5 COSO Components and Their 17 Underlying Principles

The COSO Internal Control — Integrated Framework organizes internal control into five components and 17 principles. The five components are the control environment, risk assessment, control activities, information and communication, and monitoring activities. The 17 principles, formalized in the 2013 update, distribute across those components as five, four, three, three, and two, and together they give each component concrete criteria that can be tested and evaluated.¹ The framework was originally published in 1992 by the Committee of Sponsoring Organizations of the Treadway Commission and remains the most widely used internal control model in the United States.²

For a system of internal control to be considered effective under the framework, all five components must be present and functioning together, and all 17 principles must be present and functioning as well.¹ The sections below take each component in order and list the principles that belong to it.

Control Environment (Principles 1–5)

The control environment is the foundation everything else rests on. It reflects the organization’s commitment to integrity, ethical behavior, and putting competent people in the right roles. The board of directors sets the standard by holding senior management accountable for how controls are designed and whether they actually work. Reporting lines, authority levels, and job qualifications all flow from decisions made here. Ethical expectations take shape through a code of conduct, and management reinforces that code by building a culture where accountability isn’t optional.

Federal law reinforces these expectations. The Foreign Corrupt Practices Act requires every company with SEC-registered securities to maintain a system of internal accounting controls that ensures transactions are properly authorized, recorded, and reconciled.³

The five principles inside this component are:

Principle 1. The organization demonstrates commitment to integrity and ethical values.
Principle 2. The board exercises oversight responsibility.
Principle 3. Management establishes structure, authority, and responsibility.
Principle 4. The organization demonstrates commitment to competence.
Principle 5. The organization enforces accountability.

A healthy control environment also protects the people who raise concerns. The Sarbanes-Oxley Act prohibits public companies from retaliating against employees who report conduct they reasonably believe violates federal securities laws, including fraud and SEC rule violations.⁴ Protected reports can go to federal agencies, members of Congress, or a supervisor within the company. Retaliation isn’t limited to firing someone. It covers demotions, suspensions, threats, harassment, and any other change to the terms of employment.

Risk Assessment (Principles 6–9)

Risk assessment is where the organization identifies what could go wrong and decides how much exposure it’s willing to accept. The process starts with defining objectives clearly enough that threats to those objectives become visible. A vague goal like “improve profitability” doesn’t give you anything to assess risk against; a specific objective like “reduce inventory shrinkage to below 2% of revenue” does.

Management evaluates both internal and external factors: operational disruptions, regulatory changes, market shifts, technology failures, and personnel turnover. Each identified risk gets assessed for likelihood and potential impact. This is not a one-time exercise. The framework specifically calls for identifying significant changes in the business environment that could make existing controls obsolete, which is why risk assessment needs to be ongoing rather than annual.

Evaluating fraud risk gets its own principle. Managers look for the conditions that make fraud more likely: financial pressure on employees, opportunities created by weak controls, and a culture that rationalizes cutting corners. Asset theft and fraudulent financial reporting are the two biggest categories.

The four principles in this component are:

Principle 6. The organization specifies objectives with sufficient clarity.
Principle 7. The organization identifies and analyzes risks.
Principle 8. The organization assesses fraud risk.
Principle 9. The organization identifies and analyzes significant change.

Organizations use two broad approaches to measure risk. Qualitative methods rank threats on ordinal scales — high, medium, low — based on judgment and experience. Quantitative methods assign numerical values to probability and financial impact, often using statistical models that forecast best-case and worst-case scenarios. Most organizations blend the two: qualitative screening to prioritize which risks deserve deeper quantitative analysis.

Control Activities (Principles 10–12)

Control activities are the specific policies and procedures that make sure management’s risk-mitigation directives actually get carried out. They sit at the intersection of “we identified a risk” and “here’s what we do about it every day.” Examples range from requiring dual authorization on payments above a set dollar threshold to reconciling bank statements and inventory records on a regular schedule.

Some controls are automated. Software flags transactions that fall outside preset parameters, such as an unusually large procurement charge or a payment to a newly created vendor. Others are manual, like a manager reviewing departmental spending against budget before approving the next round of purchases. Both types need clear documentation so that auditors can trace how a control was designed, who performed it, and what the outcome was.

The three principles here are:

Principle 10. The organization selects and develops control activities.
Principle 11. The organization selects and develops general controls over technology.
Principle 12. The organization deploys control activities through policies and procedures.

Segregation of duties belongs inside this component and is one of the easiest control activities to get wrong. The core idea is that no single person should control every step of a financial transaction. The person who approves a vendor shouldn’t also be the person who pays that vendor. When one individual can both commit fraud and conceal it, auditors call that a toxic combination. In smaller organizations where headcount makes perfect segregation impractical, compensating controls like independent reviews or system-generated exception reports become essential.

Information and Communication (Principles 13–15)

Internal controls run on data. This component makes sure the right information reaches the right people in time for them to act on it. That means capturing quality information from both internal systems and outside sources, processing it efficiently, and distributing it through channels that actually work.

Internal communication gives employees the context they need to operate within the control framework: understanding their roles, knowing what to escalate, and having access to reporting channels when something looks wrong. Anonymous hotlines and other confidential reporting mechanisms fall under this component. External communication covers the flow of information to shareholders, regulators, auditors, and other third parties, including the specific reporting obligations public companies carry under federal securities laws.

The three principles are:

Principle 13. The organization uses relevant information.
Principle 14. The organization communicates internally.
Principle 15. The organization communicates externally.

When information gets trapped in silos, so that one department sees a problem but leadership never hears about it, operational weaknesses hide in plain sight until they become crises.

Monitoring Activities (Principles 16–17)

Controls degrade over time. People leave, systems change, new risks emerge, and procedures that worked three years ago may no longer address current conditions. Monitoring activities evaluate whether the other four components are still functioning as intended.

Monitoring comes in two forms. Ongoing evaluations are built into day-to-day operations: automated exception reports, supervisory reviews, and real-time reconciliations that provide continuous feedback. Separate evaluations are periodic, deeper assessments typically performed by internal audit teams. These targeted reviews catch problems that routine monitoring might miss, particularly when technology changes or the organization scales significantly.

When monitoring uncovers a deficiency, the framework requires reporting it upward to the people who can fix it: the process owner, senior management, and in significant cases the board of directors or audit committee. The speed and seriousness of that escalation path determines whether deficiencies get remediated or simply documented and forgotten.

The two principles in this component are:

Principle 16. The organization conducts ongoing or separate evaluations.
Principle 17. The organization evaluates and communicates deficiencies.

The credibility of separate evaluations depends on who performs them. Internal audit teams need to report to the board or audit committee rather than to the management whose controls they’re evaluating. When internal audit reports to the CFO whose financial controls are under review, the results are predictably optimistic.

Not to Be Confused With COSO ERM

COSO has published two separate frameworks. The Internal Control — Integrated Framework, updated in 2013, is the one covered here and the one referenced for financial reporting controls and SOX compliance. The Enterprise Risk Management framework, updated in 2017, is a broader model that integrates risk management with strategy and performance across the entire organization. ERM builds on the internal control framework but has a wider scope. If you are working with the five components and 17 principles, you are working with the 2013 internal control framework.

Inherent Limitations of the Framework

The COSO framework is explicit that internal controls provide reasonable assurance, not absolute assurance. Even a well-designed system has blind spots. People make mistakes, exercise poor judgment, or collude to circumvent controls. Management can override the very controls it designed. External events such as economic downturns, natural disasters, and sudden regulatory changes can overwhelm even robust systems.¹

A company can implement all five components, satisfy all 17 principles, and still experience a control failure. The framework’s value lies in reducing that probability to a reasonable level and catching breakdowns quickly when they occur, not in eliminating risk entirely.

1
SEC Historical Society. Executive Summary – Internal Control Integrated Framework
2
COSO. Internal Control – Integrated Framework
3
Office of the Law Revision Counsel. United States Code Title 15 – 78m
4
Office of the Law Revision Counsel. United States Code Title 18 – 1514A