The COSO Internal Control Framework: 5 Components and 17 Principles
By SimplyCPA · 11 October 2026
On this page (6)
- What it is: The COSO 2013 Internal Control — Integrated Framework, the framework most US companies use to design and assess internal control.
- Five components: Control environment, risk assessment, control activities, information and communication, and monitoring activities.
- 17 principles: Spread across the five components; all must be present and functioning for internal control to be effective.
- Three objectives: Operations, reporting and compliance.
- Where it's required: SEC rules require management of public companies to assess internal control over financial reporting using a suitable recognised framework — in practice, almost always COSO.
Why COSO matters
Section 404 of the Sarbanes-Oxley Act requires management of US public companies to report on the effectiveness of their internal control over financial reporting (ICFR). The Securities and Exchange Commission (SEC) requires that assessment to use a suitable, recognised control framework. The framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) is the one almost everyone uses — and it's the framework the CPA Exam expects you to know.
The five components
| Component | What it covers | Principles |
|---|---|---|
| Control environment | Integrity and ethical values, board oversight, structure and authority, commitment to competence, accountability — the "tone at the top" | 1–5 |
| Risk assessment | Specifying objectives, identifying and analysing risks, considering fraud risk, assessing significant changes | 6–9 |
| Control activities | Selecting control activities, general controls over technology, deploying through policies and procedures | 10–12 |
| Information and communication | Using relevant, quality information; communicating internally and externally | 13–15 |
| Monitoring activities | Ongoing and separate evaluations; communicating deficiencies | 16–17 |
A popular memory aid is CRIME: Control activities, Risk assessment, Information and communication, Monitoring, and (control) Environment — just remember the official order starts with the control environment.
Effective internal control
Internal control is effective only when all five components and all relevant principles are present (designed and implemented) and functioning (operating as designed), and the components operate together. A major deficiency in one component can't be offset by strength in another.
Examples of control activities
- Authorisation and approval (purchase orders above a limit need a manager's sign-off).
- Segregation of duties — separating authorisation, recording and custody of assets.
- Reconciliations (bank reconciliations reviewed by someone independent of cash).
- Physical controls over assets and IT access controls.
Deficiency levels
- Control deficiency — a control doesn't allow timely prevention or detection of misstatements.
- Significant deficiency — less severe than a material weakness, but important enough to merit the attention of those charged with governance.
- Material weakness — a reasonable possibility that a material misstatement won't be prevented or detected on a timely basis.
Study it alongside understanding the entity and internal control and IT controls in an audit.