COSO internal control framework
The COSO framework defines internal control in five components: control environment, risk assessment, control activities, information and communication, and monitoring. It is the standard reference for designing and evaluating internal control.
The 2013 framework adds 17 principles under the five components. Management uses it for its SOX 404 assessment, and auditors use it to understand and test controls.
Example. Requiring two signatures on payments above $10,000 is a control activity, while a monthly review of exceptions by the controller is monitoring.
By Binod Raj Singh, CPA (licensed in Montana) · Updated for the 2026-2027 exam windows · Last updated 2026-11-05