COSO Internal Control vs. COSO ERM: Key Differences | growGRC
COSO Internal Control vs. COSO ERM
A practical comparison of COSO Internal Control and COSO ERM, including their purposes, components, principles, GRC applications, differences, and how to use both frameworks together.
Published: 8/20/2026Updated: 8/20/2026By growGRC Editorial Team
Executive Summary
COSO Internal Control and COSO ERM are complementary frameworks with different primary purposes. Internal Control focuses on the system of internal control and reasonable assurance over operations, reporting, and compliance objectives. COSO ERM integrates enterprise risk with strategy and performance.
Key Takeaways
✓COSO Internal Control focuses on the system of internal control; COSO ERM focuses on integrating risk with strategy and performance.
✓The Internal Control framework has five components and 17 principles.
✓COSO ERM has five components and 20 principles.
✓Risk appetite and portfolio view are central concepts in COSO ERM.
✓Control Activities are a dedicated Internal Control component, while ERM addresses risk responses within Performance.
✓The frameworks can be used together in GRC while preserving separate framework mappings.
COSO Internal Control vs. COSO ERM
COSO Internal Control — Integrated Framework and COSO Enterprise Risk Management — Integrating with Strategy and Performance are complementary frameworks with different primary purposes.
The Internal Control framework focuses on the system of internal control and reasonable assurance over objectives related to operations, reporting, and compliance. COSO ERM takes a broader enterprise perspective by integrating risk with strategy and performance.
Understanding the distinction helps GRC professionals select the appropriate framework, avoid duplicate work, and use both frameworks together when the organization needs an integrated risk and control model.
What is the main difference?
The simplest distinction is:
COSO Internal Control focuses on internal control.
COSO ERM focuses on enterprise risk management and its integration with strategy and performance.
The frameworks are related, but they should not be treated as interchangeable.
Internal control is an important part of risk management, while ERM provides a broader context for how risk affects strategy, objectives, decisions, and performance.
COSO Internal Control
The COSO Internal Control — Integrated Framework provides a structure for designing, implementing, conducting, and evaluating internal control.
What is the main difference between COSO Internal Control and COSO ERM?
COSO Internal Control focuses on the system of internal control and reasonable assurance over objectives, while COSO ERM integrates enterprise risk management with strategy and performance.
How many principles does each COSO framework have?
COSO Internal Control has 17 principles, while COSO ERM has 20 principles.
Can COSO Internal Control and COSO ERM be used together?
Yes. COSO ERM can provide the enterprise risk perspective while COSO Internal Control can provide a structure for designing and evaluating relevant controls.
Is COSO ERM just a larger internal-control checklist?
No. COSO ERM has a broader purpose that includes integrating risk with strategy, objectives, performance, risk appetite, and enterprise decision-making.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
The focus is on whether the system of internal control provides reasonable assurance regarding the achievement of relevant objectives.
COSO ERM
COSO Enterprise Risk Management — Integrating with Strategy and Performance provides a broader structure for integrating risk management with strategy and performance.
It is organized around five components:
1. Governance and Culture.
2. Strategy and Objective-Setting.
3. Performance.
4. Review and Revision.
5. Information, Communication, and Reporting.
The framework is supported by 20 principles.
COSO ERM addresses areas such as risk appetite, strategic alternatives, risk identification, risk assessment, risk responses, portfolio view, review of changes, and risk reporting.
Side-by-side comparison
Dimension
COSO Internal Control
COSO ERM
Primary focus
Internal control
Enterprise risk management
Main perspective
Control system
Risk, strategy, and performance
Components
5
5
Principles
17
20
Objective orientation
Operations, reporting, compliance
Strategy and performance, including objectives across the enterprise
Risk appetite
Not the primary organizing concept
Central connection between strategy and risk
Control activities
Core component
Used as part of risk responses and broader GRC processes
The table provides a high-level comparison. The frameworks should be applied according to their official concepts and the organization's circumstances.
Components compared
The component structures are different because the frameworks address different primary questions.
Control Environment vs. Governance and Culture
COSO Internal Control begins with the Control Environment, which establishes the foundation for internal control through integrity, ethical values, oversight, organizational structure, authority, competence, and accountability.
COSO ERM uses Governance and Culture to establish oversight, operating structures, desired culture, core values, and capable people in the context of enterprise risk management.
Both recognize that governance, accountability, values, and organizational behavior affect risk and control effectiveness.
Risk Assessment vs. Strategy and Objective-Setting and Performance
Risk Assessment is one of the five components of COSO Internal Control. It focuses on identifying and analyzing risks to the achievement of objectives, including consideration of fraud and changes.
COSO ERM distributes risk considerations more broadly. Strategy and Objective-Setting connects risk with strategy and objectives, while Performance focuses on identifying, assessing, prioritizing, and responding to risks.
Therefore, COSO ERM places risk more explicitly within strategic and performance decision-making.
Control Activities vs. Risk Responses
Control Activities are a dedicated component of the Internal Control framework. They are actions established through policies and procedures that help ensure management directives are carried out.
COSO ERM does not use Control Activities as one of its five components. Instead, it includes Implementing Risk Responses within the Performance component.
A risk response can involve controls, but not every risk response is necessarily a control activity. Depending on circumstances, responses can include accepting, avoiding, pursuing, reducing, or sharing risk.
Information and Communication vs. Information, Communication, and Reporting
Both frameworks recognize the importance of relevant information and communication.
COSO Internal Control emphasizes information and communication needed for the functioning of internal control.
COSO ERM extends this perspective into risk information, communication, and reporting needed to support risk-informed decisions, management, and board oversight.
Monitoring Activities vs. Review and Revision
COSO Internal Control uses Monitoring Activities to evaluate whether the components of internal control are present and functioning and to identify deficiencies.
COSO ERM uses Review and Revision to assess substantial changes, review risk and performance, and pursue improvements in enterprise risk management.
The concepts are related but not identical.
17 principles vs. 20 principles
The difference in principle counts reflects the different purposes of the frameworks.
COSO Internal Control: 17 principles
The 17 principles support the five internal-control components:
5 principles for Control Environment.
4 principles for Risk Assessment.
3 principles for Control Activities.
3 principles for Information and Communication.
2 principles for Monitoring Activities.
COSO ERM: 20 principles
The 20 principles support the five ERM components:
5 principles for Governance and Culture.
4 principles for Strategy and Objective-Setting.
5 principles for Performance.
3 principles for Review and Revision.
3 principles for Information, Communication, and Reporting.
The principle structures should not be merged into a single checklist without preserving the context of each framework.
Which framework should an organization use?
The answer depends on the question the organization needs to address.
Use COSO Internal Control when the primary need is to design, document, evaluate, or improve internal control.
Use COSO ERM when the primary need is to integrate risk with strategy, objectives, performance, risk appetite, and enterprise decision-making.
Use both when the organization needs an integrated model in which enterprise risks inform decisions and risk responses are supported by effective internal controls.
Can COSO Internal Control and COSO ERM be used together?
Yes.
The frameworks can complement one another.
A practical architecture can use COSO ERM as the enterprise risk perspective and COSO Internal Control as a framework for designing and evaluating relevant controls.
For example:
1. Strategy establishes objectives.
2. ERM considers risk appetite and identifies risks affecting those objectives.
3. Management selects risk responses.
4. Internal control principles help structure controls that address relevant risks.
5. Control owners operate and evidence controls.
6. Testing and monitoring evaluate control effectiveness.
7. ERM reporting considers changes in risk and performance.
8. Management and the board use the combined information for decision-making.
This approach can improve traceability from strategy to risk to control to evidence and remediation.
Example: cybersecurity risk
Consider an organization with a strategic objective to expand a digital service.
COSO ERM can help management evaluate the strategic context, define acceptable risk, identify cybersecurity risk, assess severity, prioritize the risk, select a response, and consider the risk in the broader portfolio.
COSO Internal Control can then provide a structure for relevant controls, such as access management, segregation of duties, change management, monitoring, and technology-related controls.
The frameworks therefore answer different but connected questions:
ERM: How does cybersecurity risk affect strategy and performance, and how should the organization respond?
Internal Control: What control system provides reasonable assurance that relevant objectives are achieved and risks are appropriately addressed?
GRC implementation model
A GRC program can maintain separate framework mappings while connecting them through shared organizational objects.
COSO ERM can provide mappings for strategy, objectives, risk appetite, risks, responses, portfolio, and performance.
COSO Internal Control can provide mappings for control environment, risk assessment, control activities, information and communication, monitoring, and control deficiencies.
Keeping the mappings distinct prevents the frameworks from being incorrectly treated as identical while still allowing a common GRC data model.
Common mistakes
Several implementation mistakes can reduce the value of using both frameworks.
Treating COSO ERM as a larger control checklist
ERM is not simply an expanded list of internal controls. Its purpose includes integrating risk with strategy and performance.
Treating every risk response as a control
Risk responses can include acceptance, avoidance, pursuit, reduction, or sharing. Controls are one possible mechanism for reducing or managing risk.
Combining the 17 and 20 principles without context
The principles belong to different framework structures. A GRC implementation should preserve their original framework relationships.
Creating duplicate assessments
Organizations can reduce unnecessary work by identifying where one activity produces evidence useful to both frameworks, while maintaining separate mappings.
Ignoring strategy and performance
A control-only GRC implementation may miss the broader enterprise risk perspective that COSO ERM is designed to provide.
How to choose a framework for a GRC program
A practical decision process is:
1. Identify the business question.
2. Determine whether the primary concern is control effectiveness, enterprise risk, or both.
3. Identify the objectives and risks in scope.
4. Select the framework that best addresses the primary purpose.
5. Map relevant principles to organizational processes.
6. Reuse evidence where appropriate.
7. Maintain separate framework mappings.
8. Report results according to the needs of management, boards, auditors, regulators, and other stakeholders.
The goal should be useful decision support, not maximum framework mapping.
Conclusion
COSO Internal Control and COSO ERM are complementary rather than competing frameworks.
COSO Internal Control provides a structured approach to the system of internal control and reasonable assurance over operations, reporting, and compliance objectives.
COSO ERM provides a broader enterprise risk perspective by integrating risk with strategy and performance.
Organizations can use either framework independently or use both together. For GRC programs, the most effective approach is usually to preserve the distinction between the frameworks while connecting strategy, objectives, risks, risk responses, controls, evidence, testing, deficiencies, remediation, and reporting.
Mapping scope
The component relationships are a conceptual comparison to support design discussions. They are not an official COSO crosswalk and do not mean that a component or principle in one framework substitutes for a requirement or principle in the other. Assess applicable frameworks and required evidence independently.
SUPPORTS
COSO ICIF: Integrated Internal Control
COSO ICIF organizes internal control around objectives, components and principles to help assess whether controls are designed and operate as an integrated system.
