COSO Framework’s 17 Principles of Effective Internal Control

Earlier this year, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) updated its Internal Control — Integrated Framework. The updated principles-based framework, which supersedes the original 1992 framework, now explicitly describes its principles rather than simply implying them, thus making it easier for companies to apply the principles. The revised COSO framework’s 17 principles of effective internal control are as follows:

Internal Control Component	Principles
Control environment	Demonstrate commitment to integrity and ethical values Ensure that board exercises oversight responsibility Establish structures, reporting lines, authorities and responsibilities Demonstrate commitment to a competent workforce Hold people accountable
Risk assessment	Specify appropriate objectives Identify and analyze risks Evaluate fraud risks Identify and analyze changes that could significantly affect internal controls
Control activities	Select and develop control activities that mitigate risks Select and develop technology controls Deploy control activities through policies and procedures
Information and communication	Use relevant, quality information to support the internal control function Communicate internal control information internally Communicate internal control information externally
Monitoring	Perform ongoing or periodic evaluations of internal controls (or a combination of the two) Communicate internal control deficiencies

Depending on a company’s facts and circumstances, making the transition to the updated framework can take time, so it’s a good idea to begin the process as soon as possible. Companies may begin by familiarizing themselves with the aforementioned 17 principles and other COSO guidelines. Then, companies may evaluate the current state of their internal control system and develop a plan for correcting any weaknesses.

To learn more about the revised COSO Framework, view the Weaver Insights article Updated COSO Framework: Will Your Company’s Internal Controls Make the Grade?