COSO's Internal Control—Integrated Framework

Updating the Original Concepts for Today's Environment

Jill D'Aquila, PhD, CPA

The Internal Control-Integrated Framework, issued by the Committee of Sponsoring Organizations (COSO) in 1992, was revolutionary: it represented the first major formal attempt to define internal control and provide a standard for measurement. Ten years later, the passage of the Sarbanes-Oxley Act (SOX)—specifically, section 404 of the act—further highlighted the importance of internal control. This law not only required organizations to establish and maintain internal controls over financial reporting; it also required managers and external auditors to evaluate and report on the effectiveness of internal control. The SEC also highlighted the importance of internal control shortly after SOX's enactment; in a final rule, the SEC stated, “The COSO Framework satisfies our criteria and may be used as an evaluation framework for purposes of management's annual internal control evaluation and disclosure requirements” (http://www.sec.gov/rules/final/33-8238.htm). The SEC recognized that other suitable evaluation standards existed outside the United States.