The COSO Framework is designed to be used by organizations to assess the effectiveness of the system of internal control to achieve objectives as determined by management.
The 2017 framework lists five categories of components:
Governance and culture. Governance sets the organization’s tone, reinforcing the importance of, and establishing oversight responsibilities for enterprise risk management. Culture pertains to ethical values, desired behaviors, and understanding of risk in the entity.
Strategy and objective-setting. Enterprise risk management, strategy, and objective-setting work together in the strategic-planning process. A risk appetite is established and aligned with strategy; business objectives put strategy into practice while serving as a basis for identifying, assessing, and responding to risk.
Performance. Risks that may impact the achievement of strategy and business objectives need to be identified and assessed. Risks are prioritized by severity in the context of risk appetite. The organization then selects risk responses and takes a portfolio view of the amount of risk it assumed. The results of this process are reported to key risk stakeholders.
Review and revision. By reviewing entity performance, an organization can consider how well the enterprise risk management components are functioning over time and, in light of substantial changes, what revisions are needed.
Information, communication, and reporting. Enterprise risk management requires a continual process of obtaining and sharing necessary information, from both internal and external sources, which flows up, down, and across the organization.
The objective of effective Internal Control over Financial Reporting (ICFR) is to address risks related to financial reporting.
In simple terms, a company’s ICFR consists of controls designed to provide reasonable assurance that the company’s financial statements are reliable and prepared in accordance with the applicable financial reporting framework, such as US generally accepted accounting principles (GAAP) or International Financial Reporting Standards (IFRS).