governance.
In this era of uncertainty, a framework like COSO is not just an option, but an essential necessity for a company's long-term success.
Learn more about COSO Framework can improve the effectiveness of your company's internal control! Optimize internal audit and risk management with Audithink – Try it now!
