Five Components of Internal Controls (COSO Framework)

The five components of an internal control system were developed by COSO, a private-sector organization founded in 1985 to study factors leading to fraudulent financial reporting. In 1992, COSO released the Internal Control–Integrated Framework, updated in 2013, offering guidance on designing, implementing, and assessing internal control.

While more extensive, the initial five-element framework remains relevant to fraud. This post summarizes the five internal control components of COSO.

What Is the Importance of Internal Controls?

The COSO framework is structured around five key components:

• ​Control Environment
• ​Risk Assessment
• ​Control Activities
• ​Information and Communication
• ​Monitoring

Each element is further broken down into 17 principles that describe implementation considerations and how these controls should work in practice.

COSO is among the widely adopted frameworks, but its official guidance is general, and companies that adopt it have varying interpretations and tailor components to their specific business processes, systems, and risks.

This blogpost will be helpful if you are:

• ​Designing or updating an internal control framework for compliance (SOX, SOC 1/2, ISO 27001, etc.)
• ​Preparing for an audit and needing to document or evidence how each COSO component is met
• ​Implementing risk management initiatives where controls must be mapped to specific risks, business processes, or technology systems
• ​Running control testing and remediation to identify gaps and determine corrective actions
• ​Building training and onboarding for compliance, finance, or risk teams

What Are Internal Controls?

Internal controls serve as safeguards, operating at different levels within an organization to provide multiple layers of protection, enhance operational effectiveness, ensure reliable financial reporting, and promote adherence to laws and regulations.

The purpose of the COSO framework’s five components is to provide a standardized common language and structure for an organization to design and evaluate controls. Internal controls should be a comprehensive framework built on interconnected components that work together at all levels of the organization.

Five Components of Internal Controls

Control Environment

This component provides the basis of how internal controls should be implemented and functioning. It sets the tone at the top of an organization, encompassing ethical values, integrity, competence, management philosophy, and the board of directors’ independent oversight. It provides governance structures, management’s operating style, and how authority and responsibility are assigned and executed.

COSO Principles 1-5: Control Environment

• ​Commitment to integrity and ethical values: Establish ethical values and communicate them through policies, training, and leadership by example.
• ​Independent board oversight: An independent board of directors oversees management decisions and ensures the effectiveness of internal controls.
• ​Establish structure, authority, and responsibility: Management establishes a clear organizational structure with reporting lines and assigns appropriate authorities and responsibilities.
• ​Commitment to competence: Organizations should hire, develop, and retain competent individuals.
• ​Accountability for control responsibility: Establish clear accountability, performance measures, incentive programs, and disciplinary action when necessary.

Culture Factors

• ​Integrity and ethical values: Honest communication, transparent reporting, code of conduct, conflict of interest policies, and mechanisms for reporting unethical behavior.
• ​Commitment to competence: Attract, develop, and retain competent individuals.
• ​Organizational structure: Clearly defined hierarchy of authority and responsibility.
• ​Board oversight: Strong, independent oversight from the board, especially the audit committee.

Top-Down vs Bottom-Up Influence

• ​Top-down: Senior management and board set the tone and drive compliance culture.
• ​Bottom-up: Employee actions and feedback shape the effectiveness of internal controls.

Implementation Checklist

• ​Define and document ethical values and code of conduct
• ​Ensure active oversight from the board and audit committee
• ​Clearly define organization structure, assign authority and responsibilities
• ​Communicate internal control responsibilities and expectations
• ​Provide regular training and competency development
• ​Establish performance measures, incentive programs, and disciplinary measures
• ​Conduct periodic reviews of the control environment

Common Pitfalls

• ​Inconsistent messaging or behavior from leadership
• ​Poorly defined or outdated organizational structure
• ​Lack of independent board or audit committee oversight
• ​Neglecting employee feedback
• ​Weak enforcement of accountability
• ​Lack of regular assessments or continuous monitoring

Risk Assessment

Risk assessment involves identifying, analyzing, and managing relevant risks to achieve business objectives. It includes setting clear and measurable goals, identifying internal and external risks, analyzing likelihood and impact, and defining mitigation strategies.

COSO Principles 6-9: Risk Assessment

• ​Specific objectives: Objectives must be clear and measurable, with defined risk tolerance and success metrics.
• ​Risk identification and analysis: Comprehensive risk identification across all levels and functions.
• ​Fraud risk assessment: Evaluate fraud risk explicitly, covering financial reporting fraud, asset misappropriation, or corruption.
• ​Anticipation of significant change: Establish processes to identify and respond to significant changes (acquisitions, new technology, etc.).

Continuous Identification and Analysis

Risk assessment is ongoing, adapting to evolving business environments. Risks can emerge from internal operations, external market forces, regulatory changes, or technological advancements.

Objective Categories

• ​Operations Risks: Affect efficiency, performance, and profitability.
• ​Reporting Risks: Affect reliability, accuracy, and timeliness of reporting.
• ​Compliance Risks: Risks of non-compliance with laws, regulations, standards, and policies.

Adapting Controls to Change

Organizations must ensure controls are responsive to emerging threats and regularly updated. Change management processes must integrate risk assessment.

Audit Reports and Board Engagement

Internal and external audits assess risk management and control effectiveness. Audit findings guide management in refining controls, while board oversight ensures transparency and accountability.

Control Activities

Control activities are the actions established by policies and procedures to ensure management directives to mitigate risks are carried out. They occur at all levels and stages within business processes and over the technology environment.

COSO Principles 10-12: Control Activities

• ​Select and develop control activities: Design activities that address identified risks and support objectives.
• ​Select and develop general controls over technology: Implement controls for technology infrastructure (system access, change management, backup, business continuity, data privacy, cyber protection).
• ​Deploy control activities through policies and procedures: Implement with clear policies and detailed procedures, specifying execution, responsibility, and monitoring.

Policies, Procedures, and Segregation of Duties

• ​Policies: Principles and standards governing behavior and decision-making.
• ​Procedures: Specific actionable steps, responsibilities, timing, documentation, and expectations.
• ​Segregation of duties: Prevents a single individual from controlling all phases of a transaction, reducing fraud and enforcing accountability.

Types of Activities

• ​Approvals and authorizations: Formal decision-making processes with defined approval limits.
• ​Verifications: Independent confirmation of accuracy and completeness.
• ​Reconciliation: Comparison between data sources to resolve discrepancies.
• ​Security controls: Restrict access to assets, information, and systems (access controls, firewalls, encryption, antivirus).

Preventive vs. Detective Controls

• ​Preventive controls: Stop errors or unauthorized activities before they occur (access controls, password policies).
• ​Detective controls: Identify problems after they occur (log monitoring, audit trails, inventory counts).

Automation, Testing Cadence, and Inventory Audits

• ​Automated solutions reduce human error and increase consistency.
• ​Control activities are tested with various scenarios and at defined frequencies (quarterly, semiannually, annually).
• ​Regular inventory checks and physical verification help detect discrepancies, theft, or misappropriation.

Information & Communication

Information is necessary for carrying out internal control responsibilities. Communication occurs both internally and externally, providing the information needed for day-to-day controls and enabling personnel to understand their responsibilities.

COSO Principles 13-15: Information & Communication

• ​Use Quality Data: Identify, capture, and use relevant, accurate, and complete data.
• ​Internal communication: Information should flow in all directions across all levels.
• ​External communication: Communicate quality data with external parties (customers, suppliers, regulators, investors, partners).

Quality Information: Capture, Format, and Timeliness

• ​Data must be accurate, complete, relevant, and timely.
• ​Information must be captured from reliable sources and structured for the relevant audience.
• ​Timely delivery supports decision-making and risk response.

Internal Flows

• ​Downward: Management to operational levels (strategic direction, policies, procedures).
• ​Upward: Operational levels to management (performance results, issues, opportunities).
• ​Lateral: Across departments and functions (coordination and collaboration).

External Communication

• ​Meet regulatory requirements, maintain stakeholder relationships, and gather information about external changes.
• ​Includes audit disclosures, compliance updates, contract terms, SLAs, and customer communications.

Escalation Protocols

• ​Minor lapses: Managed by department heads or control owners, tracked and resolved with routine actions.
• ​Major lapses: Escalated to senior leadership, audit committee, or compliance officer; may trigger incident response plans and external notifications.

Monitoring

Monitoring is the process of continuously evaluating the effectiveness of internal controls over time. It includes ongoing and separate evaluation activities to detect and address control deficiencies.

Purpose of Ongoing and Separate Evaluations

• ​Ongoing evaluation: Continuous feedback through activities embedded in business operations (supervisory reviews, system alerts, dashboard metrics).
• ​Separate evaluation: Independent assessment by teams not involved in day-to-day operations (internal audits, control self-assessments, penetration testing).

Detecting Deficiencies and Timely Remediation

• ​Identify deficiencies through audits, performance reviews, exception reports, and user feedback.
• ​Categorize and implement remediation plans with clear ownership, procedures, resources, and timelines.
• ​Retest controls and update policies after remediation.