AICPA internal controls are built on the COSO Internal Control–Integrated Framework, a system of five components and 17 principles that organizations use to design controls and that auditors use to evaluate them. The AICPA’s Auditing Standards Board sets the auditing standards that apply when a private company, nonprofit, or other nonissuer is audited under this framework; public companies fall under separate PCAOB standards that share the same COSO foundation.
The COSO Framework Behind the Standards
The Committee of Sponsoring Organizations of the Treadway Commission was organized in 1985 to study the factors behind fraudulent financial reporting.1COSO. COSO Home Its Internal Control–Integrated Framework, originally issued in 1992 and updated in 2013, is the dominant blueprint for structuring and assessing internal control systems in the United States.2Committee of Sponsoring Organizations of the Treadway Commission. Guidance on Internal Control
The framework aims for reasonable assurance in three areas: the effectiveness of operations, the reliability of financial and non-financial reporting, and compliance with applicable laws and regulations. “Reasonable assurance” is deliberate language. No control system can guarantee perfection, and the framework acknowledges that. What it provides is a structured way to identify where things can go wrong and build processes to catch or prevent problems before they become material.
Management uses the framework to document how their processes reduce the risk of material misstatement, and that documentation becomes the starting point for any external audit of the control environment. In 2023, COSO extended its reach with supplemental guidance on effective internal control over sustainability reporting.2Committee of Sponsoring Organizations of the Treadway Commission. Guidance on Internal Control
The Five Components of Internal Control
All five components must function effectively and work together. A breakdown in any single component undermines the whole structure.
Control Environment
The control environment sets the tone for the organization and influences how seriously people take their control responsibilities. It covers leadership’s commitment to integrity and ethical values, the competence expected of personnel, and how the board of directors exercises independent oversight. If the board is passive or management treats compliance as a checkbox exercise, the best-designed controls won’t save the organization. A weak control environment compromises everything built on top of it.
Risk Assessment
Risk assessment is the process management uses to identify and analyze threats to reporting objectives. It has to consider internal factors like rapid growth, new product lines, or turnover in key accounting positions, and external factors like regulatory changes or economic shifts. Management first needs to define its objectives clearly enough that failures can be identified; you cannot assess risk against a vague goal. Fraud risk gets particular attention, requiring management to consider the opportunities, pressures, and rationalizations that could lead employees or executives to manipulate financial data.
Control Activities
Control activities are the specific policies and procedures that carry out management’s risk-mitigation directives. They range from transaction approvals and account reconciliations to physical controls over inventory and equipment. This is the most visible part of the control system, the actual checks and processes people perform every day.
A core principle is segregation of duties: no single person should be able to authorize a transaction, maintain custody of the resulting asset, and record that transaction in the accounting system. When one person handles all three functions, the opportunity for errors and fraud increases dramatically because there is no independent check on their work.
Technology controls belong here too. IT general controls, often called ITGCs, govern user access management, change management for financial applications, data backup procedures, and system security. If an unauthorized person can modify the accounting software or access the general ledger without detection, automated controls built into that system become unreliable. Auditors test ITGCs specifically because a failure at this level can undermine dozens of downstream application controls at once.
Information and Communication
Relevant, high-quality information has to reach the right people at the right time. For financial reporting, the accounting system must accurately initiate, record, process, and report transactions while maintaining accountability for related assets. Information also has to flow upward from operations to management, downward from management to staff, and outward to regulators and auditors. Personnel need to understand their specific control responsibilities. Policy manuals and training programs are the typical vehicles, though the real test is whether people actually know what to do when something goes wrong.
Monitoring Activities
Monitoring is how the organization confirms that controls continue to work over time. It takes two forms: ongoing monitoring built into daily operations through supervisory review and continuous reconciliation, and separate evaluations through periodic internal audits or targeted management reviews. Most organizations use both.
When monitoring identifies a control deficiency, the organization must communicate it to the appropriate level of management and correct it promptly. Severity determines who needs to know. Routine gaps might stay at the operational level, while significant deficiencies and material weaknesses must reach the board and external auditors.3Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements
The 17 Principles Behind the Five Components
The 2013 update to the COSO framework introduced 17 specific principles that give concrete meaning to the five components. Each principle represents a fundamental concept that must be present and functioning for the related component to be effective. These principles are what management actually documents and what auditors actually test. The five components alone are too abstract to evaluate directly.
The control environment maps to five principles covering integrity and ethical values, board oversight independence, organizational structure, commitment to attracting competent personnel, and accountability enforcement. Risk assessment maps to four principles addressing suitable objectives, risk identification and analysis, fraud risk assessment, and evaluating significant changes in the business environment.
Control activities include three principles: selecting and developing control activities that mitigate risks, selecting and developing general controls over technology, and deploying controls through documented policies and procedures. Information and communication maps to three principles covering information quality, internal communication, and external communication. Monitoring covers two: conducting evaluations and communicating deficiencies. Together, these 17 principles give organizations a concrete checklist for building and assessing their control systems.
Who the AICPA’s Standards Actually Cover
This is where experienced professionals sometimes get tripped up. The AICPA does not set audit standards for public companies. Two separate bodies govern auditing standards depending on whether the company is publicly traded.
The AICPA’s Auditing Standards Board (ASB) sets standards for nonissuers, meaning private companies, nonprofits, and other entities outside the SEC’s issuer definition.4AICPA & CIMA. AICPA Auditing Standards Board (ASB) The Public Company Accounting Oversight Board (PCAOB) sets the standards for issuers that file financial statements with the SEC. SOX 404 compliance, integrated audits, and separate opinions on internal control over financial reporting fall under PCAOB authority, not AICPA authority.
Both frameworks require auditors to understand a client’s internal controls. Under AICPA standards (AU-C Section 315), auditors of private companies must gain an understanding of the entity and its environment, including internal controls, to assess the risks of material misstatement. Under PCAOB standards (AS 2201), auditors of public companies go further and issue a separate opinion on internal control over financial reporting as part of an integrated audit.5Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of Financial Statements The concepts overlap heavily, but the scope and reporting obligations differ.
How Auditors Evaluate Internal Controls
Whether operating under PCAOB or AICPA standards, the auditor’s evaluation follows a similar logic. It starts with understanding the design of controls, often through a walk-through where the auditor traces a single transaction from initiation through recording to confirm how the control system actually works in practice.
Design effectiveness asks a simple question. If this control operates as intended by someone with the proper authority and competence, would it actually prevent or detect a material misstatement?5Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of Financial Statements A poorly designed control is useless no matter how consistently it’s performed.
If the design is sound, the auditor moves to operating effectiveness, testing whether the control actually functions as designed. The primary procedures are inquiry (asking personnel how they perform the control), observation (watching them do it), inspection (reviewing the documentation trail), and re-performance (the auditor independently executing the control, such as recalculating a bank reconciliation or re-matching a purchase order to a receiving report and invoice).
Control testing directly determines how much substantive testing the auditor must perform. Substantive testing means directly verifying account balances and transactions. When controls work well, the auditor can rely on them and reduce substantive procedures. When controls fail, the auditor compensates by significantly expanding direct testing of balances, often moving that work closer to the balance sheet date to shorten the window for undetected errors.
Deficiency Classifications and Communication
Not all control problems are equal. Auditing standards classify deficiencies into two categories with different consequences.
A significant deficiency is a control weakness, or combination of weaknesses, that is less severe than a material weakness but still important enough to deserve attention from those overseeing financial reporting. A material weakness is a control weakness, or combination of weaknesses, where there is a reasonable possibility that a material misstatement in the annual or interim financial statements will not be prevented or detected on a timely basis.3Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements
The auditor must communicate both categories in writing to management and the audit committee before issuing the audit report, and the communication has to clearly distinguish between the two.3Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements If a company has no separate audit committee, the communication goes to the full board of directors.
SOC Reports for Outsourced Processes
Many companies outsource financial processes such as payroll, transaction processing, or data hosting to third-party service providers. When a service organization handles processes relevant to a client’s financial reporting, the client’s auditor needs assurance that the outsourced controls are effective. That is what SOC reports address.
A SOC 1 report, governed by the AICPA’s Statement on Standards for Attestation Engagements (SSAE 18), focuses on controls at a service organization that are relevant to user entities’ internal control over financial reporting.6AICPA & CIMA. Standards and Statements The report comes in two types. Type I evaluates the design of controls at a point in time. Type II evaluates both design and operating effectiveness over a period, typically six to twelve months. Type II reports carry more weight because they demonstrate that controls actually worked over a sustained period, not just that they looked good on paper.
If your company relies on an outsourced service provider for any process that feeds into financial reporting, your auditor will almost certainly ask for that provider’s SOC 1 report. If the provider can’t produce one, or if the report reveals control deficiencies, that gap becomes your company’s problem to address, either through additional controls on your end or through expanded audit testing.