The 2013 Framework retains the definition of internal control and the COSO cube, including the five components of internal control: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

One important distinction between COSO’s 2017 ERM framework and COSO’s 2013 internal control-integrated framework is that COSO 2013 is the de facto standard for regulatory reporting purposes to comply with Sarbanes-Oxley Section 404(a) and 404(b) reporting on internal control over financial reporting by management and …

17 Principles
COSO Framework’s 17 Principles of Effective Internal Control.

The Committee of Sponsoring Organizations’ (COSO) mission is to help organizations improve performance by developing thought leadership that enhances internal control, risk management, governance and fraud deterrence.

Even though the COSO framework wasn’t specifically created for the Sarbanes-Oxley Act, the guidelines of the COSO framework satisfy SOX requirements. Consequently, many auditors use COSO to audit for SOX compliance.

GOING BACK TO ITS ORIGINAL 1992 release, the COSO internal control framework was always meant to be viewed as a three-dimensional model or framework, where each cell component in any one dimension was meant to have a relationship with corresponding cells in the other two dimensions.

COSO, the implementation of the 2013 Framework “is expected to help organizations design and implement internal control in light of many changes in business and operating environments since the issuance of the original 1992 Framework, broaden the application of internal control in addressing operations and reporting objectives, and

COSO defines internal control as “a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.”.

COSO’s Enterprise Risk Management — Integrated Framework defines risk appetite as follows: The amount of risk, on a broad level, an entity is willing to accept in pursuit of value. It reflects the entity’s risk management philosophy, and in turn influences the entity’s culture and operating style.