COSO Internal Control Framework

Internal control is often treated as a compliance exercise: a set of procedures written for the auditors, a controls matrix that is rarely updated and testing that focuses on documents rather than on whether risks are actually managed. The control environment and tone at the top are discussed but not assessed, IT controls are left to the IT department, and deficiencies are reported without a clear view of their severity. Newer areas such as sustainability data, outsourced services and automation are often outside the control system altogether.

This programme applies the COSO framework as a working tool. It moves through five stages: understanding the framework and its objectives, building the control environment and assessing risk, designing control activities including IT controls, managing information, communication and monitoring, and evaluating the system and reporting deficiencies.

Built on recognised practice. The programme is built on the COSO Internal Control Integrated Framework (2013) with its five components and 17 principles, and references COSO Enterprise Risk Management: Integrating with Strategy and Performance, COSO guidance on achieving effective internal control over sustainability reporting (2023), COSO fraud risk management guidance, the IIA Three Lines Model and the IIA Global Internal Audit Standards. They are used to show how internal control connects to governance, risk management and assurance.

Decisions this programme improves. Which risks need key controls and which controls add little value; whether a control is designed well and operating effectively; how to balance preventive, detective, manual and automated controls; how serious a deficiency is and who needs to know; and how to extend internal control to new reporting areas and technologies.

How it is delivered. Twenty hours across five sessions, built around one running case: a government entity or company with procurement, payments, payroll and financial reporting processes. Participants map risks to the 17 principles, build a risk and control matrix, design test steps, evaluate deficiencies and prepare a summary for an audit committee.

In-house option. For organisations, the programme can be tailored to your own processes, control frameworks, ERP systems and regulatory requirements, and delivered to finance, internal audit, risk and compliance teams together so that all three lines work from the same framework.

Who Should Attend

Internal auditors: internal audit staff and audit team leaders

Finance professionals: financial controllers, accountants and financial reporting staff

Risk and compliance staff: risk officers, compliance officers and internal control specialists

Process owners: managers responsible for procurement, payments, payroll and other key processes

IT and governance staff: IT audit, IT governance and information security staff involved in controls

Objectives

Explain the COSO Internal Control Integrated Framework, its objectives, five components and 17 principles

Assess the control environment, including governance, ethics, competence and accountability

Conduct a risk assessment that links objectives, risks and fraud risk to controls

Design control activities, including preventive, detective, manual and automated controls

Identify key IT general controls and application controls and their role in reliable information

Build and maintain a risk and control matrix for a business process

Design and perform tests of control design and operating effectiveness

Evaluate control deficiencies and classify their severity

Explain how the Three Lines Model allocates roles for control, oversight and assurance

Apply COSO principles to newer areas such as sustainability reporting and automated processes

Course Outline

The COSO Framework: Objectives, Components and Principles

Why internal control fails in practice
Operations, reporting and compliance objectives
The five components and 17 principles
Points of focus and how to use them
Internal control, enterprise risk management and governance: how they relate
Roles of the board, management, internal audit and external audit under the Three Lines Model

Control Environment and Risk Assessment

Tone at the top, ethics and codes of conduct
Board oversight, organisational structure and delegation of authority
Competence, accountability and performance incentives
Specifying objectives and identifying risks
Fraud risk assessment
Identifying and assessing significant change

Designing Control Activities

Types of controls: preventive, detective, manual and automated
Segregation of duties and access control
Controls over key processes: procurement, payments, payroll and financial close
IT general controls and application controls
Controls over outsourced services and third parties
Policies and procedures that put controls into practice

Information, Communication and Monitoring

Quality of information and data governance
Internal and external communication of control responsibilities
Ongoing monitoring and separate evaluations
Continuous monitoring and data analytics
Controls over automation, robotic process automation and AI-enabled processes
Internal control over sustainability reporting using COSO guidance

Evaluating and Reporting on Internal Control

Building the risk and control matrix
Testing design and operating effectiveness: methods and sampling
Evaluating deficiencies and determining severity
Reporting to management and the audit committee
Remediation plans and follow-up
Action plan: strengthening internal control in your organisation

Competencies

COSO framework application

Control environment assessment

Risk and fraud risk assessment

Control activity design

IT general and application controls

Risk and control matrix development

Control testing and deficiency evaluation

Monitoring and continuous control assurance

Internal control over sustainability reporting

Live Online

Access Elite Academy’s complete training portfolio live online. Organizations, distributed teams and professionals can join scheduled interactive sessions or request any program to be delivered online, subject to scheduling and delivery requirements. Elite Academy’s Live Online Training provides access to our complete portfolio of professional programs without linking availability to a physical destination. Organizations, multi-location teams and individual professionals can join scheduled instructor-led sessions or request any program from the Elite Academy portfolio for live online delivery, subject to scheduling and delivery requirements. The format preserves real-time interaction, expert guidance and practical learning while removing the need to travel. Browse the current Live Online schedule below or request your preferred program and dates.