The COSO internal control framework sets out 17 principles, grouped under its five components: control environment (principles 1–5), risk assessment (6–9), control activities (10–12), information and communication (13–15) and monitoring activities (16–17). Each principle describes something an organisation must do, such as committing to integrity, assessing fraud risk or reporting control deficiencies. For internal control to be effective, all 17 must be present and functioning. That makes them the internal auditor’s checklist for judging whether a system of internal control works.
Key points
- 17 principles sit under COSO’s five components: 5 for the control environment, 4 for risk assessment, 3 for control activities, 3 for information and communication and 2 for monitoring.
- Each principle is broken down into points of focus, which guide what you test.
- Effective internal control means all 17 principles are present and functioning, and work together.
- Principles 1–5 are about people and culture: integrity, board oversight, structure, competence and accountability.
- Principles 16 and 17, monitoring and reporting deficiencies, are core internal audit work.
- Every principle has a famous failure behind it, from Enron to Equifax, that shows what happens when it is missing.
The 17 COSO principles at a glance
The principles below are summarised in plain language. The official wording is in COSO’s Internal Control – Integrated Framework. For the framework as a whole (the three objectives, five components and the COSO cube), start with our guide: internal control explained: the COSO framework and examples.
| No. | Component | The principle, in short | Case used in the course |
|---|---|---|---|
| 1 | Control environment | Commitment to integrity and ethical values | Enron |
| 2 | Control environment | The board is independent of management and oversees internal control | Wells Fargo |
| 3 | Control environment | Clear structures, reporting lines, authorities and responsibilities | A retailer that acquires companies without defining roles |
| 4 | Control environment | Attract, develop and retain competent people | Google (good practice), Uber (failure) |
| 5 | Control environment | Hold people accountable for their internal control responsibilities | Wells Fargo, ADT |
| 6 | Risk assessment | Set objectives clearly enough to identify the risks to them | Volkswagen emissions |
| 7 | Risk assessment | Identify and analyse risks across the organisation | Airlines in COVID-19 (good practice), Boeing 737 MAX (failure) |
| 8 | Risk assessment | Consider the potential for fraud | American Express (good practice), Novartis (failure) |
| 9 | Risk assessment | Identify and assess significant changes | Equifax data breach |
| 10 | Control activities | Select and develop control activities that reduce risks to acceptable levels | A manufacturer with no supplier quality checks |
| 11 | Control activities | Select and develop general controls over technology | Target data breach |
| 12 | Control activities | Deploy controls through policies and procedures | Walmart Mexico bribery case |
| 13 | Information and communication | Obtain and use relevant, quality information | Volkswagen emissions |
| 14 | Information and communication | Communicate internal control information internally | A group whose subsidiaries share no control information |
| 15 | Information and communication | Communicate with external parties | General Motors ignition switch |
| 16 | Monitoring activities | Carry out ongoing and separate evaluations | Boeing (after the 737 MAX), Toshiba |
| 17 | Monitoring activities | Evaluate and communicate deficiencies in time | Tyco |
Each principle is supported by points of focus: the important characteristics that break the principle down. You use them when you test, as the examples below show.
Control environment: principles 1 to 5
The control environment is the tone at the top. These five principles are about people, culture and structure, and they shape every other control.
Principle 1: commitment to integrity and ethical values
The board and management set the tone at the top, establish standards of conduct, check that people follow them, and deal with deviations promptly. In practice, that means a code of conduct, a code of ethics and a whistle-blower policy, communicated to everyone and backed by regular training for all staff, including senior management.
When it fails: at Enron, executives built a culture that valued profits over ethics, and the financial statements were manipulated to make the company look more profitable than it was. The company filed for bankruptcy in 2001.
What the auditor checks: does the code exist, has every employee acknowledged it, is training recorded, and were breaches acted on, including by senior people?
Principle 2: independent board oversight
The board sets its oversight responsibilities, brings relevant expertise, operates independently of management, and oversees all five components of internal control. It usually does this through the audit committee, management and internal audit.
When it fails: at Wells Fargo, employees opened millions of unauthorised customer accounts to meet sales targets. A key issue was the board’s lack of oversight: it set aggressive targets without considering the risk of misconduct and did not act promptly once the problem surfaced.
What the auditor checks: the independence and expertise of board and audit committee members, and the minutes: do they show real review of controls, risks and audit findings, or only formal approvals?
Principle 3: structure, reporting lines and authority
Management, with the board’s oversight, sets up the organisation structure, the reporting lines, and the authorities and responsibilities, with limits. The structure should match the strategy: a company expanding into new regions might decentralise, giving regional managers decision rights within clear limits.
When it fails: the course example is a retail company that acquires several smaller businesses but never defines who the acquired staff report to or what they may approve. The result is confusion, duplicated effort and delays.
What the auditor checks: an up-to-date organisation chart and a delegation of authority (authority matrix) with value limits, and whether actual approvals stay within them.
Principle 4: commitment to competence
The organisation has policies and practices to attract, develop and retain competent people; it evaluates competence and addresses shortcomings; and it plans for succession, so that someone is ready when a key person leaves.
Good practice and failure: the course contrasts Google, known for its training, leadership development and succession planning, with Uber in 2017, where an engineer’s account of harassment and discrimination led to an investigation that revealed weak policies and a damaging culture.
What the auditor checks: job descriptions with required competencies, training records, and a succession plan for key roles.
Principle 5: accountability
The organisation enforces accountability through its structures, sets performance measures, incentives and rewards, checks they stay relevant, considers excessive pressures, and rewards or disciplines people accordingly.
When it fails: Wells Fargo again. Unrealistic sales goals created the pressure, and the company blamed a few employees instead of holding senior people accountable.
What the auditor checks: a simple test from the course. If controls are established but nobody is named as responsible for performing or reviewing them, and skipping them has no consequence, principle 5 is failing.
Risk assessment: principles 6 to 9
Principle 6: clear objectives
The organisation specifies its objectives clearly enough to identify and assess the risks to them. This covers operations, external financial and non-financial reporting, internal reporting and compliance. The points of focus include management’s choices, tolerances for risk, the resources committed, materiality and the laws and standards that apply. A software company planning a new release, for example, breaks the objective into new features, bug fixing and testing, integration and deployment, and considers the tolerance for delays and the data-protection laws that apply.
When it fails: the course uses Volkswagen’s emissions case: the goal of becoming the world’s largest carmaker was pursued without clear attention to compliance with emission rules, and software was installed to pass emission tests.
What the auditor checks: are the department’s objectives written down, measurable and linked to risks? Vague objectives make it impossible to know what could prevent them.
Principle 7: identify and analyse risks
The organisation identifies risks at every level (entity, division, operating unit, function), analyses internal and external factors, involves the right levels of management, estimates how significant each risk is, and decides how to respond.
Good practice and failure: during COVID-19, airlines identified risks such as cabin contamination and crowded airports and responded with extra cleaning, distancing and masks. With the Boeing 737 MAX, the course points out that the risk of a new sensor and software system was not adequately analysed, and the appropriate levels of management were not involved.
What the auditor checks: a risk register with ratings and owners, and evidence that it is reviewed and acted on. See our course videos on assessing risk with a heat map.
Principle 8: fraud risk
The organisation considers the types of fraud it could face, and assesses the three sides of the fraud triangle: incentives and pressures, opportunities, and attitudes and rationalisations.
Good practice and failure: the course describes American Express’s fraud risk management programme, with a specialist team that investigates suspected fraud. The failure example is Novartis: in June 2020, Novartis and its former eye-care unit Alcon agreed to pay about $346 million to settle US charges of bribing healthcare providers and officials in Greece, Vietnam and South Korea, and of keeping false records to hide it.
What the auditor checks: is there a fraud risk assessment, does it cover each process, and does it name the controls that address each scheme?
Principle 9: identify and assess changes
The organisation identifies and assesses changes that could significantly affect internal control: in the external environment, the business model and the leadership. A retailer expanding into new countries, for example, faces new regulations, cultures and competitors, and may need different supply chain and inventory controls there.
When it fails: Equifax, 2017. A vulnerability that had been fixed in one part of its systems was not fixed in another, and the result was one of the largest data breaches in history.
What the auditor checks: when a new system, product, location or leader arrives, is anyone reviewing what it means for the controls?
Control activities: principles 10 to 12
Principle 10: select and develop control activities
Control activities are linked to the risk assessment, fit the organisation’s size and complexity, are placed in the relevant business processes and at the right levels, use a mix of control types (such as preventive and detective), and address segregation of duties.
When it fails: the course example is a manufacturer that sources raw materials from many suppliers in different countries but has no check on the quality of what arrives, no monitoring of supplier performance and no contingency plan. The result is production delays, higher costs and lost customer trust.
What the auditor checks: this is the heart of a process-level internal audit checklist: does every significant risk in the risk and control matrix have a control, and are incompatible duties separated?
Principle 11: general controls over technology
The organisation understands how its business processes depend on technology and sets controls over:
- infrastructure: data backup and recovery, network security, system availability
- security management: access control, user management, passwords, access logs
- acquisition, development and maintenance: system development controls and change management.
When it fails: Target, 2013. The course explains that a vulnerability in Target’s payment systems was not adequately addressed and access controls did not limit what the attackers could reach, leading to a massive breach of customer data.
What the auditor checks: user-access reviews, a list of who holds administrator rights, backup and restore tests, and approvals for system changes.
Principle 12: policies and procedures
Controls are deployed through policies (what is expected) and procedures (how it is done). Responsibility is assigned, controls are performed on time by competent people, problems are corrected, and policies are reassessed. The course example is a factory safety policy: protective gear is provided, staff are trained, a manager monitors compliance, inspections are done, and the policy is reviewed.
When it fails: the 2012 Walmart Mexico bribery case, where, as the course describes, staff were not adequately trained on anti-corruption policies and warnings from an internal whistle-blower were not acted on.
What the auditor checks: do written procedures exist for each policy, are they current, and are they followed in a sample of transactions?
Information and communication: principles 13 to 15
Principle 13: relevant, quality information
The organisation identifies what information it needs, captures data from internal and external sources, turns it into useful information, maintains its quality, and weighs cost against benefit. A carmaker, for example, uses customer feedback, warranty claims and quality reports to improve its products and stay compliant.
What the auditor checks: are the reports that management relies on complete and accurate? Reconcile a key report back to the system before you rely on it.
Principle 14: internal communication
Internal control information, including objectives and responsibilities, is communicated at all levels and to the board, through suitable methods, with separate lines (such as a whistle-blower channel) for when normal channels do not work.
When it fails: the course example is a group with different control systems in each overseas subsidiary and no standard way of sharing control information. The board cannot judge whether internal control works across the group.
What the auditor checks: how policies reach staff, whether a speak-up channel exists and is used, and what control information reaches the board.
Principle 15: external communication
The organisation communicates with external parties, such as shareholders, regulators, customers and suppliers, about matters that affect internal control, and allows information to come in from them. Listed companies, for example, publish audited financial statements, and in the United States the SEC requires disclosure of material weaknesses in internal control over financial reporting.
When it fails: General Motors knew of an ignition-switch defect for over a decade but did not disclose it to regulators, the public or customers until 2014.
What the auditor checks: who approves external disclosures and regulatory filings, and how complaints and information from outside are logged and acted on.
Monitoring activities: principles 16 and 17
Principle 16: ongoing and separate evaluations
The organisation uses a mix of ongoing monitoring and separate evaluations to check that each component of internal control is present and functioning. The points of focus include considering the rate of change, starting from a baseline understanding, using knowledgeable people, building checks into business processes, adjusting the scope and frequency of evaluations, and evaluating objectively. Internal audit’s periodic reviews are one of these separate evaluations.
Good practice and failure: after the 737 MAX was grounded, Boeing carried out a separate evaluation of its internal control system and made corrective changes. The failure case is Toshiba’s 2015 accounting scandal, where profits had been overstated over several years and the company had not adjusted its evaluations as the business changed.
Principle 17: evaluate and communicate deficiencies
The organisation assesses the results of its evaluations, communicates deficiencies in time to those who must act (including senior management and the board, as appropriate) and monitors the corrective action.
The example: after the 2002 Tyco scandal, involving its former CEO and CFO, the company set up a formal process in which internal audit assesses controls and reports deficiencies to senior management and the board, who are then responsible for corrective action.
What the auditor checks: an action tracker with owners and dates, evidence that closed actions were verified, and regular reporting of open items to the audit committee.
Worked example: using the 17 principles in an entity-level review
Here is how the principles turn into an audit plan. Suppose you are reviewing entity-level controls at a mid-sized company. For each principle, you ask for evidence and decide whether the principle is present (designed) and functioning (working in practice). This is an illustration of the method, not a real client.
| Principle | Evidence to ask for | Warning sign |
|---|---|---|
| 1. Integrity | Code of conduct, signed acknowledgements, ethics training records, action taken on breaches | The code exists, but no breach has ever led to action |
| 2. Board oversight | Audit committee composition and minutes, internal audit reports presented | Minutes record approvals only, with no questions or follow-up |
| 3. Structure and authority | Organisation chart, delegation of authority with limits | Approvals above the authorised limit in a sample of transactions |
| 4. Competence | Job descriptions, training plan, succession plan | Key finance roles with no back-up |
| 5. Accountability | Control owners named in the RCM, appraisal criteria | Controls with no named owner |
| 6–9. Risk assessment | Written objectives, risk register, fraud risk assessment, review of major changes | A new ERP went live with no review of its effect on controls |
| 10–12. Control activities | RCMs by process, IT access reviews, current written procedures | The same user can create a vendor and approve its payment |
| 13–15. Information and communication | Key MIS reports, policy communication, whistle-blower log, disclosure approvals | Management relies on a spreadsheet that nobody reconciles |
| 16–17. Monitoring | Audit plan and reports, action tracker, audit committee reporting | The same observation repeats in three successive audits |
A principle that is missing or not working is a control deficiency. Record it with the evidence, assess how serious it is, and report it promptly to those who must fix it: principle 17 applies to the auditor too. Our guide to the internal audit report format shows how to write it up.
From our practice: a manufacturing company had set up systems to back up its ERP data, but never tested regularly whether the backups could be restored. When the need came, the backup did not load and the recovery failed. The control existed on paper but did not work when it mattered. That is a failure of principle 11, general controls over technology: a control is effective only when it is both well designed and operating.
▶ Watch it explained
Short videos from our internal audit course. Each one covers a single topic, step by step.
- COSO Principles 1-3 Explained: Integrity, Board Oversight and Organisation Structure (13 min)
- COSO Principles 4-5 Explained: Competence and Accountability (8 min)
- COSO Principles 6-7 Explained: Clear Objectives and Identifying Risks (9 min)
- COSO Principles 8-9 Explained: Fraud Risk and Managing Change (7 min)
- COSO Principles 10-12 Explained: Control Activities, IT General Controls and Policies (13 min)
- COSO Principles 13-15 Explained: Quality Information and Communication (11 min)
- COSO Principles 16-17 Explained: Monitoring and Reporting Deficiencies (9 min)
- Module 4 Recap: Internal Control in Four Minutes (4 min, free)
📄 Get the template
Building an Effective Ethics Programme: 15 Good Practices and a Health Check. Fifteen practices that turn stated values into everyday decisions, each with an example and what to look for, plus a health check. (Principle 1)
Fraud Scenario Library and Risk Assessment Worksheet (Excel). 26 common fraud schemes in 4 categories, each explained with an example, with space to record how it could happen, controls and gaps. (Principle 8)
Managing Information Technology: Risk and Control Matrix (Excel). 32 controls (21 key) for 10 objectives and 16 risks, each with walkthrough questions, evidence to ask for and test steps. (Principle 11)
✅ Test yourself
Questions from our course quizzes. Click a question to see the answer.
A board set aggressive sales targets without considering the risk of unethical behaviour, and failed to detect millions of unauthorised customer accounts (the Wells Fargo case). Which COSO principle failed most directly?
Principle 2: the board demonstrates independence from management and exercises oversight of internal control. The board set the targets without considering the risk of misconduct and did not act promptly on the problem.
During an audit you find well-designed controls in financial reporting, but nobody is named as responsible for performing or reviewing them, and no one has been disciplined for skipping them. What do you conclude?
Principle 5 is failing: controls exist, but nobody is held accountable for them. Accountability needs structures, performance measures, and rewards or discipline.
Equifax had fixed a known vulnerability in one part of its systems but not in another, which led to a major data breach. Why is this a Principle 9 failure?
Because the company failed to identify and assess a significant change affecting its system of internal control, and to address it across all its systems.
Frequently asked questions
What are the 17 principles of COSO?
They are: 1 integrity and ethical values, 2 board independence and oversight, 3 structure, reporting lines and authority, 4 competence, 5 accountability, 6 clear objectives, 7 identifying and analysing risks, 8 fraud risk, 9 assessing significant changes, 10 control activities, 11 general controls over technology, 12 policies and procedures, 13 quality information, 14 internal communication, 15 external communication, 16 ongoing and separate evaluations, and 17 communicating deficiencies.
How are the 17 principles grouped under the five components?
Control environment: principles 1–5. Risk assessment: 6–9. Control activities: 10–12. Information and communication: 13–15. Monitoring activities: 16–17.
Do all 17 COSO principles have to be in place?
Yes. Under the framework, an effective system of internal control needs all 17 principles to be present and functioning, and all five components to operate together.
What are points of focus in COSO?
Points of focus are the important characteristics of each principle. They break the principle down into specific things to look for, which makes them useful when designing tests of controls.
Which COSO principles matter most to internal auditors?
All 17 guide an evaluation of internal control, but principles 16 (ongoing and separate evaluations) and 17 (evaluating and communicating deficiencies) describe core internal audit work.
Related reading: Internal control explained: the COSO framework and examples · Internal audit checklist: build your own, plus 36 by process · Internal audit report: format, key parts and writing tips
