COSO ICIF: Integrated Internal Control

Purpose

The COSO Internal Control framework provides a structure for designing, implementing and assessing controls linked to operations, reporting and compliance objectives. The 2013 edition organizes the framework around five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

GRC use

An organization defines objectives and responsibilities, identifies relevant risks, establishes control activities and obtains information to oversee how they operate. Assessment should consider both control design and operation, with deficiencies communicated in a timely manner.

Distinction and boundaries

ICIF addresses internal control and should not be conflated with COSO ERM, which focuses on integrating risk with strategy and performance. A system of internal control provides reasonable assurance, not absolute certainty.

Assessment in an organization

Connect each relevant objective to risks that could prevent it and to control responses assigned to owners. Obtain evidence of both design and operation: an approved policy alone does not show that an activity is performed consistently. Define how deficiencies are escalated, who assesses their severity and how remediation is verified. Consider limitations such as judgment, human error, collusion and organizational change.

Illustrative example

In a payment process, segregation of duties may be part of the design; transaction samples, approval records and exception follow-up can help assess operation. Evidence and conclusions should match the objective and defined scope.

Designing and assessing controls

Start by defining the objective and process scope. Identify what could prevent the objective and design responses assigned to people with authority and resources. Combine preventive and detective controls as appropriate to the risk; consider access, authorization, reconciliation, review and technology controls without assuming a written policy proves operation. Establish how exceptions are reported and underlying causes addressed.