COSO Framework Explained

The COSO framework is the most widely used model for internal control in the world. Published by the Committee of Sponsoring Organizations of the Treadway Commission, the 2013 Internal Control, Integrated Framework sets out five components and 17 principles that auditors use to judge whether an organisation's controls are effective. Its companion, the 2017 Enterprise Risk Management framework, links risk with strategy and performance.

For technology companies, COSO shows up in three places: SOX compliance for listed companies, SOC 1 and SOC 2 reports for service providers, and investor or client due diligence. In February 2026, COSO also published guidance on internal control over generative AI. This guide explains both frameworks, the IT general controls they rely on, how they connect to SOX and SOC reports, and how software teams can build systems that support them.

What is COSO?

COSO was formed in 1985 to sponsor the National Commission on Fraudulent Financial Reporting, known as the Treadway Commission. Its five sponsoring organisations are the American Accounting Association, the American Institute of Certified Public Accountants (AICPA), Financial Executives International, the Institute of Internal Auditors and the Institute of Management Accountants. COSO publishes frameworks and guidance on internal control, enterprise risk management and fraud deterrence.

Internal control, in COSO's definition, is a process carried out by an entity's board, management and other personnel, designed to provide reasonable assurance about achieving objectives relating to operations, reporting and compliance. Reasonable assurance means controls reduce risk to an acceptable level, not that they eliminate it.

History and current versions

1992: original Internal Control, Integrated Framework.
2004: Enterprise Risk Management, Integrated Framework.
2013: updated Internal Control framework, introducing 17 explicit principles and better coverage of technology, outsourcing and non-financial reporting. The 1992 version was superseded from December 2014.
2017: updated ERM framework, Enterprise Risk Management, Integrating with Strategy and Performance.
2023: supplemental guidance on achieving effective internal control over sustainability reporting.
2026: guidance on achieving effective internal control over generative AI, released in February 2026, alongside practical ERM and governance publications.

Who uses COSO?

US listed companies, whose management must assess internal control over financial reporting (ICFR) under SOX section 404 using a suitable framework.
External auditors evaluating ICFR and controls at service organisations.
Service organisations, such as SaaS, payroll, payments and hosting providers, whose SOC 1 and SOC 2 reports rely on COSO concepts.
Companies preparing for IPO or large investment rounds.
Internal audit and risk teams in organisations of all sizes and in the public sector.

Is it mandatory or voluntary?

COSO is a voluntary framework. However, SEC rules require management of US public companies to base their ICFR assessment on a suitable, recognised framework, and COSO 2013 is used by nearly all of them. Companies outside the US often adopt it because their auditors and investors expect it. There is no organisational certification.

The five components and 17 principles

Component	Principles
Control environment	1. Commitment to integrity and ethical values. 2. Board independence and oversight. 3. Structures, reporting lines and authorities. 4. Commitment to competence. 5. Accountability for internal control responsibilities.
Risk assessment	6. Clear objectives. 7. Identifying and analysing risks. 8. Assessing fraud risk. 9. Identifying and analysing significant change.
Control activities	10. Selecting and developing control activities. 11. Selecting and developing general controls over technology. 12. Deploying controls through policies and procedures.
Information and communication	13. Using relevant, quality information. 14. Communicating internally. 15. Communicating externally.
Monitoring activities	16. Ongoing and separate evaluations. 17. Evaluating and communicating deficiencies.

An effective system of internal control requires all five components and all relevant principles to be present and functioning, and operating together. Each principle has points of focus that help organisations design and assess controls.

Principle 11: general controls over technology

Principle 11 is where COSO meets IT. Organisations must select and develop general controls over technology to support achieving objectives. These IT general controls (ITGCs) typically cover:

Access to programs and data: user provisioning, periodic access reviews, privileged access control, password and MFA policies, and segregation of duties.
Program change: change requests, testing, approval, segregation between developers and those who deploy to production, and emergency change handling.
Program development: controlled development and implementation of new systems, including data migration checks.
Computer operations: job scheduling, backups, incident management and monitoring.

Application controls, such as automated validations, calculations, approval workflows and interface reconciliations, sit within principle 10 and depend on effective ITGCs. If ITGCs fail, auditors cannot rely on application controls or system-generated reports.

Entity-level controls

Not all controls sit in processes or systems. Entity-level controls support the control environment, risk assessment, information and monitoring components across the whole organisation. Examples include a code of conduct with annual acknowledgement, an audit committee that meets regularly with auditors, a whistleblower hotline, background checks for staff in sensitive roles, a documented delegation of authority, a risk assessment reviewed by leadership, and internal audit or management reviews of control results. In smaller technology companies, these are often informal; formalising them is usually one of the first steps before a SOC 2 or SOX program.

Fraud risk

Principle 8 requires organisations to consider the potential for fraud, including fraudulent reporting, misappropriation of assets and corruption, and the incentives, opportunities and attitudes that enable it. For software systems, this translates into controls such as segregation of duties in financial workflows, approval limits, alerts on unusual transactions, restrictions on editing master data such as bank details, and logs that cannot be altered by the people they record. COSO and the Association of Certified Fraud Examiners also publish a Fraud Risk Management Guide with more detail.

Deficiencies and how they are classified

Under principle 17, organisations must evaluate and communicate deficiencies in a timely manner. For SOX purposes, deficiencies are classified by severity. A control deficiency exists when a control's design or operation does not allow staff to prevent or detect misstatements on a timely basis. A significant deficiency sits between the two: not a material weakness, yet serious enough that the audit committee and others overseeing financial reporting should know about it. A material weakness is a deficiency, or combination, with a reasonable possibility that a material misstatement will not be prevented or detected on time. Material weaknesses must be disclosed by public companies, so ITGC failures that could lead to one receive close attention.

COSO ERM 2017

The ERM framework, Enterprise Risk Management, Integrating with Strategy and Performance, is broader than internal control. It focuses on how risk affects strategy selection and performance, and has five components with 20 principles:

Governance and culture (principles 1 to 5): board risk oversight, operating structures, desired culture, core values, and developing capable people.
Strategy and objective-setting (6 to 9): analysing business context, defining risk appetite, evaluating alternative strategies, and formulating business objectives.
Performance (10 to 14): identifying, assessing and prioritising risk, implementing responses, and developing a portfolio view.
Review and revision (15 to 17): assessing substantial change, reviewing risk and performance, and pursuing improvement.
Information, communication and reporting (18 to 20): using information and technology, communicating risk information, and reporting on risk, culture and performance.

COSO ERM is often compared with ISO 31000. Both are compatible; COSO ERM is more detailed on strategy and governance, while ISO 31000 is shorter and international.

COSO, SOX, SOC 1 and SOC 2

SOX: management uses COSO 2013 to assess ICFR, and auditors of larger filers attest to it. ITGCs over financial systems are a major part of testing.
SOC 1: reports on a service organisation's controls relevant to clients' financial reporting, used by clients' auditors in their COSO-based assessments.
SOC 2: the AICPA Trust Services Criteria common criteria CC1 to CC5 are organised around the 17 COSO principles, so a SOC 2 examination effectively evaluates COSO components for a service organisation's system.

For SaaS companies, this means building COSO-aligned controls pays off twice: once for SOC 2 and again when public-company clients rely on SOC 1 reports or ask about ITGCs.

Generative AI guidance (2026)

COSO's 2026 publication on achieving effective internal control over generative AI applies the 2013 framework's components and principles to GenAI. According to published summaries, it groups GenAI uses into capability types so controls can be designed around what a system does, emphasises inventories of AI use cases, clear ownership, controls over data inputs and outputs, human review of AI-assisted judgements, monitoring for model drift and errors, and managing unapproved "shadow AI" use as a control environment issue. Auditors are expected to refer to it when assessing AI that affects financial reporting or other controls.

How to implement COSO, step by step

Define objectives for reporting, operations and compliance in scope.
Assess risks, including fraud and significant changes, for each objective.
Map processes and systems that support those objectives.
Design controls: entity-level controls for the control environment, process-level controls, application controls and ITGCs.
Document controls in a risk and control matrix with owners, frequency and evidence.
Test design and operating effectiveness through internal reviews or internal audit.
Remediate deficiencies and report significant ones to leadership and the audit committee.
Monitor continuously and update for changes such as new systems, acquisitions or AI tools.

Documentation you will need

Code of conduct, board and committee charters, and organisation charts.
Risk assessment including fraud risk.
Process narratives or flowcharts.
Risk and control matrix.
ITGC policies and evidence: access reviews, change tickets, backup logs.
Test results and deficiency logs.
Reports to management and the audit committee.
SOC reports from key service providers, with complementary user entity controls addressed.

Timeline and cost considerations

A company preparing for its first SOX cycle typically spends 12 to 18 months building and testing controls. A SaaS provider preparing a first SOC 2 report can design COSO-aligned controls in three to six months. Costs include staff time, advisory support, GRC tools and audit fees. Building access control, change management and logging into systems from the start is far cheaper than retrofitting them.

Benefits and limitations

Benefits: universally recognised by auditors; links governance, risk and control; scales from small companies to large groups; supports SOX, SOC reports and investor due diligence.
Limitations: provides reasonable, not absolute, assurance; can become documentation-heavy; the 2013 framework is not specific about cybersecurity detail, so organisations add frameworks such as NIST CSF or COBIT.

Common mistakes for technology companies

Developers with production deploy rights and no review, breaking segregation of duties.
Access reviews done but not evidenced, or done by people who cannot judge appropriateness.
Shared admin accounts with no individual accountability.
Spreadsheets and reports used in controls without checking completeness and accuracy of the data.
Ignoring complementary user entity controls listed in vendors' SOC reports.
Unmanaged AI tools used in financial or customer processes.

Best practices, tools and technologies

Use SSO and role-based access with automated joiner, mover and leaver processes.
Enforce pull request reviews and pipeline-based deployments so changes are approved and traceable.
Keep immutable audit logs for financial and administrative actions.
Generate reports from controlled queries with parameters and change history.
Automate evidence collection for access reviews and changes.
Inventory AI use cases and apply review controls to AI outputs used in decisions.

We build role-based access, approval workflows, audit trails and controlled deployments into business software through our web application development and SaaS product services.

How COSO relates to other frameworks

Framework	Relationship
SOX	Law requiring ICFR assessment; COSO 2013 is the framework used.
SOC 2	Common criteria built on the 17 COSO principles.
SOC 1	Service organisation controls relevant to clients' financial reporting.
COBIT	IT governance framework often used to detail IT controls under COSO.
ISO 31000	International risk guidelines compatible with COSO ERM.

Real-world example

A US fintech preparing for IPO uses an Indian engineering partner to build its lending platform. Its auditors will test ITGCs over the loan servicing system. The team configures SSO with role-based access and quarterly access reviews exported automatically, requires two approvals and passing tests for every production deployment, restricts direct database access to a break-glass account with alerting, logs all changes to interest rate tables, and documents these controls in a risk and control matrix. The partner's own SOC 2 report covers its development environment, and the fintech maps the report's complementary user entity controls to its own processes.

Next steps

Identify which objectives and systems need COSO-aligned controls.
Strengthen ITGCs: access, change, operations.
Build a risk and control matrix.
Test and remediate.
Review AI use against the 2026 guidance.

Frequently asked questions

What is the COSO framework?

A widely used framework for internal control, with five components and 17 principles, published by the Committee of Sponsoring Organizations of the Treadway Commission.

Is COSO mandatory?

It is voluntary, but US public companies effectively must use it, or a similar recognised framework, for SOX internal control assessments.

What are the five components of COSO?

Control environment, risk assessment, control activities, information and communication, and monitoring activities.

What is the difference between COSO internal control and COSO ERM?

Internal control focuses on reliable reporting, operations and compliance; ERM links risk with strategy and performance.

How does COSO relate to SOC 2?

SOC 2 common criteria CC1 to CC5 are organised around the 17 COSO principles.

What are IT general controls?

Controls over access, program change, development and computer operations that support reliable systems, required under COSO principle 11.

Can a company be COSO certified?

No. COSO offers certificates for individuals, but organisations are assessed by auditors, not certified.

Does COSO cover cybersecurity?

At a principle level through technology controls; organisations add NIST CSF or similar frameworks for detail.

What did COSO publish on generative AI?

In February 2026, guidance applying the internal control framework to generative AI use, covering inventories, ownership, data and output controls and monitoring.

Is COSO used outside the US?

Yes. Many organisations worldwide use it because auditors and investors recognise it.

Which COSO framework do SOX programs use?

The 2013 Internal Control, Integrated Framework, which replaced the 1992 version from December 2014.