The COSO Framework, summarised
November 2003
The internal control framework, published in 1992 by The Committee of Sponsoring Organisations of the Treadway Commission (COSO), has become a recognised standard in the US and other countries that have trading links with the US, for best practice in strong systems of risk management and internal control.
Whilst up to now the framework has concentrated on internal controls, it has very recently been reviewed by the sponsoring organisations and is scheduled to be re-published early in 2004.
This new, extended COSO definition parallels the very first design specifications for Risk Governance where the co-ordination of all these components will ensure maximum effectiveness of a company's risk management process.
The existing framework is not complicated, and seeks to show that internal controls assure:
- That Operations are effective and efficient
- That Financial Reporting is accurate and reliable
- Compliance with laws and regulations
Across 5 interrelated components:
- Control environment
- Risk assessment
- Control activities
- Information and communications
- Ongoing monitoring
The framework looks like this:
Early in 2004, once the new proposals have been accepted, these 5 layers increase to 8 layers by extending the Risk Assessment layer to include:
- Objective setting
- Event identification
- Risk response
The Framework is further explained in an excellent document published by The Institute of Internal Auditors in the US, in which a number of succinct observations are made:
"Risk assessment must be pervasive and diligent. Managers must understand and acknowledge all potential risks and have action plans in place to mitigate them. And internal auditors must play a proactive role in the ERM team."
"Every entity, whether for-profit or not, exists to realize value for its stakeholders. Value is created, preserved, or eroded by management decisions in all activities, from setting the strategy to operating the enterprise on a day-to-day basis. Enterprise Risk Management supports value creation."
Click the following link to see the full Institute of Internal Auditors document:
Full IIA Document |
