Using the COSO framework to understand controls
How an auditor can use COSO's Internal Control - Integrated Framework to understand a client's internal control, scaled for owner-managed clients.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Ask a client's finance manager to describe their internal control and you usually get a list: two signatures on payments, a monthly bank reconciliation, passwords on the accounting system. The list is real, but it is not a system. It says nothing about the tone set by the owner, how the business decides what could go wrong, how information reaches the people who need it, or who notices when a control stops working.
COSO's Internal Control – Integrated Framework gives the auditor a structure for asking those questions, and a practical way to make sure the understanding of a client's controls covers more than the obvious activities. This article explains how to use it on audits in South Africa, Nigeria and Kenya, including for small owner-managed clients.
The 2013 framework and why it replaced 1992
COSO, the Committee of Sponsoring Organizations of the Treadway Commission, states that its Internal Control – Integrated Framework was originally issued in 1992 and refreshed in 2013. COSO says that on December 15, 2014 the original 1992 framework was superseded by the 2013 version.
COSO explains that the 2013 framework is expected to broaden the application of internal control to operations and reporting objectives, and to clarify the requirements for determining what effective internal control is. It is also meant to help organisations design and implement internal control in light of changes in business and operating environments since the original framework was issued. COSO describes the framework as guidance developed to help improve confidence in all types of data and information.
If a client's policies or a firm's methodology still refer to the 1992 framework, that is worth updating.
The components, with monitoring as one
COSO states that effective monitoring of internal control is one of the five components of effective internal control set out in its framework. Monitoring is the component most often missing in smaller entities: controls are designed once and nobody checks whether they still operate.
Investopedia, describing internal control systems more generally, lists their components as a control environment, risk assessment, monitoring, information and communication, control activities, compliance with laws and regulations, separation of duties and physical controls. That broader list is a useful prompt alongside the framework's components, because it names controls, such as physical safeguards and segregation, that clients recognise.
For each area, the auditor's questions run something like this:
| Area | Question for the client |
|---|---|
| Control environment | Does the owner or board set clear expectations about honesty and accuracy, and act on breaches? |
| Risk assessment | How does the business decide what could go wrong in its reporting? |
| Control activities | Which specific checks prevent or detect errors in each process? |
| Information and communication | How does the right information reach the people who use it? |
| Monitoring | Who checks that controls still work, and what happens when one fails? |
COSO's illustrative tools
COSO states that its Illustrative Tools for Assessing Effectiveness of a System of Internal Control are expected to help users assess whether a system of internal control meets the requirements of the 2013 framework. They are written for organisations assessing their own systems, but an auditor can borrow their structure when documenting the understanding of a client's controls, and recommend them to clients that want to assess themselves.
Mapping the client's controls in the Controls & Walkthrough Studio
In Achekam, the Controls & Walkthrough Studio keeps the team's work against the chosen engagement, so the description of each control and the walkthrough that confirms it sit with the audit they belong to. The ISA numbers on its badges are labels; they are not evidence that a standard has been met.
A practical way to use the framework in the Studio is to organise the understanding by component first and process second: entity-level matters such as tone, risk assessment and monitoring, then the control activities in each significant process, each confirmed by a walkthrough. Our article on walkthroughs and controls covers performing and recording them.
The Working Paper Control Centre shows each engagement's papers as an index with progress by status, and can group the same papers by preparer, reviewer, risk or statement line. Grouping by risk lets the reviewer see whether the controls understanding has reached the areas that matter most.
Scaling the framework for owner-managed clients
The framework applies to organisations of every size, but it should not produce a thick file for a business with three staff. For owner-managed clients:
- Control environment often comes down to the owner: how involved they are, whether they override controls, and how they react to errors.
- Risk assessment may be informal. Ask the owner what keeps them awake at night about the numbers.
- Control activities are fewer and often owner-performed: signing payments, reviewing the bank statement, approving new suppliers.
- Information and communication may be a weekly conversation with the bookkeeper. That is acceptable if it happens.
- Monitoring is usually the gap. Note it plainly.
The point is to understand the system that exists, not to measure the client against a large-company model.
Feeding the results into risk assessment
Understanding control is not an end in itself. It feeds the assessment of control risk for each significant area and decides whether the audit can rely on controls or must be substantive. It also produces the deficiencies the firm reports to management. Our guide to management letter deficiencies covers turning control weaknesses into practical recommendations.
COSO's guidance on internal control describes the 2013 framework, its supersession of the 1992 version and the illustrative tools, and is the reference to check before updating a methodology.
On your next audit, try structuring the controls understanding by the framework's components before listing any control activities. It is the quickest way to see what the usual list leaves out.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
