The COSO framework for a small business
What the COSO internal control framework is, which version applies, and how an owner-managed business can scale it down to a short, workable list.
By Achekam · · 5 min read · For Running a business businesses in South Africa, Nigeria, Kenya
"COSO" turns up in audit reports, bank covenants and board packs, usually without explanation. For the owner of a ten-person business in Durban, Abuja or Mombasa, it can sound like something meant for listed companies with internal audit departments. It is, partly. But the thinking behind it scales down well, and a small business that borrows its structure ends up with fewer surprises in its books.
This article explains what the framework is, which version is current, and how to turn it into a short list an owner can actually run.
What COSO is, and which version applies
COSO is the Committee of Sponsoring Organizations of the Treadway Commission. Its Internal Control—Integrated Framework was first issued in 1992 and refreshed in 2013. COSO states that on December 15, 2014 the original 1992 framework was superseded by the 2013 version. If anyone hands you material built on the older one, it is out of date.
COSO says the framework was developed as guidance to help improve confidence in all types of data and information. It also makes a point small businesses should hear: internal controls have value beyond compliance and external reporting. COSO states that effective internal controls can help an organisation articulate its purpose, set its objectives and strategy, and grow on a sustained basis with confidence and integrity in its information. In other words, it is about running the business well, not only about satisfying auditors.
The parts of a control system in plain terms
COSO delineates five components of effective internal control, and states that effective monitoring is one of them. Investopedia, describing internal control systems more generally, lists their parts as a control environment, risk assessment, monitoring, information and communication, control activities, compliance with laws and regulations, separation of duties and physical controls.
Translated for an owner-managed business:
| Part | What it means in a small business |
|---|---|
| Control environment | The tone you set: whether rules apply to everyone, including family and long-serving staff |
| Risk assessment | Knowing where money or stock could go missing, or where figures could be wrong |
| Control activities | The checks themselves: approvals, reconciliations, counts, second signatures |
| Information and communication | Staff knowing the rules, and you getting reliable figures on time |
| Monitoring | Checking, now and then, that the checks are still being done |
Reasonable assurance, not perfection
ACCA explains that no internal control system is perfect, so the purpose of any control system should be to provide reasonable assurance that the organisation can meet its objectives. ACCA attributes this view to the Turnbull Report, first published in 1999.
For a small business, that is liberating. You are not trying to make fraud or error impossible. You are trying to make it unlikely, and to make sure that if it happens, you find out soon. A control that costs more than the risk it covers is a bad control, however correct it looks on paper.
Scaling it down: a short list for an owner-managed business
A workable version for a business with a handful of staff fits on one page:
- Tone. Write down the few rules that matter (who may approve payments, who may give discounts, who may take stock off-site) and follow them yourself.
- Risks. Once a year, list the five places you would steal from if you worked for yourself. Those are where your controls go.
- Two people on every payment. One prepares, another approves. If only the owner can approve, the owner approves.
- Bank reconciled every month. Every line explained, not just the total.
- Months closed. Once the month is reviewed, nobody posts into it without the owner knowing.
- Bank details checked. Any new or changed supplier or employee bank account is confirmed by someone other than the person who entered it.
- Owner review. The owner reads the management accounts monthly and asks about anything unexpected.
Controls Achekam builds in
Several of these controls are enforced by Achekam rather than left to habit:
- Closed months. Months can be soft-closed, hard-closed and locked. A closed month refuses postings from every source, and reopening a hard close needs a second approver.
- Reconciliations a person signs off. Bank lines are matched by suggestion, and a person accepts each match. A line not yet in the books becomes a suggested journal a person approves, and a reconciliation completes only when nothing is left unexplained.
- Two-person payroll. A pay run is approved by someone other than the person who prepared it, nobody can approve a run that pays themselves, and an approved run is never recalculated. An employee's bank account entered or changed by one person must be verified by another before it is paid.
- Purchasing. A purchase order is raised from the selected quotation of an approved requisition, and the person who raised it cannot approve it.
These are control activities in COSO's terms. They still depend on the right people holding the right roles: two-person payroll needs at least two people in payroll roles. The comparison with what stays manual is in controls your accounting software should enforce.
Monitoring: checking the controls still work
Controls decay. The person who approved payments leaves and their replacement is never set up, so the owner starts approving their own transfers "just this once". Monitoring is how you catch that drift.
Simple monitoring for a small business:
- Each quarter, pick a few payments and check who prepared and who approved them.
- Compare budgets with actual figures every month and ask why the large differences arose. In Achekam, a business can set a budget per account and period and compare it with the ledger.
- Confirm that every bank account was reconciled for every month, with nothing left unexplained.
- Review the list of users and their rights, removing anyone who has left.
For more on who should hold which role, see segregation of duties.
Where to start
COSO's own guidance page for the Internal Control—Integrated Framework (2013) lists the framework and its supporting guidance on monitoring and technology. You do not need to read all of it. Take the one-page list above, add the risks particular to your business, and agree a date each quarter when someone other than the person doing the work checks that it is still being done.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
