COSOs

COSO, or the Committee of Sponsoring Organizations of the Treadway Commission, is a U.S.-based private-sector organization established in 1985 by five sponsoring bodies: the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute of Internal Auditors (IIA), and the Institute of Management Accountants (IMA). Its mission is to provide thought leadership and guidance on internal control, enterprise risk management, governance, and fraud deterrence, and to develop frameworks used by organizations worldwide to improve performance and accountability.

COSO is best known for its two integrated frameworks. The Internal Control—Integrated Framework (ICIF), first issued in 1992 and revised in 2013, defines five interrelated components—Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring—that collectively support three objectives: the effectiveness and efficiency of operations, the reliability of financial reporting, and compliance with laws and regulations. The ICIF is widely used to design, implement, and assess internal control systems and to support regulatory compliance, including Sarbanes-Oxley Act requirements in many jurisdictions.

The Enterprise Risk Management (ERM) Framework, originally released in 2004 and updated in 2017, describes eight interrelated components—Internal Environment, Objective Setting, Event Identification, Risk Assessment, Risk Response, Control Activities, Information and Communication, and Monitoring—and identifies four objective categories: Strategic, Operations, Reporting, and Compliance. The ERM framework emphasizes an integrated, enterprise-wide approach to risk management and decision making.

COSO’s frameworks are applied globally across industries to enhance governance, risk management, and control activities. The organization continues to publish guidance and updates reflecting evolving best practices in internal control and risk management.