Internal Control Explained: COSO Framework and Examples

Internal control is the set of policies, procedures and checks an organisation builds into its processes so that it achieves its objectives: reliable financial statements, efficient operations, safe assets and compliance with laws and its own policies. The COSO framework, the most widely used model, organises internal control into three objectives (operations, reporting and compliance), five components (control environment, risk assessment, control activities, information and communication, and monitoring) and 17 principles. Internal control is effective when all five components, and the 17 principles beneath them, are present and working together. Even then it gives reasonable assurance, never absolute assurance.

What is internal control?

In simple terms, a control is any action an organisation takes to make sure it achieves its objectives. Setting an alarm so that you wake up on time is a control in your own life. Organisations need the same thing on a larger scale: rules and checks that keep the business running smoothly, protect its assets and stop mistakes and fraud.

More formally, internal control is a system of processes, policies and procedures that an organisation puts in place to make sure of five things:

What internal control protects	What it means	Examples of controls
1. Integrity of the financial statements	The accounts give a true and fair view, free from error and omission	Cash counted daily and reconciled to the books; bank balances reconciled to bank statements; invoices verified and approved under the authority matrix before they are booked
2. Efficient and effective operations	Efficiency is getting more done with limited resources; effectiveness is achieving the outcome you wanted	Monitoring machine idle time and output against plan in a manufacturing plant
3. Protection of assets	Physical and intangible assets are safe from theft, damage or deterioration	Restricted access to premises; cash and inventory under lock and key; the server room locked
4. Compliance with laws, regulations and internal policies	The organisation follows the law and management’s own directives	A compliance checklist of the laws that apply in each country and state, with regular reporting against it
5. Achievement of objectives	The overall result of the first four	If the first four are in place, the risks that threaten the objectives are being managed

A control is a step inside the process

Internal control is not something that sits outside the business. It is one of the steps in the process itself. When an expense is booked, there is a step where it is authorised: that authorisation is the control. When a company gives customers 30 days’ credit, the policy is the 30-day period; the procedure is that the period is set in the system, printed on every invoice, and someone calls the customer before it expires. Both are controls.

That is why policies and procedures are the internal auditor’s benchmark. Even where nothing is written down, the organisation still follows some way of working. You need to understand it before you can design or test a control against it.

The golden rule: cost against benefit

A control must never cost more than the benefit it brings. Compare the financial impact of the risk with what the control will save and what it will cost to run. If the cost is higher, management will rightly reject it, however good it looks on paper.

A simple example from the course: a biometric attendance system for a small warehouse might cost around ₹2 lakh to install, plus annual maintenance of about 10% of that. For a small site, an attendance register does the job at a fraction of the cost. The same logic works the other way: a control with no risk behind it has no meaning at all.

Everyday examples of internal control

Control	How it works	What it prevents or detects
Segregation of duties	Linked tasks go to different people: the person who books vendor invoices does not also process payments; the person who raises a purchase requisition does not also place the order	Fraud or error that one person could otherwise commit and hide, such as changing a vendor’s bank details or raising fake requisitions for a favoured vendor
Physical controls	Locks, cabinets, alarms, CCTV	Theft, loss and damage. CCTV is both a deterrent and a way to find out what happened
Policies and procedures	Written rules, such as expense limits by grade, travel class, or who may approve a refund	Inconsistent decisions across people and locations
Authorisation and delegation of authority	An authority matrix sets who may approve what, up to which value	Transactions approved by people without the authority to do so
Access controls	Passwords, user rights, access logs	Unauthorised changes to data and systems
Maker-checker	One person prepares, a second reviews and approves	Errors and unreviewed entries
Reconciliations and confirmations	Bank and party reconciliations; balance confirmations from third parties	Errors, omissions and unrecorded transactions

For more on how controls are classified (preventive, detective and corrective; manual and automated; general and application), see the module’s videos on directive, preventive, detective and corrective controls and general vs application and manual vs automated controls.

The COSO framework, simply explained

COSO is the Committee of Sponsoring Organizations of the Treadway Commission. It was formed in 1985 by five professional bodies: the American Accounting Association, the American Institute of Certified Public Accountants, Financial Executives International, the Institute of Internal Auditors and the National Association of Accountants (now the Institute of Management Accountants). It provides thought leadership on three subjects: enterprise risk management, internal control, and fraud deterrence. Its internal control framework gives guidance that any organisation can apply, whether it is designing controls or evaluating them. The framework itself is published by COSO.

The framework is usually drawn as a cube with three dimensions:

Dimension	What it contains
Objectives (top of the cube)	Operations: effective and efficient use of resources, in line with strategy · Reporting: accurate, complete and reliable reports, covering the whole process of capturing, recording, analysing and reporting information · Compliance: following the laws and regulations that apply
Components (front)	Control environment · Risk assessment · Control activities · Information and communication · Monitoring activities
Levels of the organisation (side)	Entity · Division · Operating unit · Function

Every objective applies to all five components, and every component helps achieve all three objectives. When you look at any control, ask two questions: which of the three objectives is it helping to achieve, and which of the five components does it belong to?

The course describes the reporting objective as the reliability of financial reporting. The 2013 update of the framework widened it: it now covers internal and external reporting, both financial and non-financial.

The five COSO components explained

Component	What it means	What a strong one looks like
1. Control environment	The tone at the top: the values, leadership style and culture set by the board and senior management, and the policies, delegation of authority and reporting lines that follow from them	Clear ethical values reflected in the policies; leaders who model ethical behaviour; written, accessible policies and procedures; a culture of open communication, where anyone can raise a risk
2. Risk assessment	Identifying the risks to the objectives, assessing their likelihood and impact, and deciding how to respond	A risk process that management owns and runs; the auditor checks that all significant risks were identified and have a mitigation plan
3. Control activities	The policies and procedures, built into processes, that reduce specific risks	The right mix of control types (preventive and detective, manual and automated and so on) for the risk
4. Information and communication	How information is identified, captured, processed, communicated and protected, flowing down (instructions), up (reporting) and across departments	The organisation knows what information it needs; captures and keeps it accurately and on time; processes and communicates it accurately, completely and promptly; and protects sensitive information
5. Monitoring activities	Checking that controls are present and working, and fixing them when they are not	Ongoing monitoring; separate evaluations (for example by internal audit); reporting of weaknesses with corrective action; a quick response when the business changes

Why the auditor reads the control environment first

Every organisation sets its own tone. Some run on strict attendance rules; others care only about results and let people work from anywhere. Neither is wrong, but the controls must fit the culture. How management sees internal audit also shows in the control environment. So when you begin an audit, start by understanding the control environment: it drives everything else, and controls that ignore it will not work.

Monitoring is not only internal audit

Monitoring sounds like internal audit, but it is wider. Self-assessments, maker-checker reviews and checks between departments are all monitoring. Management remains responsible for having controls in place and working. Internal audit’s separate evaluation gives management and the board an independent level of assurance on top of that.

Worked example: COSO in a retail chain

This is the case we use in the course. ABC Retail Stores wants to prevent inventory fraud across its outlets. Here is how each COSO component shows up:

Component	What ABC Retail does
Control environment	A code of conduct that requires employees to report unethical practices, annual ethics training for all staff, and a zero-tolerance policy
Risk assessment	Identifies the risk of inventory theft at outlets (theft by employees, shoplifting, supply chain fraud) and assesses the likelihood and impact of each
Control activities	Segregation of duties (staff who receive stock do not count it), regular physical counts reconciled to the system, access to stock areas restricted to authorised staff, CCTV
Information and communication	A hotline for anonymous reporting, monthly inventory performance updates to store managers, and documented procedures available to everyone involved
Monitoring activities	Quarterly internal audits of inventory practices, real-time monitoring of stock levels in the ERP, and management review of audit findings with corrective action

Notice that each component also links back to the objectives: the counts and reconciliations support reliable reporting, the access controls protect assets, and the code of conduct supports compliance with policy.

From our practice: a manufacturing company had set up systems to back up its ERP data, but never tested regularly whether the backups could be restored. When the need came, the backup did not load and the recovery failed. The control existed on paper but did not work when it mattered. That is a failure of principle 11, general controls over technology: a control is effective only when it is both well designed and operating.

Entity-level, division, unit and function controls

The third side of the COSO cube is the level of the organisation where a control operates:

• Entity level: controls that affect the whole organisation, such as the code of conduct, the delegation of authority and board oversight. These set the tone at the top.
• Division level: controls tailored to a major business segment. A retail division and a manufacturing division may need different inventory controls.
• Operating unit: controls within a sub-unit, such as one retail store using an inventory tracking system.
• Function: controls within a department or process, such as segregation of duties in accounts payable.

An entity-level controls checklist therefore starts with the control environment: the code of conduct and how it is enforced, board and audit committee oversight, the organisation structure, the authority matrix, and how deficiencies reach the board.

An internal control checklist based on COSO

Use these questions when you first assess an organisation’s internal control. Each one comes from a component above. They are a starting point, not a full audit programme; for process-level checks, see our internal audit checklists by process.

Component	Questions to ask	Evidence to look for
Control environment	Are the values written down, and do the policies match them? Do leaders follow the rules they set? Are policies accessible to staff, including new joiners? Can staff raise concerns without fear?	Code of conduct and staff acknowledgements, policy manual, authority matrix, organisation chart, whistle-blower policy and reports
Risk assessment	Does management identify and rate risks against its objectives? Is there a response for each significant risk? Is fraud risk considered?	Risk register, risk committee or management meeting minutes, mitigation plans
Control activities	Does each significant risk have a control? Are incompatible duties separated? Are IT access and changes controlled? Is the cost of each control justified by the risk?	Process notes or flowcharts, a risk and control matrix, system user-access lists, approvals on samples of transactions
Information and communication	Does the organisation know what information it needs? Is it captured accurately and on time? Does it reach the people who must act? Is sensitive data protected?	MIS reports and their distribution, data backup and access records, communication of policies to staff
Monitoring activities	Are controls checked on an ongoing basis? Are there separate evaluations? Are weaknesses reported and fixed? Are controls updated when processes, systems or people change?	Internal audit reports, action trackers, self-assessments, evidence that closed actions were verified

When is internal control effective?

A control is effective when it achieves the objective it was designed for. You lock your car so that it is not stolen; if the car is there at the end of the day, the control did its job. For the system as a whole, the COSO framework sets a clear test: each of the five components, and the 17 principles within them, must be present and functioning, and operating together. The board and senior management judge whether they are. When you give an opinion on internal control as an auditor, these principles guide your test.

Six features of a good system of internal control:

1. It responds quickly to new risks, inside the company and in the business environment.
2. The cost of each control is balanced against its benefit, including the risk it manages.
3. Significant control failures or weaknesses are reported immediately to the right level of management, with the corrective action being taken.
4. It reduces errors and breakdowns but cannot promise they will never happen: it gives reasonable, not absolute, assurance.
5. It is embedded in operations and part of the culture, not a separate activity.
6. It is reviewed and updated regularly. A system left alone deteriorates.

An example of change: bank reconciliation used to be a manual control, an accountant ticking the bank statement against the bank book, approved by the CFO. Where the ERP now reconciles automatically, the control becomes automated, and the auditor’s test changes with it.

Balance: under-control and over-control

Too few controls expose the organisation to loss of assets, poor decisions, non-compliance and public scandal. Too many create bureaucracy, red tape, lower productivity, more complexity, longer cycle times and activities that add no value. Both destroy value. The aim is a balance in which the critical risks are managed at a cost the business can justify.

How internal audit uses the COSO framework

Evaluating internal control is the main reason an internal audit function exists; most of its other work supports that task. In practice, the framework helps you at each stage of an audit:

• Planning: understand the control environment and management’s risk assessment before you design your tests.
• Fieldwork: map the risks and controls of each process in a risk and control matrix, then test each key control for design (would it work?) and operating effectiveness (did it work throughout the period?). See the videos on the test of design and the test of operating effectiveness.
• Reporting: report deficiencies promptly to those who must fix them, including senior management and the board where needed. That is COSO’s monitoring component at work.

Our internal audit process guide covers each of these stages step by step.

In India: under the Companies Act 2013, the directors’ responsibility statement of a listed company confirms that internal financial controls have been laid down and are adequate and operating effectively (section 134(5)(e)). The statutory auditor reports on whether the company has adequate internal financial controls over financial reporting and whether they operate effectively (section 143(3)(i)).

Frequently asked questions

What is internal control in simple words?

Internal control is the set of policies, procedures and checks an organisation builds into its processes so that it achieves its objectives: reliable financial statements, efficient operations, safe assets and compliance with laws and policies. A control is a step inside a process, such as an approval or a reconciliation.

What are the five components of COSO?

Control environment, risk assessment, control activities, information and communication, and monitoring activities. Together they make up a system of internal control, and all five must be present and working together.

What are the three objectives of internal control under COSO?

Operations (effective and efficient use of resources), reporting (accurate, complete and reliable reports) and compliance (following the laws and regulations that apply). A control can support one, two or all three.

What are examples of internal controls?

Segregation of duties, approvals under a delegation of authority, physical controls such as locks and CCTV, passwords and user access rights, maker-checker reviews, bank and party reconciliations, and third-party balance confirmations.

Can internal control give absolute assurance?

No. Even a well-designed system gives only reasonable assurance, because people make mistakes, situations arise that nobody planned for, and the cost of a control must stay below its benefit.

Related reading: The 17 COSO principles explained, with examples · Internal audit checklist: build your own, plus 36 by process · The internal audit process, step by step · Internal audit interview questions and answers