COSO Internal Control Framework: CPA Exam Essentials

COSO Internal Control Framework: CPA Exam Essentials

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control-Integrated Framework is one of the most heavily tested topics on the CPA exam's Business Analysis and Reporting (BAR) section. Originally published in 1992 and updated in 2013, this framework provides the standard for designing, implementing, and evaluating the effectiveness of internal control systems. Every CPA candidate must have a thorough understanding of its components and principles.

The Five Components of Internal Control

The COSO framework identifies five interrelated components that must be present and functioning for an internal control system to be effective. These components operate at all levels of the organization and across all business functions.

1. Control Environment

The control environment is the foundation of the entire internal control system. It sets the tone of the organization and influences the control consciousness of its people. The control environment encompasses:

• Integrity and ethical values: The organization demonstrates a commitment to integrity and ethical values through its code of conduct, ethical training programs, and leadership behavior.
• Board oversight: The board of directors or equivalent governance body provides oversight of the development and performance of internal control, independent from management.
• Organizational structure: Management establishes structures, reporting lines, and appropriate authorities and responsibilities in pursuit of objectives.
• Commitment to competence: The organization demonstrates a commitment to attract, develop, and retain competent individuals aligned with its objectives.
• Accountability: The organization holds individuals accountable for their internal control responsibilities in pursuit of objectives.

2. Risk Assessment

Risk assessment involves identifying and analyzing risks to the achievement of objectives, forming a basis for determining how risks should be managed. Key aspects include:

• Objective setting: The organization specifies objectives with sufficient clarity to enable identification and assessment of risks. Objectives span operations, reporting, and compliance categories.
• Risk identification: The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how they should be managed.
• Fraud risk assessment: The organization considers the potential for fraud in assessing risks, including fraudulent reporting, misappropriation of assets, and corruption.
• Change assessment: The organization identifies and assesses changes that could significantly impact the system of internal control, including changes in the external environment, business model, and leadership.

3. Control Activities

Control activities are the actions established through policies and procedures that help ensure management directives to mitigate risks are carried out. These include:

• Authorization controls: Ensuring transactions are approved by appropriate personnel before they are processed.
• Segregation of duties: Dividing responsibilities among different people to reduce the risk of error or fraud. The classic separation involves authorization, custody, and record-keeping functions.
• Physical controls: Safeguarding assets through physical security measures, periodic inventory counts, and reconciliations.
• Information processing controls: Both IT general controls and application controls that ensure the accuracy and completeness of data processing.
• Performance reviews: Management reviews of actual performance against budgets, forecasts, and prior periods to identify unexpected results requiring investigation.

4. Information and Communication

The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. This component has three principles:

• Relevant information: The organization obtains or generates information that is relevant and of sufficient quality to support the functioning of other components of internal control.
• Internal communication: The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of the other components.
• External communication: The organization communicates with external parties regarding matters affecting the functioning of internal control.

5. Monitoring Activities

Monitoring activities assess whether each of the five components of internal control is present and functioning. The two principles under monitoring are:

• Ongoing and separate evaluations: The organization selects, develops, and performs ongoing evaluations (built into business processes) and separate evaluations (periodic assessments) to ascertain whether the components of internal control are present and functioning.
• Communication of deficiencies: The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors.

The Seventeen Principles

The 2013 update to the COSO framework codified seventeen principles that support the five components. Each principle represents a fundamental concept associated with its respective component. For the CPA exam, candidates should understand that all seventeen principles must be present and functioning, and operating together in an integrated manner, for the overall system of internal control to be effective.

Direct vs. Indirect Relationships

An important concept for the CPA exam is understanding that the five components of internal control have both direct and indirect relationships with each other. For example, the control environment directly influences risk assessment, which in turn drives the selection and development of control activities. Information and communication and monitoring activities support all three of the other components.

Applying COSO on the Exam

CPA exam questions often present scenarios describing an organization's internal control system and ask candidates to identify which component or principle is being addressed, or which component has a deficiency. Practice mapping real-world controls to the COSO framework, and remember that a deficiency in one component can have cascading effects on other components and on the overall effectiveness of internal control.