COSO Framework: Internal Control and ERM Explained | growGRC
COSO Framework: Internal Control and Enterprise Risk Management Explained
A practical overview of the COSO ecosystem, explaining the Internal Control Framework, its five components and 17 principles, and how COSO ERM connects risk with strategy and performance.
Published: 8/20/2026Updated: 8/20/2026By growGRC Editorial Team
Executive Summary
COSO provides recognized frameworks for internal control and enterprise risk management. The Internal Control Framework uses five components and 17 principles, while COSO ERM integrates risk with strategy and performance through five components and 20 principles.
Key Takeaways
✓COSO is an ecosystem of governance, internal control, and enterprise risk management guidance.
✓The COSO Internal Control Framework has five components and 17 principles.
✓COSO ERM connects risk management with strategy and performance.
✓COSO provides reasonable assurance, not absolute assurance.
✓Effective implementation links objectives, risks, controls, information, and monitoring.
COSO Framework: Internal Control and Enterprise Risk Management Explained
The COSO Framework is a widely used reference point for designing, implementing, evaluating, and improving governance, risk management, and internal control. COSO is the Committee of Sponsoring Organizations of the Treadway Commission. Its guidance is especially important for organizations that need a structured way to understand how objectives, risks, controls, information, oversight, and accountability fit together.
COSO is best understood as an ecosystem of frameworks rather than a single checklist. Two of its most important frameworks are the COSO Internal Control — Integrated Framework and COSO Enterprise Risk Management — Integrating with Strategy and Performance. The first focuses on internal control and the achievement of objectives; the second places risk within strategy and performance management.
Direct answer
The COSO Framework provides principles and concepts that organizations can use to establish effective internal control and enterprise risk management. The COSO Internal Control Framework is organized around five integrated components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Its 17 principles provide more specific expectations for evaluating whether those components are present and functioning.
COSO ERM complements this perspective by connecting risk with strategy and performance. It helps organizations consider risk when setting objectives, executing strategy, responding to uncertainty, reviewing performance, and reporting information.
COSO is therefore not simply a list of controls. It is a structured way to think about how an organization governs itself, identifies and responds to uncertainty, performs activities, communicates information, and monitors whether its system remains effective.
Why COSO matters
Organizations operate with competing objectives, uncertainty, regulatory requirements, operational dependencies, technology risks, and changing business conditions. A control framework gives management and boards a common language for addressing those challenges.
COSO is valuable because it connects individual controls to broader organizational objectives. A control should not exist only because a procedure has always been performed. It should support a defined objective, address a relevant risk, operate within an appropriate control environment, use reliable information, and be subject to monitoring.
This perspective is useful for governance, risk, compliance, internal audit, financial reporting, operational resilience, cybersecurity governance, and other control-intensive activities.
The COSO Internal Control Framework
The COSO Internal Control — Integrated Framework was refreshed in 2013. It describes internal control as a process, effected by an entity's board, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives.
The framework uses three broad categories of objectives:
Operations objectives, relating to effectiveness and efficiency of operations.
Reporting objectives, relating to internal and external financial and non-financial reporting.
Compliance objectives, relating to adherence to applicable laws and regulations.
The framework is structured around five components.
1. Control environment
The control environment establishes the foundation for internal control. It includes factors such as integrity and ethical values, oversight by the board, management's approach to responsibility and accountability, organizational structure, competence, and accountability.
A strong control environment makes control responsibilities explicit and reinforces the expectation that people act consistently with organizational values and objectives.
2. Risk assessment
Risk assessment involves identifying and analyzing risks that could affect the achievement of objectives. It considers how risks may arise from internal or external changes and includes consideration of fraud risk.
Risk assessment should be connected to objectives. An organization cannot meaningfully assess risk without first understanding what it is trying to achieve.
3. Control activities
Control activities are actions established through policies and procedures to help ensure that management's directives are carried out. They may include authorizations, approvals, reconciliations, reviews, segregation of duties, access controls, and other preventive or detective mechanisms.
Effective control activities are designed around specific risks and objectives rather than implemented as disconnected administrative tasks.
4. Information and communication
Information and communication support the organization's ability to carry out internal control responsibilities. Relevant, quality information needs to reach people who need it, when they need it.
Communication operates internally and externally. It includes the flow of information between functions, levels of management, governing bodies, and relevant external parties.
5. Monitoring activities
Monitoring determines whether the components of internal control are present and functioning. It can include ongoing evaluations, separate evaluations, or a combination of both.
Deficiencies identified through monitoring should be communicated to the appropriate parties and addressed in a timely manner.
The 17 COSO principles
The five components are supported by 17 principles that make the framework more actionable.
The Control Environment component contains principles addressing integrity and ethical values, oversight responsibility, structure and authority, competence, and accountability.
Risk Assessment covers principles concerning suitable objectives, risk identification and analysis, fraud risk, and identification and assessment of significant change.
Control Activities addresses selecting and developing control activities, technology-related controls, and deployment of controls through policies and procedures.
Information and Communication addresses the use of relevant quality information, internal communication, and external communication.
Monitoring Activities addresses ongoing or separate evaluations and communication of control deficiencies.
Together, the components and principles provide a way to assess whether an internal control system is designed and operating effectively.
COSO and Enterprise Risk Management
COSO ERM is related to internal control but has a broader risk-management orientation. The COSO ERM framework published in 2017 is titled Enterprise Risk Management — Integrating with Strategy and Performance.
Its central idea is that risk management should be integrated with how an organization creates, preserves, and realizes value. Risk should therefore be considered during strategy and objective-setting, performance management, review, and reporting.
COSO ERM is organized into five interrelated components:
1. Governance and Culture.
2. Strategy and Objective-Setting.
3. Performance.
4. Review and Revision.
5. Information, Communication, and Reporting.
The ERM framework contains 20 principles associated with those components.
COSO Internal Control vs. COSO ERM
COSO Internal Control and COSO ERM should not be treated as interchangeable.
Area
COSO Internal Control
COSO ERM
Primary focus
Internal control
Enterprise risk management
Main perspective
Objectives and control effectiveness
Risk, strategy, and performance
Core structure
Five components and 17 principles
Five components and 20 principles
Typical use
Control design, evaluation, reporting, compliance
Risk-informed strategy and performance
Relationship
Provides a control framework
Integrates risk into organizational management
An organization can use both. ERM can provide the broader risk perspective while internal control provides a structured approach for designing and evaluating controls.
How COSO works in practice
A practical COSO implementation starts with objectives. The organization should identify what it needs to achieve, determine the risks that could prevent those objectives from being achieved, and identify controls or other responses.
A typical implementation flow is:
1. Define organizational, process, reporting, or compliance objectives.
2. Identify relevant risks, including fraud and significant change.
3. Evaluate the significance of those risks.
4. Design or identify control activities that address relevant risks.
5. Establish reliable information and communication.
6. Monitor whether controls and related components are functioning.
7. Document deficiencies and remediation.
8. Reassess the system as objectives, risks, technology, regulations, and operating conditions change.
This approach can be represented in a risk and control matrix that links objectives, risks, controls, owners, evidence, and testing activities. The exact structure of such a matrix depends on the organization's operating model and governance requirements.
Who uses COSO?
COSO concepts can be used by:
Boards and audit committees.
Executive management.
Risk management teams.
Compliance functions.
Internal audit.
Finance and controllership.
Control owners.
Information security and cybersecurity governance teams.
Operational management.
External auditors and assurance professionals.
The appropriate depth of implementation depends on the organization's objectives, size, complexity, regulatory environment, and risk profile.
COSO use cases
Common use cases include internal control over financial reporting, operational controls, compliance programs, enterprise risk management, fraud risk management, internal audit planning, control testing, and governance reporting.
COSO can also provide a conceptual foundation for mapping risks and controls in areas such as cybersecurity, third-party risk, privacy, technology governance, and other specialized GRC programs. In these cases, COSO should be used as a governance and control framework rather than treated as a detailed technical control catalog.
Benefits of using COSO
A COSO-based approach can provide several benefits:
A common language for governance, risk, and control.
Clearer relationships between objectives, risks, and controls.
A structured basis for evaluating control effectiveness.
Better visibility into control deficiencies.
More consistent communication between management, risk, compliance, and audit.
A framework for monitoring and continuous improvement.
A foundation for integrating control considerations into broader risk management.
Limitations and considerations
COSO does not eliminate risk. Internal control provides reasonable assurance, not absolute assurance. Human judgment, management override, collusion, resource constraints, and changing conditions can affect the effectiveness of controls.
COSO also does not prescribe one universal control design. Organizations need to apply judgment based on their objectives, operating environment, industry, legal requirements, technology, and risk profile.
For that reason, implementing COSO effectively requires more than checking whether policies and controls exist. The organization must evaluate whether the relevant principles are present and functioning and whether identified deficiencies are addressed appropriately.
COSO implementation checklist
A practical implementation review can ask:
Are objectives clearly defined?
Are relevant risks identified and assessed?
Has fraud risk been considered?
Are control responsibilities clear?
Are control activities linked to identified risks?
Is relevant and quality information available?
Are communication channels effective?
Are controls monitored?
Are deficiencies documented, escalated, and remediated?
Are significant changes incorporated into risk and control assessments?
Can management demonstrate how the system supports the achievement of objectives?
Common mistakes
One common mistake is treating COSO as a compliance checklist. The framework is intended to support an integrated system of control and risk management, not merely the existence of individual controls.
Another mistake is documenting large numbers of controls without establishing the objectives and risks those controls address. This can create excessive control complexity without improving assurance.
Organizations can also underestimate monitoring. A control that was effective when designed may become ineffective when processes, systems, people, vendors, regulations, or business objectives change.
Conclusion
The COSO Framework provides a structured foundation for understanding governance, risk, and internal control. Its Internal Control Framework organizes control around five integrated components and 17 principles, while COSO ERM extends the risk perspective by connecting risk with strategy and performance.
For GRC programs, the most useful approach is to treat COSO as an integrated framework for connecting objectives, risks, controls, information, accountability, and monitoring. When applied with appropriate organizational judgment, it can help management and oversight functions move from isolated control activities toward a more coherent system of governance and risk-informed decision-making.
COSO Risk Assessment
A practical guide to COSO Risk Assessment, its four principles, risk lifecycle, fraud risk, change, evidence, and GRC application.
