The five components of internal control, as defined by the COSO framework, are the control environment, risk assessment, control activities, information and communication, and monitoring activities. They operate together as a system: each one depends on the others, and a weakness in any single component undermines the whole. Publicly traded companies in the United States must document and report on these controls under the Sarbanes-Oxley Act, while private companies, nonprofits, and government agencies adopt the framework voluntarily because it scales to almost any size organization.
The framework was first published by the Committee of Sponsoring Organizations of the Treadway Commission in 1992 and updated in 2013 to add 17 supporting principles distributed across the five components.1COSO. Internal Control – COSO What follows is what each component covers, who has to comply, and what happens when controls fail.
Control Environment
The control environment is the foundation everything else sits on. It reflects the organization’s commitment to integrity and ethical behavior, starting with the board and senior leadership. When executives treat compliance as a genuine priority rather than a box to check, that attitude filters through the organization. When they don’t, no amount of detailed policy will compensate.
A strong control environment needs a clear organizational structure with authority and responsibility well defined. People at every level need to know what they’re accountable for and who they report to. Human resources reinforces this by setting standards for hiring, training, evaluating, and compensating employees based on the competencies each role actually demands. If a finance team lacks the skills to execute controls properly, the controls fail regardless of how well they were designed.
Ethical expectations should be spelled out in a code of conduct and reinforced through consistent discipline when violations occur. Selective enforcement quietly tells everyone that the rules are optional. The board plays a critical role here as well, particularly through its audit committee. Federal law requires that public companies disclose whether at least one audit committee member qualifies as a “financial expert,” meaning someone with experience in accounting principles, financial statement preparation or auditing, internal accounting controls, and audit committee functions.2Office of the Law Revision Counsel. 15 U.S. Code 7265 – Disclosure of Audit Committee Financial Expert An independent, financially literate audit committee provides the oversight that keeps management honest.
Risk Assessment
Risk assessment is the process of identifying what could go wrong and figuring out how much it matters. Organizations set objectives across three categories (operational performance, reliable financial reporting, and compliance with laws and regulations) and risk assessment examines what could prevent them from hitting those objectives.
Risks come from inside and outside. Internal risks might involve IT system failures, turnover in key roles, or gaps in segregation of duties. External risks include economic downturns, new competitors, regulatory changes, or supply chain disruptions. Once identified, each risk needs to be evaluated for likelihood and severity. Management then chooses a response: avoid the activity, reduce the risk through additional controls, share it through insurance or outsourcing, or accept it when the cost of mitigation outweighs the potential impact.
The analysis is never finished. Rapid growth, new product lines, acquisitions, and regulatory changes all introduce fresh risks that need attention. A useful distinction in this work is inherent risk (the exposure that exists before any controls are applied) versus residual risk (what remains after controls are in place). If residual risk is still too high, controls need to be added or the approach needs to change.
Fraud Risk
The 2013 COSO framework explicitly requires organizations to consider fraud when assessing risk. That means evaluating the types of fraud that could occur (fraudulent financial reporting, misappropriation of assets, corruption) and examining three factors that tend to be present when fraud happens: incentive or pressure on individuals, opportunity created by weak controls, and attitudes or rationalizations that let people justify dishonest behavior. Fraud risks that arise specifically from IT systems and access to sensitive information need their own consideration.
Control Activities
Control activities are the specific policies and procedures that carry out management’s risk responses. They happen at every level and across every function, from transaction processing to financial statement preparation.
Segregation of Duties
The most fundamental control activity is segregation of duties. The core idea is straightforward: no single person should be able to initiate a transaction, approve it, record it, and have custody of the resulting asset. Separating these functions means that errors or fraud require collusion between multiple people, which dramatically reduces the chance of either going undetected. In smaller organizations where full separation isn’t practical, detailed supervisory review of related activities serves as a compensating control.
Other Control Activities
Beyond segregation of duties, control activities include physical safeguards over assets such as restricted access to warehouses and data centers. Performance reviews that compare actual results to budgets or forecasts catch problems after they occur. Authorization and approval procedures ensure transactions only go through when they meet criteria set by management. Independent reconciliations, such as matching bank statements to the general ledger, catch discrepancies before they compound. The design of each control should map directly to an identified risk. A control that doesn’t address a specific risk is wasted effort; a risk with no corresponding control is an open exposure.
IT General Controls
Modern financial reporting depends heavily on technology, which makes IT general controls a critical subset of control activities. They typically fall into four categories: access controls over programs and data (who can log in, what they can see and change), program change management (ensuring software changes are tested and approved before going live), program development (controls over building new systems), and computer operations (job scheduling, backup procedures, incident management). Weaknesses here can undermine every application-level control that depends on those systems, which is why auditors test them early in any assessment.
Information and Communication
The other four components can’t function without the right information reaching the right people at the right time. Information and communication addresses how operational, financial, and compliance-related data flows through the organization.
Internally, employees need to understand their roles in the control system and have access to the information required to carry those roles out. This happens through policy manuals, training, and open reporting channels. If a frontline employee spots a potential control weakness but has no clear path to report it, that weakness festers.
Externally, public companies are required to include internal control disclosures in their annual 10-K filings under Item 9A, which covers both disclosure controls and procedures and management’s assessment of internal control over financial reporting.3SEC.gov. Investor Bulletin – How to Read a 10-K Management must state its responsibility for establishing adequate internal controls and provide its assessment of their effectiveness as of the end of the fiscal year.4Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls External communication also includes timely responses to regulatory inquiries and clear information sharing with auditors, customers, and vendors.
Monitoring Activities
Controls degrade over time. People leave, processes change, systems get updated, and workarounds become habits. Monitoring activities continuously assess whether controls are still working as designed and catch deficiencies before they cause real damage.
Monitoring takes two forms. Ongoing monitoring is built into normal operations: supervisory reviews, automated exception reports, and system-generated alerts that flag unusual transactions in real time. Separate evaluations are periodic assessments, typically performed by internal audit or outside consultants, that take a deeper look at whether controls are designed properly and operating effectively.
Internal Audit
Internal audit is the primary mechanism for separate evaluations. The function operates under a formal charter approved by the board or audit committee that defines its purpose, authority, scope, and reporting relationships. Internal auditors test specific controls, report findings to management and the audit committee, and follow up on whether corrective actions are actually taken. Their independence from the operations they audit is essential. If internal audit reports to the CFO whose department it’s evaluating, the objectivity is compromised.
Whistleblower Channels
The Sarbanes-Oxley Act requires public companies to establish procedures for employees to submit confidential, anonymous concerns about questionable accounting or auditing practices. These channels feed directly into the monitoring function by surfacing problems that routine testing might miss. The audit committee is responsible for overseeing how complaints are received, retained, and addressed. Any control deficiency that surfaces, whether through audit testing, a whistleblower report, or an automated alert, must be communicated to the appropriate level of management, and significant deficiencies and material weaknesses must be escalated to the audit committee.5U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports
How the Components Fit Together
The five components aren’t a checklist to work through in order. They operate as an integrated system where weakness in any one area compromises the others. A strong control environment without adequate monitoring will eventually deteriorate as people find workarounds. Excellent monitoring can’t save an organization with no meaningful control activities to monitor. Risk assessment that ignores fraud scenarios leaves a gap that no amount of reconciliation will fill.
Who Has to Comply
The Sarbanes-Oxley Act imposes the most rigorous internal control requirements on publicly traded companies. Section 404(a) requires every public company to include a management assessment of internal controls in its annual report.4Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls Section 404(b) adds a second layer: the external auditor must independently attest to management’s assessment. Smaller reporting companies with annual revenues below $100 million and non-accelerated filers (those with a public float below $75 million) are generally exempt from the auditor attestation requirement, but they still have to perform and report their own management assessment.6eCFR. 17 CFR 240.12b-2 – Definitions
The underlying statutory obligation comes from Section 13(b)(2)(B) of the Securities Exchange Act of 1934. That provision requires systems sufficient to ensure that transactions are properly authorized, recorded accurately enough to prepare reliable financial statements, and that recorded assets are periodically compared to what actually exists.7Office of the Law Revision Counsel. 15 U.S. Code 78m – Periodical and Other Reports
Private companies, nonprofits, and government entities face no federal mandate to follow COSO, but many adopt it anyway. The framework’s principles are broad enough to scale down for a mid-sized nonprofit or up for a multinational. Organizations that accept federal funding, seek external financing, or plan an eventual IPO often find that implementing COSO early saves significant cost compared to retrofitting controls under pressure.
What Happens When Controls Fail
Not all control weaknesses carry the same weight. The PCAOB and SEC use a three-tier classification system, and the category a weakness falls into determines who needs to know about it and what disclosures are required.
A plain deficiency exists when a control is designed, implemented, or operating in a way that doesn’t allow management or employees to catch misstatements in the normal course of their work. Many of these are minor and can be fixed internally. A significant deficiency is serious enough to merit the attention of those responsible for overseeing financial reporting, but not severe enough to qualify as a material weakness. A material weakness exists when there’s a reasonable possibility that a material misstatement in the financial statements won’t be prevented or caught on a timely basis.8PCAOB. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
The practical difference is enormous. If management identifies a material weakness, it cannot conclude that internal controls are effective.9U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Disclosure in Exchange Act Periodic Reports Frequently Asked Questions The weakness must be publicly disclosed in the annual filing, which often triggers a stock price decline, increased audit fees, and heightened regulatory scrutiny.
Criminal Penalties for Executives
Under SOX Section 906, the CEO and CFO must personally certify that each periodic financial report fully complies with securities law requirements and fairly presents the company’s financial condition. An executive who certifies a report knowing it doesn’t meet these standards faces up to $1,000,000 in fines and 10 years in prison. If the false certification is willful, the maximum penalty rises to $5,000,000 in fines and 20 years in prison.10Office of the Law Revision Counsel. 18 U.S. Code 1350 – Failure of Corporate Officers to Certify Financial Reports
Civil Enforcement Against the Company
The SEC brings civil enforcement actions against companies that fail to maintain adequate internal controls, even when no fraud is alleged. Typical actions include cease-and-desist orders, civil monetary penalties, and undertakings requiring the company to retain an independent consultant to oversee remediation. In a 2019 enforcement sweep, the SEC charged four public companies with longstanding internal control failures, imposing penalties ranging from $35,000 to $200,000 and citing violations of Exchange Act Section 13(b)(2)(B) and related rules.11U.S. Securities and Exchange Commission. SEC Charges Four Public Companies With Longstanding ICFR Failures Those dollar amounts may look modest relative to corporate budgets, but the reputational damage and heightened scrutiny that follow an SEC action tend to cost far more than the fine itself.