Internal control frameworks: COSO, COBIT and Canadian certification

Lessons 5 to 7 described many individual controls: credit limits, three-way matches, reconciliations, separation of duties. Individual controls are only part of the picture. An organization needs a way to decide which risks matter, which controls address them, whether the controls are designed well and operating, and how to tell when something has changed. Internal control frameworks provide that structure. They give management, boards and auditors a common language for discussing control, and regulators use them as the benchmark for internal control over financial reporting (ICFR). This lesson covers the COSO Internal Control–Integrated Framework, the COSO Enterprise Risk Management framework, the COBIT framework for governance of information and technology, and the legal certification regimes for public companies.

Internal control is defined by COSO as a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance. Three phrases in that definition matter. Internal control is a process, not a document or a one-time event. It is carried out by people at every level, not just the accounting department. And it provides reasonable assurance, not absolute assurance: controls cost money, people make mistakes, and two or more people working together (collusion) or a senior manager overriding controls can defeat even well-designed systems.

The COSO Internal Control–Integrated Framework

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a joint initiative of five US professional bodies, including the American Institute of CPAs, the Institute of Internal Auditors and the Institute of Management Accountants. Its Internal Control–Integrated Framework, first published in 1992 and updated in 2013, is the most widely used internal control framework in the world, including by most Canadian and US public companies. The framework relates three categories of objectives (operations, reporting and compliance) to five components of internal control, which apply at every level of the organization, from the entity as a whole to individual divisions, processes and functions.

The control environment is the foundation. If senior management ignores the rules, overrides controls or pressures staff to hit targets at any cost, the most sophisticated control activities will fail. Evidence of a strong environment includes a code of conduct that is enforced, an independent audit committee that meets the auditors without management present, clear authority limits, competent finance staff and a whistleblower channel that people trust. Risk assessment asks what could go wrong with each objective, how likely and how serious it is, and what has changed; an ERP implementation, a new sales channel or a new country of operation all change the risk profile. Control activities are the specific actions that respond to risks, and they can be classified in several useful ways.

Segregation of duties

Segregation of duties (SoD) is one of the most important control activities. The classic rule separates four functions for any transaction: authorization (approving it), recording (entering it in the books), custody (handling the assets) and reconciliation or review. If one person can both steal an asset and hide the theft in the records, the organization depends entirely on that person's honesty. In an ERP, SoD is enforced through access rights: roles define which transactions each user can perform, and an SoD rule set lists combinations that should not be held by one person, such as creating a supplier and approving payments to suppliers. Small organizations often cannot separate every duty, so they rely on compensating controls such as owner review of bank statements and payment registers.

# Ridgeback: checking user access against segregation-of-duties rules (illustrative)
conflicts = [("Create/change supplier", "Approve payment run", "fictitious supplier payments"),
             ("Enter supplier invoice", "Approve payment run", "paying own invoices"),
             ("Create/change employee", "Run payroll", "ghost employees"),
             ("Enter cash receipt", "Issue credit memo", "lapping and concealed theft"),
             ("Post manual journal entry", "Approve manual journal entry", "unapproved entries")]
access = {
    "jsmith (AP clerk)": {"Enter supplier invoice", "Create/change supplier"},
    "mlee (AR clerk)": {"Enter cash receipt", "Issue credit memo"},
    "rkaur (controller)": {"Approve payment run", "Approve manual journal entry", "Post manual journal entry"},
    "tnguyen (HR)": {"Create/change employee"},
    "dbrown (payroll)": {"Run payroll"},
}
found = 0
for user, rights in access.items():
    for a, b, risk in conflicts:
        if a in rights and b in rights:
            found += 1
            print(f"CONFLICT {user}: '{a}' + '{b}' -> risk of {risk}")
print(f"{found} conflicts found across {len(access)} users")

CONFLICT mlee (AR clerk): 'Enter cash receipt' + 'Issue credit memo' -> risk of lapping and concealed theft
CONFLICT rkaur (controller): 'Post manual journal entry' + 'Approve manual journal entry' -> risk of unapproved entries
2 conflicts found across 5 users

The check finds two conflicts. The AR clerk can both enter cash receipts and issue credit memos, the combination that makes lapping and concealed theft possible (lesson 5). The controller can post and approve manual journal entries, which defeats the approval workflow. Note that the AP clerk can create suppliers and enter invoices, which is not a listed conflict because the clerk cannot approve the payment run; it is still a concern worth adding to the rule set, since a clerk who can create a supplier and enter its invoices relies only on the payment approver to notice a fictitious supplier. Rule sets need regular review as roles change.

COSO ERM and COBIT

COSO also publishes Enterprise Risk Management–Integrating with Strategy and Performance (2017), a broader framework for managing risk across the whole organization, linked to strategy setting and performance. Internal control is part of ERM, but ERM goes further, asking how much risk the organization is willing to accept in pursuit of its goals (its risk appetite) and how risk considerations should shape strategy. In March 2026 COSO also issued guidance, Achieving Effective Internal Control Over Generative AI, that applies the five components to generative AI tools used in finance and other functions; lesson 12 returns to it.

COBIT, published by ISACA, is a framework for the governance and management of enterprise information and technology. The current version, COBIT 2019, sets out governance and management objectives grouped into five domains: Evaluate, Direct and Monitor (EDM), Align, Plan and Organize (APO), Build, Acquire and Implement (BAI), Deliver, Service and Support (DSS), and Monitor, Evaluate and Assess (MEA). Organizations use COBIT to structure IT governance and to define the IT general controls that support financial reporting, which lesson 9 covers. COBIT and COSO fit together: COSO principle 11 requires general controls over technology, and COBIT supplies the detail of what those controls should be.

Legal requirements for public companies

In Canada, National Instrument 52-109 Certification of Disclosure in Issuers' Annual and Interim Filings, often called CSOX, requires the chief executive and chief financial officers of non-venture reporting issuers to certify each quarter and year that the filings are accurate, that they have designed disclosure controls and procedures and internal control over financial reporting, and, annually, that they have evaluated the effectiveness of ICFR and disclosed any material weaknesses. Unlike the US rules, NI 52-109 does not require the external auditor to issue a separate opinion on ICFR. Venture issuers file basic certificates without the design and evaluation representations. The certifying officers must use a recognized framework, and most use COSO 2013.

Deficiencies are graded by severity. A control deficiency exists when a control's design or operation does not allow staff to prevent or detect misstatements on a timely basis. A significant deficiency is less severe than a material weakness but important enough to merit the attention of those responsible for oversight. A material weakness is a deficiency, or combination of deficiencies, that creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. Material weaknesses must be disclosed publicly, and they often lead to share price falls and costly remediation, which is why management invests heavily in documenting and testing controls.