COSO and COSO-ERM

The Original COSO Framework

Name:
Internal Control - An Integrated Framework (established 1992)

Emphasis:
Establishes a framework for internal controls.
Has three objectives:
1) accuracy of financial reporting
2) compliance with laws and regulations
3) effective and efficient operations.

Control Components:
see also The COSO Cube

The original COSO framework contains five control components needed to help assure sound business objectives. The control components are:

Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring.

Resources:

COSO key concepts www.coso.org...

COSO framework materials are available from the American Institute of Certified Public Accountants. www.aicpa.org/

Original Framework: Internal Control - Integrated Framework Executive Summary www.coso.org/publications...

COSO Framework Description www.knowledgeleader.com...

The COSO-ERM Framework

Name:
Enterprise Risk Management (ERM) COSO Framework (established 2004)

Emphasis:
Builds on original COSO framework, while emphasizing the importance ofentifying and managing risks across the enterprise.

COSO-ERM Components
see also The New Coso Cube

The new Enterprise Risk Management (ERM) COSO framework consists of eight components:

Internal control environment
Objective setting
Evententification
Risk assessment
Risk response
Control activities
Information and communication
Monitoring.

The three new components of the COSO framework are Objective setting, Evententification, and Risk response.

Resources:

A Building-Block Approach For Implementing COSO's Enterprise Risk Management-Integrated Framework http://findarticles.com...

COSO Enterprise Risk Management (ERM) Framework http://ria.thomson.com...

Enterprise Risk Management: Practical Implementation Ideas www.knowledgeleader.com...

COSO and COSO-ERM
see also Where COSO Gets Its Name

COSO is an internal controls framework focusing on fiscal responsibility. COSO-ERM builds on COSO, with a focus on Enterprise Risk Management. Below is a comparison of the two frameworks.

Copyright 2004-2008 The Data Governance Institute, LLC. All Rights Reserved
The site is brought to you in partnership with the Business Intelligence Network