COSO Cube – the Rubik’s Cube (TM) of Control

The Committee of Sponsoring Organizations of the Treadway Commission (popularly known as COSO) has updated their internal control framework from its original 1992 framework.

Here is the old framework, referred to as the “Original COSO Cube“:

And the new framework in the “New COSO Cube“:

According to the Journal of Accountancy, “The definitions of internal control and objectives of the framework have not changed. Internal control is defined as a process designed to assure three objectives—reasonable assurance of effectiveness and efficiency of operations, reliable reporting, and compliance with laws and regulations. The original five components of the framework—control environment, risk assessment, control activities, information and communications, and monitoring—also have remained the same. But the updated framework provides a total of 17 principles across those five components to build on the concepts that COSO contributors believe proved useful in the original version.”

COSO Chairman David L. Landsittell stated “this update should allow organizations to more effectively utilize the framework to develop and maintain systems of internal control in support of their long-term success.”   The exposure draft is open to comments through March 31^st and can be found at ic.coso.org.

COSO believes this new Framework will bring significant benefits, including “increased confidence that controls mitigate risks to acceptable levels.” According to the Executive Summary, COSO’s goal was to focus on agility, confidence, and clarity by adding ways to evaluate effectiveness and help identify and analyze risks.