COSO Enterprise Risk Management: Understanding the New Integrated ERM Framework

Chapter 6. Integrating ERM with COSO Internal Controls

Often confused by their similar names and the same sponsors, the Committee of Sponsoring Organizations (COSO) internal controls and their enterprise risk management (ERM) framework represent two different approaches to understanding internal controls and risk-related processes in today’s enterprise. While much of this book has discussed COSO ERM, this chapter will look at the COSO internal controls framework and its risk-related relationships with COSO ERM. Professionals need to recognize that these are two rather different frameworks or models. All too often and almost up to the present, many have referred to the COSO internal controls framework as just “COSO” or “COSO #1” with the similarly named but different COSO ERM framework sometimes called “COSO #2”.

This chapter looks at the components and objectives of the COSO internal control framework as well as some background on its origins. Since the COSO internal controls framework has a risk component, we will discuss its relationship to COSO ERM. An overall objective of this chapter will be to describe how managers can use and apply effective ERM practices when building strong COSO internal control practices.

COSO Internal Controls: Background and Earlier Legislation

The concept of internal control has been used by business professionals since the very early days of auditing to define the process of how management mechanisms work. Internal control descriptions and definitions ...