A warehouse may require payment approval while supervisors routinely accept unsupported signatures, leaving uncertainty about whether the organization actually controls spending.
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a framework for designing, implementing, operating, and evaluating internal control. Its purpose is to help organizations manage threats to achieving objectives and evaluate their control systems.
Internal control is an ongoing process carried out by the governing body, management, and other personnel to support achievement of organizational objectives. The process is designed to provide reasonable assurance, a high degree of confidence that still allows the possibility of failure.
- The governing body oversees internal control and challenges management about its development and performance.
- Management establishes objectives and takes responsibility for designing, implementing, and operating the control system.
- Other personnel perform assigned controls, provide relevant information, and report problems encountered while carrying out their responsibilities.
Internal control operates through people's actions, including their use of technology, rather than existing solely in manuals or organization charts.
Common mistakes
- Wrong objective category. Classifying every mandatory company policy as compliance ignores whether the stated objective concerns an applicable law or regulation.
- Seventeen separate controls. Treating seventeen principles as a required inventory of seventeen procedures ignores the possible relationships between controls and principles.
- Automatic system failure. Treating one accidental processing error as conclusive evidence of an ineffective system ignores reasonable assurance and the circumstances of the failure.
Bottom line
- Internal control is a continuing process performed by governance, management, and other personnel to provide reasonable assurance about objectives.
- COSO covers operations, reporting, and compliance objectives across the entity and its divisions, operating units, and functions.
- The five components contain seventeen principles, distributed five, four, three, three, and two in framework order.
- Every component and relevant principle must be present and functioning, and the components must operate together for the system to be effective.
Exam shortcut
Read the action verb before choosing a component: identifying exposure, processing a transaction, transmitting information, and evaluating a control point toward different answers. For paired scenarios, underline the changed behavior. Keep unchanged staffing, reporting frequency, and transaction controls from deciding a question about investigative follow-up. Separate evidence of adoption from evidence of continued use.
The full lesson (about 3,700 words, 25 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.C1
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.