COSO Internal Control Framework: 5 Components and 17 Principles [AUD Notes]

COSO internal control is the framework AUD expects you to know cold. In fact, it defines internal control as a process carried out by the board, management, and other personnel to give reasonable assurance that an entity meets its objectives in three categories: operations, reporting, and compliance. In turn, the 2013 COSO framework organizes it into 5 components and 17 principles, and every component must be present and functioning. Finally, see the full CPA hub at CPA Notes.

COSO Internal Control: The Direct Answer in 45 Words

In short, COSO internal control is a process, not a checklist, built on 5 components, Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities, supported by 17 principles. All 5 components and the relevant principles must be present and functioning, and the components must operate together for internal control to be effective under the 2013 COSO framework.

COSO Internal Control Framework: The 5 Components at a Glance

First, COSO, the Committee of Sponsoring Organizations of the Treadway Commission, issued the Integrated Framework in 1992 and refreshed it in 2013, making 17 principles explicit. As a result, the 1992 framework was superseded on December 15, 2014, so AUD uses the 2013 version.

Component	Principles	What it answers
Control Environment	1 to 5	Tone at the top.
Risk Assessment	6 to 9	What could stop objectives being met?
Control Activities	10 to 12	Policies that reduce the risks.
Information and Communication	13 to 15	Information reaches the right people.
Monitoring Activities	16 to 17	Do the controls still work?

COSO Internal Control: Control Environment (Principles 1 to 5)

In short, the control environment is the foundation.

• Principle 1: Commitment to integrity and ethical values.
• Principle 2: Board independence and oversight.
• Principle 3: Structures, reporting lines, authorities, and responsibilities.
• Principle 4: Commitment to competent people.
• Principle 5: Accountability for internal control responsibilities.

COSO Internal Control: Risk Assessment (Principles 6 to 9)

Next, risk assessment identifies and analyzes risks to objectives, then decides how to manage them.

• Principle 6: Specify clear objectives to identify and assess risks.
• Principle 7: Identify and analyze risks across the entity.
• Principle 8: Consider the potential for fraud in assessing risks.
• Principle 9: Identify and assess changes that could significantly affect internal control.

COSO Internal Control: Control Activities (Principles 10 to 12)

Then, control activities put risk responses into action.

• Principle 10: Select control activities that mitigate risks to acceptable levels.
• Principle 11: Select and develop general control activities over technology.
• Principle 12: Deploy control activities through policies and procedures.

COSO Internal Control: Information and Communication (Principles 13 to 15)

Also, information and communication keeps the right information moving to the right people.

• Principle 13: Use relevant, quality information to support internal control.
• Principle 14: Communicate information internally, including objectives and responsibilities.
• Principle 15: Communicate with external parties about internal control matters.

COSO Internal Control: Monitoring Activities (Principles 16 to 17)

Finally, monitoring checks whether the controls still work over time.

• Principle 16: Perform ongoing and/or separate evaluations of internal control.
• Principle 17: Evaluate and communicate deficiencies promptly to those responsible for corrective action.

How AUD Tests COSO Internal Control

First, internal control is central to AUD Area II, Assessing Risk and Developing a Planned Response, at 25 to 35 percent under the AICPA Blueprint effective January 2025. Similarly, Area III, Performing Further Procedures and Obtaining Evidence, carries 30 to 40 percent. In total, AUD is a four-hour exam: 78 multiple-choice questions, 7 task-based simulations, 50/50 scoring, pass 75.

First, the auditor understands internal control design and implementation. For example, a walkthrough traces a transaction. Second, the auditor assesses control risk. Third, the auditor tests controls for reliance. As a result, weak controls mean maximum control risk and substantive procedures.

Finally, the auditor classifies deficiencies. A deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis.

In contrast, a significant deficiency is less severe than a material weakness but still merits attention by those charged with governance. By contrast, a material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis.

Therefore, under AU-C 265, significant deficiencies and material weaknesses must be communicated in writing to management and to those charged with governance. In addition, for public companies, SOX Section 404(a) requires management to assess internal control over financial reporting. However, Section 404(b) adds an auditor attestation, but only for accelerated and large accelerated filers; non-accelerated filers and emerging growth companies are exempt from 404(b). In practice, companies assessing internal control use the COSO 2013 framework, which the SEC accepts as suitable but does not mandate by name.

Scenario 1: COSO Internal Control and Segregation of Duties

Scenario 1: One person does everything in the revenue cycle

For example, Harbor Retail Co. sells goods online. Specifically, one employee, Dana, approves credit, records sales, and handles cash receipts. In fact, no one reviews her work.

Step 1, name the component and principle. First, this is Control Activities, Principle 10, and the control environment, Principle 5. In other words, segregation of duties is missing: Dana authorizes, records, and holds the asset, so one person can take cash without detection.

Step 2, judge the risk and decide the audit response. As a result, the risk is misappropriation of assets and fraudulent reporting, so Principle 8 is also relevant. Therefore, the auditor cannot rely on this control, so control risk for revenue is set high and substantive procedures expand: confirm receivables with customers and test cash receipts to deposits. Finally, a significant deficiency must be communicated in writing to management and to those charged with governance under AU-C 265.

Step 3, state the fix. In short, split the duties: one approves credit, one records sales, one handles cash, and a supervisor reconciles receipts to deposits.

Scenario 2: COSO Internal Control and the Missing Bank Reconciliation

Scenario 2: The bank reconciliation nobody performs

For example, Meridian Services Co. has a materiality threshold of $50,000. In fact, its bank reconciliations have not been prepared for three months, and the difference is $12,000 a month, or $36,000 in total. As a result, no one investigated it.

Step 1, check the arithmetic. In total, three months at $12,000 per month gives $36,000, which is $36,000 divided by $50,000, or 72 percent of materiality.

Step 2, name the component and classify the deficiency. First, this is Control Activities, Principle 10, because the reconciliation is not operating, and Monitoring, Principles 16 and 17, because no one reported the failure. Therefore, a $36,000 difference at 72 percent of materiality, uninvestigated for three months, is more than a plain deficiency. As a result, the auditor should treat it as at least a significant deficiency, communicate it in writing to management and to those charged with governance, and expand cash testing, including a proof of cash.

Step 3, state the fix. First, reconcile every month, have a reviewer who does not handle cash approve it, and investigate every difference promptly.

COSO Internal Control: Exam Traps to Avoid

• Reasonable assurance is not absolute assurance. In fact, controls only reduce risk to an acceptable level. A question that says controls guarantee no misstatement is false.
• Present is not the same as functioning. For example, a control can exist on paper and still fail. All three tests must pass: present, functioning, and operating together.
• Management owns internal control, not the auditor. For example, the auditor obtains an understanding to plan the audit. The auditor does not express an opinion on internal control in a financial statement only audit.
• A significant deficiency is not a material weakness. In fact, they are different severity levels. Look for a reasonable possibility of material misstatement before choosing material weakness.
• Do not confuse COSO internal control with COSO ERM. In short, Internal Control 2013: 5 components, 17 principles. ERM 2017: 5 components, 20 principles.
• Strong transaction controls cannot fix a weak control environment. For example, if the tone at the top is poor, the auditor raises the risk assessment.

One-Page Revision Box: COSO Internal Control

Recall point	Answer
Definition	Process by the board, management, and staff to give reasonable assurance on operations, reporting, and compliance.
Version	2013 framework; 1992 superseded Dec 15, 2014.
Components	5 components, 17 principles; all present and functioning together.
Control Environment	Principles 1 to 5: integrity, board oversight, structure, competence, accountability.
Risk Assessment	Principles 6 to 9: objectives, risk identification, fraud risk, change.
Control Activities	Principles 10 to 12: mitigate risk, technology controls, policies and procedures.
Information and Communication	Principles 13 to 15: quality information, internal and external communication.
Monitoring Activities	Principles 16 to 17: ongoing and separate evaluations, report deficiencies promptly.
AUD weight	Area II 25 to 35 percent; Area III 30 to 40 percent; 78 MCQs, 7 TBSs, pass 75.
Deficiency ladder	Deficiency, significant deficiency, material weakness at reasonable possibility of material misstatement.
Communication	Significant deficiencies and material weaknesses in writing to management and to those charged with governance.
SOX link	SOX 404(a) management assessment for public companies; 404(b) auditor attestation only for accelerated and large accelerated filers; COSO 2013 used in practice, not mandated by name.
Worked numbers	$12,000 times 3 equals $36,000, or 72 percent of $50,000 materiality.

FAQ: COSO Internal Control

What are the 5 components of COSO internal control?

In short, Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities, all present, functioning, and operating together.

How many principles does the COSO internal control framework have?

In total, seventeen: 5 Control Environment, 4 Risk Assessment, 3 Control Activities, 3 Information and Communication, 2 Monitoring Activities. By contrast, the COSO ERM framework has 20 principles instead.

What is the difference between a significant deficiency and a material weakness?

First, a significant deficiency is less severe than a material weakness, yet important enough to merit attention by those charged with governance. In contrast, a material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis. Therefore, both need written communication to management and to those charged with governance under AU-C 265.

Finally, test yourself: name the 5 components, place all 17 principles, and classify one deficiency from each scenario. Then, for the next note, return to the CPA Notes hub.

Sources

COSO, Internal Control, Integrated Framework guidance page, https://www.coso.org/guidance-on-ic

COSO, Internal Control, Integrated Framework Frequently Asked Questions (May 2013), https://www.coso.org/_files/ugd/3059fc_8fdac5b8011e4cd08d566bf40b1ac2a8.pdf

AICPA, Uniform CPA Examination Blueprints, effective January 2025 (approved September 12, 2024), https://www.aicpa-cima.com/resources/download/learn-what-is-tested-on-the-cpa-exam

15 U.S. Code 7262, Management Assessment of Internal Controls (Sarbanes-Oxley Act Section 404), as summarized at https://legalclarity.org/section-404-requirements-under-the-sarbanes-oxley-act/

AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit, deficiency definitions as quoted in Wiley Practitioner Guide to GAAS, https://www.oreilly.com/library/view/wiley-practitioners-guide/9781119396482/c08.xhtml