The Committee of sponsoring Organizations of the Treadway Commission (COSO) released its internal control framework as principles associated with the five components provide clarity for the user in designing and implemen

COSO is the abbreviation of, The Committee of Sponsoring Organizations of the Treadway Commission (COSO). It is a joint initiative of the five private sector organizations (American Accounting Association, American Institute of CPA, Financial Executives International, The Association of Accountants and Financial Professionals in Business and The Institute of Internal Auditors) and is dedicated to providing thought leadership through the development of frameworks and guidance on enterprise risk management, internal control and fraud deterrence. COSO's Internal Control Framework includes enhancements and clarifications that are intended to ease use and application. One of the more significant enhancements is the formalization of fundamental concepts introduced in the original framework as principles. These principles, associated with the five components, provide clarity for the user in designing and implementing systems of internal control and for understanding requirements for effective internal control. Control environment: The control environment describes a set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. According to the Institute of Internal Auditors (IIA), a control environment is the foundation on which an effective system of internal control is built and operated in an organization that strives to: achieve its strategic objectives, provide reliable financial reporting to internal and external stakeholders, operate its business efficiently and effectively, comply with all applicable laws and regulations, and safeguard its assets. Risk Assessment: The risk assessment forms the basis for determining how risks will be managed. A risk is defined as the possibility that an event will occur and adversely affect the achievement of organizational objectives. Risk assessment requires management to consider the impact of possible changes in the internal and external environment and to potentially take action to manage the impact. Control Activities: Control activities are actions (generally described in policies, procedures, and standards) that help management mitigate risks in order to ensure the achievement of objectives. Control activities may be preventive or detective in nature and may be performed at all levels of the organization. Information: Information is obtained or generated by management from both internal and external sources in order to support internal control components. Communication based on internal and external sources is used to disseminate important information throughout and outside of the organization, as needed to respond to and support meeting requirements and expectations. The internal communication of information throughout an organization also allows senior management to demonstrate to employees that control activities should be taken seriously. Monitoring Activities: Monitoring activities are periodic or ongoing evaluations to verify that each of the five components of internal control, including the controls that affect the principles within each component, are present and functioning. around their products.