According to the Association of Certified Fraud Examiners, weak internal controls are responsible for almost half of all fraud, So how do you ensure your system isn`t making your organization an easy target for fraud? Use a model designed by experts to design and implement your internal controls. One of the most commonly-used frameworks was written by the Committee of Sponsoring Organizations of the Treadway Commission. The COSO board develops guidance documents that help organizations with risk assessment, internal controls and fraud prevention.

The original COSO framework was developed in 1992, with the most recent version published in 2013. According to COSO, internal control: Focuses on achieving objectives in operations, reporting and/or compliance Is an ongoing process Depends on people`s actions, not merely written policies and procedures Provides assurance senior management of security to a reasonable degree Can be adapted to the needs of the whole organization as well as each department, unit or process The COSO framework divides internal control objectives into three categories: operations, reporting and compliance. Operations objectives, such as performance goals and securing the organization`s assets against fraud, focus on the effectiveness and efficiency of your business operations. Reporting objectives, including both internal and external financial reporting as well as non-financial reporting, relate to transparency, timeliness and reliability of the organization`s reporting habits. Compliance objectives are internal control goals based around adhering to laws and regulations that the organization must comply with. The COSO framework further teaches that there are five components to an internal control system. First, control environment is the “set of standards, processes, and structures that provide the basis for carrying out internal controls across the organization.” This component includes your:

Ethical values Organizational structure Commitment to employing competent employees Human resources policies Next, risk assessment involves your organization`s analysis of the risks posed by internal and external changes, the ability to establish objectives and determine their suitability for your business and the process for weighing risks versus risk tolerances. Control activities are the tasks and activities (laid out by organizational policies and procedures) that help you achieve your internal control objectives. These include actions such as “authorizations and approvals, verifications, reconciliations, and business performance reviews.” The information and communication component recognizes these two things as essential to any internal control system. COSO stresses the importance of relevant and high-quality information to control functions. Internal messages emphasizing the importance of control responsibilities, in addition to clear communication of expectations with external parties, is key to a strong system. Finally, monitoring your internal controls is just as important as establishing them. Use ongoing evaluations built into your business processes as well as regular separate evaluations, which will vary based on your level of risk, system effectiveness and regulation requirements. COSO and SOX see the need for stronger internal controls from different perspectives. COSO provides a framework that administrators can use to design control environments. In the 2013 COSO Vision Update, the Commission expanded the framework to include 17 principles and 87 key points to consider when assessing the control environment. On the other hand, the SOX Act does not contain guidelines regarding internal controls. This law introduced an effective control environment as a statutory requirement for all SOEs. The SOX Act went further by holding CEOs and CFOs criminally liable for failing to control risks associated with financial reporting.

Leveraging the COSO framework to benchmark your current control environment against the 5 components and 17 principles can create valuable benefits for companies of all sizes.

Improved Governance – Poor governance and oversight of business performance has led to countless business failures and lower shareowner value. A fundamental goal of COSO is to improve the corporate governance function within organizations that monitor security, risk, and compliance programs to ensure adherence to policies, goals, and laws.

Improved Risk Assessments – More often than not, people think that incidents occur due to employee negligence or mistakes. In fact, most workplace incidents occur due to insufficient management controls. Most accidents can be prevented by prior risk assessment. Improved fraud detection and prevention. The COSO platform can help organizations improve fraud risk management. This structure also allows organizations to have controls to prevent fraud in the first place, detect fraud as soon as it occurs, and respond effectively when it occurs.

Enhanced Application Security – Companies face an onslaught of fraudulent activity, security threats, and other application risks. The COSO framework provides guidelines for organizations to assess and improve their own application control environment to better detect and prevent cyber threats.

Significant Cost Savings – If organizations implement the COSO framework correctly, it will streamline processes, establish more effective internal controls, and better manage risk and compliance costs.

More Positive Attention from Investors – Investors are scrutinizing the performance of public companies more than ever before. If your company adopts the COSO framework, you`ll have a more effective set of risk management controls in place, making your organization more attractive to potential investors and better prepared for an IPO.