Map your internal controls to COSO 2013 with less manual effort

COSO 2013 is the Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission in May 2013. It defines internal control and organises it into five components (control environment, risk assessment, control activities, information and communication, and monitoring activities) supported by 17 principles. It is the most widely used benchmark for designing and assessing internal control, particularly over financial reporting.

The 17 principles sit under the five components. Principles 1 to 5 cover the control environment, such as integrity, board oversight and competence. Principles 6 to 9 cover risk assessment, including fraud risk and significant change. Principles 10 to 12 cover control activities, including general controls over technology. Principles 13 to 15 cover information and communication, and Principles 16 and 17 cover monitoring and reporting deficiencies.

No. COSO 2013 is a voluntary framework and COSO has no enforcement powers. However, SEC-registered companies must assess internal control over financial reporting under Sarbanes-Oxley Section 404 using a suitable, recognised framework, and the large majority use COSO. In practice it is expected by auditors, investors and regulators for US-listed companies, so many organisations treat it as a de facto requirement.

COSO 2013 is the framework most companies use to meet Sarbanes-Oxley Section 404. Section 404 requires management to report on the effectiveness of internal control over financial reporting, and SEC rules require that assessment to be made against a suitable framework. COSO provides the criteria: management tests whether the five components and 17 principles are present and functioning, and the external auditor attests to that assessment for larger filers.

COSO 2013 is a broad internal control framework focused mainly on reliable reporting, operations and compliance, while ISO 27001 is a certifiable information security standard. SOC 2 is closely linked to COSO: the AICPA Trust Services Criteria include the 17 COSO principles as common criteria. Controls for access, change management and monitoring therefore overlap heavily, so evidence for one can support the others.

No. There is no COSO certification for organisations. Instead, management assesses whether internal control is effective against the framework, and for SEC filers an external auditor may attest to that assessment. Individuals can take COSO training and certificate courses, but that does not certify a company's controls. Any provider claiming to certify your organisation as COSO compliant is describing its own assessment, not an official credential.

It depends on the size of the organisation, how mature existing controls are and whether it is preparing for a first Sarbanes-Oxley assessment. Organisations that already run ISO 27001 or SOC 2 controls usually have much of the IT and monitoring groundwork in place. The bigger effort tends to be documenting entity-level controls, mapping them to the 17 principles and building a testing cycle.

COSO 2013 is mapped in OneClickComply's control library and is available on request, rather than as a live self-serve framework today. When enabled, it uses the same controls and automatically collected evidence as frameworks such as ISO 27001 and SOC 2, so work you have already done counts towards COSO principles. Contact us to discuss your scope and timelines.