COSO Internal Control · Integrated Framework (2013)
COSO internal control implementation consulting for controls your board and auditors can rely on.
The COSO Internal Control — Integrated Framework gives management and the board a shared language for deciding whether controls over operations, reporting and compliance actually work. Sterling's expert and experienced consultants map your controls to the five components and seventeen principles, close the gaps with your process owners and set up the evaluations that show the system is present and functioning. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced internal control consultants, building control and governance systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify, and COSO offers no certificate for organisations
8,100+ client engagements in 60+ countries.
COSO internal control client experience
What it is
What is the COSO Internal Control — Integrated Framework and what is it used for?
The framework is published by COSO, whose stated mission covers internal control, risk management, governance and fraud deterrence. It describes internal control as a system that supports three categories of objectives: operations, reporting and compliance. The system is built from five components, and seventeen principles explain what each component needs in order to work.
Organisations use it to design controls consistently, assign ownership and reach a defensible conclusion on whether the whole system is effective. It is principles-based, so it gives no list of controls to copy. This page covers the internal control framework itself; readiness for a statutory report on internal control over financial reporting, and COSO's separate enterprise risk management framework, each have their own page.
Current edition. Internal Control — Integrated Framework, published by COSO in May 2013. COSO states that the 2013 framework superseded the original 1992 framework on 15 December 2014. COSO also names two companion publications, illustrative tools for assessing effectiveness and a compendium of approaches and examples for internal control over external financial reporting, and in 2023 released supplemental guidance on achieving effective internal control over sustainability reporting using the same framework.
Who it is for
Who needs to implement the COSO internal control framework?
No certificate hangs on the wall at the end, so the reason for adopting COSO is always a question somebody needs answered with evidence. Organisations come to Sterling from four directions:
- Investors, lenders or customers ask how your controls are governed. Due diligence questionnaires, banking covenants and outsourcing contracts increasingly ask which control framework you follow and how you know it works.
- A tender or public-sector buyer expects a recognised framework. Referring to COSO, and showing a principle-by-principle assessment, answers the question in terms evaluators recognise.
- A regulator, audit committee or external auditor has raised control findings. Recurring deficiencies usually point to a missing component, such as risk assessment or monitoring, rather than one broken control.
- A group parent wants one control language across subsidiaries. Acquisitions, shared service centres and new countries need controls that the parent can compare and consolidate.
The benefit comes from controls that owners operate and management evaluates. Naming COSO in a policy without that evaluation changes nothing.
Requirements
What are the main COSO internal control requirements?
COSO calls them components and principles rather than clauses, and they are expectations to meet, not controls to copy. Each principle has to be met by controls suited to your objectives and risks. The list below summarises the principles in plain language under the component each belongs to; during the programme your controls are mapped to the framework's full wording, principle by principle.
- Control environment, principles 1 to 5: integrity and ethical values, a board that is independent of management and oversees internal control, structures and authorities set by management under board oversight, competent people attracted and retained, and individuals held accountable for their control duties.
- Risk assessment, principles 6 to 9: objectives clear enough to identify risks against, risks identified and analysed across the entity, the potential for fraud considered, and significant changes identified and assessed.
- Control activities, principles 10 to 12: activities chosen to bring risks down to acceptable levels, general controls over technology, and activities put into effect through policies and procedures.
- Information and communication, principles 13 to 15: relevant, quality information used to support internal control, internal communication of control objectives and responsibilities, and communication with external parties on matters that affect internal control.
- Monitoring activities, principles 16 and 17: ongoing or separate evaluations that confirm whether each component is present and functioning, and deficiencies reported promptly to those who must correct them, including senior management and the board where appropriate.
What does useful COSO internal control evidence look like?
A risk and control matrix that links each key risk to its controls, owners and the principle it supports; a code of conduct with acknowledgements; board and audit committee minutes showing oversight; delegation-of-authority rules; access and change records for key systems; test results from control evaluations; and a deficiency log showing severity, owner and closure. Sterling helps you keep only the evidence that proves a control operated, held in Effivity so an evaluator can follow it from risk to result.
Implementation route
How do you implement the COSO internal control framework?
Because nobody certifies COSO alignment, the route ends in an evaluation of effectiveness that management owns and can defend, backed where you choose by internal audit or an independent reviewer. Sterling prepares and supports that evaluation; it does not issue the conclusion.
- 01Set the objectives and the entities in scope.Agree which operations, reporting and compliance objectives the system covers, and which companies, sites and processes are included.
- 02Gap analysis: map today's controls to the seventeen principles.The gap analysis shows which principles are well supported, which rely on informal practice and which have nothing behind them, with actions, owners and dates.
- 03Design, document and embed the controls.Build the risk and control matrix, write proportionate policies and procedures, fix technology controls and train the control owners.
- 04Test controls and classify deficiencies.Walkthroughs and tests of design and operation, with each deficiency rated, reported and corrected with evidence.
- 05Reach and report the effectiveness conclusion.Management concludes on each component and principle, the board or audit committee reviews it, and monitoring continues on a set cycle.
Check the route before you sign. No body certifies an organisation against COSO; COSO's own IC Certificate is awarded to individuals who complete its course and exam. Be wary of any offer of a "COSO certificate" for your company, and if you need an external opinion on your controls, confirm who will give it, under which professional standard, and whether your auditor or regulator will accept it.
Cost
How much does COSO internal control implementation cost?
Cost follows the processes and entities in scope and how much control already exists. A single company with documented controls needs far less than a group aligning several subsidiaries for the first time.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Control maturity, the number of entities and processes, and whether you choose Design™ or Drive™ |
| Independent review, if you commission one | The reviewer's scope, sample sizes and locations, priced by that reviewer |
| Internal resources | Control owner time, finance and IT involvement, testing and remediation work |
| Software and learning | Included in a Sterling engagement: Effivity for the control system and Sterling Academy access, with users and access period set out in the proposal |
| Continued support | Retesting, control changes and later evaluation cycles under Sustain™ |
What moves the price
- Objectives in scope: operations, reporting, compliance or all three
- Legal entities, locations and business processes covered
- Whether a reliable risk and control matrix already exists
- The number of systems needing general controls over technology
- How much testing internal audit will carry, and the board's deadline
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions in writing
- Any independent reviewer's fees kept apart, so totals compare fairly
- Effivity, training and Academy access itemised at no additional cost
- Payments linked to deliverables rather than dates
- One all-inclusive proposal. No surprises, ever
Timeline
How long does COSO internal control implementation take?
The pace depends on how many controls are new, how quickly owners are trained and how long controls must run before testing means anything; a quarterly review cannot be tested until it has happened. As an estimate, reaching a first full evaluation of all five components typically takes 4 to 9 months, with larger groups taking longer.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to process owners, existing matrices, policies and prior audit findings |
| Design and embedding | How many controls are new or redesigned, approvals and owner training |
| Operation and testing | Controls running long enough to be sampled, including periodic ones |
| Conclusion and reporting | Remediation of deficiencies and the audit committee's meeting calendar |
If the board or a lender has set a date, share it at the outset and we will say what can be achieved by then.
Your engagement
What your COSO internal control engagement includes
Sterling does not certify, attest to or validate your internal control; management owns the conclusion, and any independent opinion comes from the reviewer you appoint.
Scope, gap analysis and plan
Objectives, entities and a principle-by-principle gap list with owners and dates.
Risk and control matrix
Key risks linked to controls, owners, frequencies and the evidence each produces.
Effivity ISO & GRC software
Your control system runs in Effivity from the start, included with the engagement at no additional cost.
Training for control owners
Internal auditor training for your evaluation team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Testing and deficiency closure
Walkthroughs and tests conducted or supported as agreed, with deficiencies closed on evidence.
Effectiveness report
A component-by-component summary for management and the audit committee.
You choose the level of support, as alternatives rather than stages. Under Design™, the guided route, your finance, risk and process teams do the build while Sterling supplies the method, templates, reviews and coaching. Under Drive™, the managed route, Sterling's consultants carry the documentation, walkthroughs and test preparation with your owners' input. Once the first evaluation is complete, Sustain™ keeps the monitoring cycle, retesting and changes to the control set on schedule, and Automate™ is Effivity, where the controls, tests and deficiencies are run.
Conclusions on the effectiveness of internal control remain with management and the board.
Often combined with
Standards organisations pair with COSO Internal Control
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
- Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
- BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
- CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
- COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
Effivity · ISO and GRC software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the COSO Internal Control — Integrated Framework (2013).
Each Sterling COSO internal control engagement includes Effivity, the ISO and GRC automation platform from the Sterling group, used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so the risk register, the control library, test plans, deficiencies, policies, training records and board reporting sit in one place, controls are performed and recorded in daily work, and an evaluator reviews a running system rather than a spreadsheet. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Code of conduct, authorities and accountability
The code, its annual acknowledgements, the delegation-of-authority matrix and control owner assignments held together, so tone at the top is recorded rather than asserted.
Board oversight and competence
Audit committee agendas, decisions and follow-up actions, alongside role profiles and training records for the people who run key controls.
Objectives and risk register
Objectives linked to the risks that threaten them, each scored, owned and reviewed on a cycle, with a trigger for reassessment when the business changes.
Fraud risk and change
Fraud scenarios assessed beside operational risks, and significant changes such as acquisitions, new systems or new markets logged and assessed before they land.
Control library and risk and control matrix
Each control described once, linked to its risks and principles, its frequency and owner, and the evidence it produces each time it runs.
Policies, procedures and communication
Controlled policies and procedures with versions and approvals, read-and-understood records, and a log of what was communicated to staff and external parties.
Control testing and deficiency tracking
Test plans, samples and results, with deficiencies rated, assigned and closed with evidence, and a status view for management and the audit committee.
Your own workflows and reports
Forms, approval paths, dashboards and board packs shaped to how you work, without code; regulatory obligations tracked to the controls that address them.
What this means at the evaluation
An internal auditor or external reviewer will ask for the risk and control matrix, a sample of control executions, the latest test results and the open deficiencies with their owners. In Effivity each is a screen with dates and evidence attached, not a folder rebuilt the week before. After the first evaluation, Sustain™ runs in the same workspace, so the next cycle starts from a system that kept running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your existing matrices, policies and registers migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS, FSMS and more when you integrate other standards
Sterling Academy · e-learning for your people
Help every control owner understand their part, not just finance and audit.
Sterling Academy provides e-learning for employees and for the people who run your control system: short video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner that can be checked online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for employees whose everyday tasks include a control
- Learning for process owners, risk leads and those who test controls
- Internal auditor training for your evaluation team, as applicable to your standard, as part of the engagement
- Completion records that support the competence expected under the control environment
- New joiners trained as they arrive, so records stay current between evaluations
- A Sterling consultant available when a learner has a question
Keep exploring
Explore more about COSO Internal Control
COSO internal control resources
Services for COSO Internal Control
Why Sterling
Want an effective COSO internal control system? Come to Sterling.
Internal control earns trust when control owners understand their controls and management can show they work. Sterling brings management system discipline: clear ownership, lean documentation and evidence produced as work is done.
Control systems in 60+ countries since 2003
Governance, risk and compliance programmes delivered for groups and single entities in every region we serve, with one engagement team accountable across every country in scope.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any independent reviewer's fees shown separately. No surprises, ever.
Controls that fit the work
Fewer, better controls tied to real risks, so owners perform them as part of the job rather than as a quarterly scramble.
Expert and experienced consultants
Consultants who have built control, risk and management systems across sectors and countries since 2003, and who design your control set so the evaluation confirms what already operates.
The Sterling Promise
What our COSO internal control success guarantee means
We stay with you until your agreed COSO internal control outcome is achieved, through design, the operating period, testing and the correction of any deficiencies found.
The engagement identifies the framework, objectives, scope, outcome and responsibilities. Your organisation supplies accurate information and operates the agreed controls. Management and the board own the effectiveness conclusion, and any independent reviewer forms its own opinion. Our commitment concerns the agreed consulting support, not a promise of every future audit result or error-free reporting.
FAQs
Frequently asked questions about the COSO internal control framework
Can a company be COSO certified?
No. COSO publishes the framework but runs no certification scheme for organisations. Its IC Certificate, offered with the AICPA, IIA, FEI and IMA, is awarded to individuals who complete the course and pass the exam; it says nothing about their employer's controls.
Is COSO only about financial reporting?
No. The framework covers operations, reporting and compliance objectives. Many start with financial reporting, then extend the same components to operations and compliance.
Do we have to replace our existing controls to align with COSO?
No. Most organisations already run many of the controls COSO expects, such as approvals, reconciliations and access reviews, without linking them to a framework. The gap analysis keeps what works, maps it to the principles and adds controls only where a principle has nothing behind it.
Can COSO be used for sustainability or ESG reporting?
Yes. In 2023 COSO released supplemental guidance on achieving effective internal control over sustainability reporting, built on the same framework. We apply the same components and principles to your ESG data, from collection at site level to the figures in the published report.
How does COSO relate to ISO 31000 and ISO 37301?
They work well together. ISO 31000 gives guidance on managing risk, ISO 37301 sets requirements for a certifiable compliance management system, and COSO shows how controls are designed and judged across the organisation. Shared elements such as risk assessment, training and monitoring are built once.
Keep exploring
More on COSO Internal Control and related standards
More in Financial services, payments & AML
Talk to a consultant
Build COSO internal control your board can stand behind.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice