Executive's Guide to COSO Internal Controls: Understanding and Implementing the New Framework

CHAPTER 4

COSO Internal Control Components: Control Environment

THE FRONT-FACING SIDE OF THE revised Exhibit 3.2 framework model shows five levels of internal control categories, the top level of which is called the control environment—the set of standards, processes, and structures that provides a basis or a structure for carrying out effective internal control activities across an enterprise. This chapter reflects on the original 1992 version of this control environment category and introduces the new concepts in the revised framework that make it particularly important.

Control environment internal control concepts should begin with the board of directors and senior management, who establish what has come to be known as management’s “tone at the top” for an enterprise; these are the formal senior management–level internal communications regarding the importance of internal controls, including expected standards of conduct. Management should emphasize and reinforce these expectations at the various levels of the enterprise. The control environment comprises the integrity and ethical values of the overall enterprise; the parameters enabling the board of directors to carry out its oversight responsibilities; the organizational structure and assignment of authority and responsibility; the process for attracting, developing, and retaining competent individuals; and the rigor around performance measures, incentives, and rewards to drive accountability for performance. This resulting ...