COSO Five Components of Internal Control | growGRC
COSO Five Components of Internal Control
A practical guide to the five interrelated components of the COSO Internal Control framework and their application in GRC.
Published: 8/20/2026Updated: 8/20/2026By growGRC Editorial Team
Executive Summary
A practical guide to the five interrelated components of the COSO Internal Control framework and their application in GRC.
Key Takeaways
✓COSO Internal Control is organized around five interrelated components.
✓The five components are Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.
✓The components are supported by 17 principles.
✓The components should be evaluated together because weaknesses can affect the overall system.
✓The five Internal Control components are different from the five COSO ERM components.
COSO Five Components of Internal Control
The COSO Internal Control — Integrated Framework organizes an effective system of internal control around five interrelated components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.
These five components provide the structure organizations can use to design, implement, operate, and evaluate internal control. They should be considered together rather than as isolated control categories.
1. Control Environment
The Control Environment establishes the foundation for internal control. It reflects the organization's commitment to integrity and ethical values, oversight, accountability, competence, and an appropriate organizational structure.
Key areas include:
Integrity and ethical values.
Board or oversight responsibility.
Organizational structure and authority.
Commitment to competence.
Accountability for internal control responsibilities.
A strong control environment establishes expectations for how people behave and how control responsibilities are assigned and enforced.
2. Risk Assessment
Risk Assessment provides the basis for identifying and analyzing risks to achieving objectives. It considers risks arising from internal and external factors and includes consideration of fraud risk and significant changes.
Risk assessment commonly involves:
1. Defining relevant objectives.
2. Identifying risks that could affect those objectives.
What are the five COSO Internal Control components?
Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.
How many principles support the five COSO Internal Control components?
The framework is supported by 17 principles distributed across the five components.
Are the five COSO Internal Control components the same as COSO ERM?
No. COSO ERM has a different five-component structure: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, and Information, Communication, and Reporting.
Why are the five components important in GRC?
They provide a structure for connecting objectives, risks, controls, information, monitoring, evidence, deficiencies, and remediation.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
5. Assessing significant changes that could affect the control system.
Risk assessment should be connected to the organization's objectives rather than performed as an isolated exercise.
3. Control Activities
Control Activities are actions established through policies and procedures that help ensure management directives are carried out.
Examples include:
Approvals and authorizations.
Verifications.
Reconciliations.
Reviews of operating performance.
Security controls.
Segregation of duties.
Technology-related control activities.
Control activities can be preventive or detective and may be performed manually, through technology, or through a combination of both.
4. Information and Communication
Information and Communication support the functioning of internal control by ensuring relevant, quality information is obtained, generated, and communicated to appropriate parties.
The component includes:
Relevant and quality information.
Internal communication.
Communication with external parties.
Timely escalation of significant control matters.
Information should be available in a form and timeframe that allows people to carry out their responsibilities and make informed decisions.
5. Monitoring Activities
Monitoring Activities determine whether the components of internal control are present and functioning. Monitoring can be conducted through ongoing evaluations, separate evaluations, or a combination of both.
Monitoring includes:
Ongoing evaluations embedded in business processes.
Separate evaluations.
Identification and communication of deficiencies.
Timely corrective action.
Monitoring helps organizations determine whether controls continue to operate effectively as circumstances change.
How the five components work together
The five components are interrelated.
A practical sequence is:
Objectives → Risks → Control Activities → Information & Communication → Monitoring → Improvement
The Control Environment provides the foundation across the entire system. Risk Assessment identifies and analyzes risks to objectives. Control Activities address relevant risks. Information and Communication provide the information needed to operate and oversee controls. Monitoring evaluates whether the system remains effective.
A weakness in one component can affect the effectiveness of the overall system of internal control.
The 17 principles
The COSO Internal Control framework is supported by 17 principles distributed across the five components:
Component
Number of principles
Control Environment
5
Risk Assessment
4
Control Activities
3
Information and Communication
3
Monitoring Activities
2
Total
17
The principles provide points of focus for evaluating whether the components are present and functioning.
Five components vs. five COSO ERM components
The five Internal Control components should not be confused with the five COSO ERM components.
COSO Internal Control uses:
Control Environment.
Risk Assessment.
Control Activities.
Information and Communication.
Monitoring Activities.
COSO ERM uses:
Governance and Culture.
Strategy and Objective-Setting.
Performance.
Review and Revision.
Information, Communication, and Reporting.
The frameworks are complementary but have different purposes and structures.
Applying the five components in a GRC program
A GRC platform can map organizational processes, risks, controls, evidence, assessments, deficiencies, and remediation activities to the five COSO components.
A practical structure is:
1. Map organizational objectives.
2. Identify risks affecting those objectives.
3. Map relevant controls to risks.
4. Classify controls against the applicable COSO component and principle.
5. Collect control evidence.
6. Test control design and operating effectiveness.
7. Record deficiencies.
8. Track remediation.
9. Monitor the control system.
10. Report results to management and oversight bodies.
The same control may support more than one objective or risk, but the framework mapping should preserve the rationale for each relationship.
Common implementation mistakes
Treating the components as independent silos
The components are interrelated. A GRC program should preserve relationships between objectives, risks, controls, information, monitoring, and governance.
Mapping every control to every component
Mapping should be evidence-based. A control should be associated with a component and principle because its design or operation supports that framework requirement.
Using monitoring only as an annual exercise
Monitoring can include ongoing evaluations embedded in business processes as well as separate evaluations.
Ignoring information quality
A control system can be weakened when information is incomplete, inaccurate, untimely, or not communicated to the people who need it.
Separating risk assessment from objectives
Risk assessment should be connected to relevant objectives. Without that connection, risk registers and control testing can become disconnected from business outcomes.
Example: access management
An access-management process can demonstrate how the components work together.
Control Environment: management establishes accountability for access governance.
Risk Assessment: the organization identifies unauthorized access as a risk to relevant objectives.
Control Activities: access requests, approvals, provisioning, reviews, and removal procedures address the risk.
Information and Communication: access reports and exception information reach responsible personnel.
Monitoring Activities: periodic reviews and separate evaluations identify deficiencies and support corrective action.
The example illustrates the relationship among the components rather than treating each component as a standalone control category.
Conclusion
The five COSO Internal Control components provide a coherent structure for understanding and evaluating an organization's system of internal control.
Control Environment establishes the foundation. Risk Assessment connects risks to objectives. Control Activities address relevant risks. Information and Communication enable the system to function. Monitoring Activities evaluate whether the system continues to operate effectively.
For GRC programs, the greatest value comes from maintaining the relationships among the five components, the 17 principles, organizational objectives, risks, controls, evidence, testing, deficiencies, and remediation.
