Internal Control Frameworks (COSO)

The COSO Internal Control Integrated Framework is the standard used on the CPA exam for evaluating internal controls. Auditors must understand its components, principles, and how deficiencies are classified and communicated.

COSO Five Components of Internal Control

Component	Description	Key Elements
Control Environment	The foundation; sets the tone of the organization	Integrity and ethical values; board oversight; organizational structure; commitment to competence; accountability
Risk Assessment	Identifying and analyzing risks to achieving objectives	Specifying objectives; identifying risks; assessing fraud risk; identifying significant changes
Control Activities	Actions established through policies and procedures	Segregation of duties; authorization; physical controls; IT general controls; reconciliations
Information & Communication	Relevant information is identified, captured, and communicated	Quality information; internal communication; external communication
Monitoring Activities	Ongoing evaluations to assess whether controls are operating	Ongoing monitoring; separate evaluations; communicating deficiencies

Memory aid (CR-CIMM): Control environment, Risk assessment, Control activities, Information & communication, Monitoring.

The 17 COSO Principles

#	Principle	Component
1	Demonstrates commitment to integrity and ethical values	Control Environment
2	Exercises oversight responsibility	Control Environment
3	Establishes structure, authority, and responsibility	Control Environment
4	Demonstrates commitment to competence	Control Environment
5	Enforces accountability	Control Environment
6	Specifies suitable objectives	Risk Assessment
7	Identifies and analyzes risk	Risk Assessment
8	Assesses fraud risk	Risk Assessment
9	Identifies and analyzes significant change	Risk Assessment
10	Selects and develops control activities	Control Activities
11	Selects and develops general controls over technology	Control Activities
12	Deploys through policies and procedures	Control Activities
13	Uses relevant information	Information & Communication
14	Communicates internally	Information & Communication
15	Communicates externally	Information & Communication
16	Conducts ongoing and/or separate evaluations	Monitoring
17	Evaluates and communicates deficiencies	Monitoring

Internal Control Deficiency Classification

Deficiency Level	Definition	Communication Requirement
Deficiency	A control does not allow management or employees to prevent or detect misstatements on a timely basis	May communicate to management (not required)
Significant Deficiency	A deficiency or combination that is less severe than a material weakness yet important enough to merit attention by those charged with governance	Must communicate in writing to those charged with governance
Material Weakness	A deficiency or combination where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis	Must communicate in writing to management AND those charged with governance

Segregation of Duties (Key Internal Control)

The four functions that must be separated:

Authorization: Approving transactions (management function)
Recording: Maintaining accounting records (accounting/bookkeeping)
Custody: Physical access to assets (warehouse, cashier)
Reconciliation: Comparing records to actual assets (independent verification)

Key rule: No single employee should perform more than one of these functions for the same class of transactions.

IT General Controls (ITGCs)

Access controls: Logical and physical access restrictions to programs and data
Change management: Controls over program changes and system updates
Computer operations: Job scheduling, backup procedures, incident management
Program development: System development lifecycle (SDLC) controls

Deepen your internal controls knowledge with CPA flashcards and practice with AUD mini exams. Sign up free to access all study tools.