|
The term "COSO" appears in financial, accounting and newspaper articles. What is COSO and why is it important to businesses of all sizes? COSO stands for the "Committee Of Sponsoring Organizations of the Treadway Commission," a nonprofit commission that in 1992 established a common definition of internal control and created a framework for evaluating the effectiveness of internal controls.
The 2002 Congress, in response to accounting and financial scandals, passed the Sarbanes-Oxley Act. This Act requires public companies to evaluate their internal controls and to publish those findings with their SEC filings. The concepts developed in the COSO Report are generally used as the framework to evaluate internal control.
Although the Sarbanes-Oxley Act is directed at public companies, many privately owned companies and nonprofit organizations are electing to evaluate their systems of internal control using COSO's framework. The manner in which the components of the COSO framework are applied to an organization will depend on the nature and size of the organization.
The COSO framework views internal controls as consisting of the following five interrelated components: - Control Environment
The integrity and ethical values of the company, including its code of conduct, involvement of the Board of Directors and other actions that set the tone of the organization
- Risk Assessment
Management's process of identifying potential risks that could result in misstated financial statements and developing actions to address those risks
- Control Activities
These are the activities usually thought of as "the internal controls." They include such things as segregation of duties, account reconciliations and information processing controls that are designed to safeguard assets and enable an organization to timely prepare reliable financial statements.
- Information and Communication
The internal and external reporting process and includes an assessment of the technology environment
- Monitoring
Assessing the quality of a company's internal control over time and taking actions as necessary to ensure it continues to address the risks of the organization
|
