Internal Control Systems and the COSO Framework
The COSO architecture
Candidates must know the COSO Internal Control - Integrated Framework: five components and seventeen principles. The components are Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities. The framework distinguishes internal control from risk management and from governance, and it applies to objectives in three categories: operations, reporting and compliance. In the Bulgarian public sector, the Financial Management and Control (FMC) system is the local expression of COSO, with components mapped onto statutory requirements and assessed annually by the head of the organisation.
Concepts to master
Key concepts: tone at the top; segregation of duties; authorisation and approval; preventive versus detective controls; manual versus automated controls; key controls; control design versus operating effectiveness; the control environment as foundation; and the role of the internal audit function in providing assurance on the FMC system without designing it.
Traps
Questions often confuse a component with a principle (e.g., "segregation of duties" is a control activity, not a component). Another trap: monitoring activities are a control component, distinct from internal audit, which is an independent assurance activity outside the five components. Also watch for confusion between the COSO internal control framework and the COSO enterprise risk management framework.
Rule of thumb
Map any control to one of the five components first, then to a principle. If a question asks "which component?", the answer is the highest-level category, not the specific control.
Worked example
A municipality requires two signatures on payments and reconciles bank accounts monthly. Both are control activities (segregation/authorisation and detective reconciliation) within the Control Activities component, supporting the compliance and reporting objectives.