How do we assess a company’s internal controls? What standards do we apply? For instance, when you’re in school and you submit an essay to your teacher, the teacher uses a rubric to grade your essay. They separate different components to assess different areas of the essay, much like with internal controls. To assess internal controls, we follow the COSO Internal Control Framework.

Since internal controls are vital for a company, a joint initiative, known as the Committee of Sponsoring Organizations (COSO) was formed to help establish standards for internal controls. The Committee of Sponsoring Organizations is composed of five sponsoring organizations, which are the American Accounting Association, the American Institute of Certified Public Accountants, the Financial Executives Institute, the Institute of Internal Auditors, and the Institute of Management Accountants. These five entities operate COSO.

COSO recognizes the importance of internal controls, which is why it published the Internal Control Integrated Framework, or simply “the Framework”. The Framework offers guidance to help organizations implement effective internal controls. This Framework has been widely accepted by the auditing world and is often used as the benchmark for determining whether a company has established effective internal controls.

What is the Framework’s objective? It is to assist organizations in implementing internal controls that meet their operational, reporting, and compliance objectives. Who is responsible for an organization’s internal controls? Both the board of directors and the management. They need to cooperate to ensure the organization is designing and implementing effective internal controls.