The COSO framework is a means of designing, implementing, and evaluating control within an organization. The COSO framework’s five components are control environment, risk assessment, control activities, information and communication, and monitoring activities. As a fraud risk management tool, businesses can design, implement, and evaluate internal control procedures.
According to the Association of Certified Fraud Examiners, weak internal control is the cause of almost 50% of all company fraud.
To develop a strong and effective internal control system, the COSO framework was created by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
The committee is comprised of representatives from various industries, including accounting, finance, and auditing.
Collectively, the committee develops procedural guidance that assists businesses with risk assessment. In so doing, internal controls are strengthened to reduce the likelihood of fraud.
What constitutes internal control? How is it defined?
The COSO framework states that internal control is a “process effected by an entity’s board of directors, management and other personnel designed to provide reasonable assurance of the achievement of objectives” under the following categories:
Operational effectiveness and efficiency. This includes performance goals and securing assets against potential fraud.
Financial reporting liability – whether that be internally or externally. Transparency, punctuality, and reliability are vital.
Legal and regulatory compliance.
The five components of the COSO framework
Five components work together to deliver an effective internal control system while supporting the vision, goals, or objectives of the business concerned.
Let’s take a look at each in more detail.
1 – Control Environment
This encompasses the standards or processes that dictate internal control across an organization.
Typically, upper management will set the tone regarding the importance of establishing and then maintaining internal control.
This creates an environment that attracts, develops, and then retains talented individuals.
There is also accountability in performance and rewards and incentives are routinely given where appropriate.
To some extent, the control environment also extends to ethical values and organizational structure.
2 – Risk assessment
Every business deals with risk, but not all deal with risk effectively.
Those with robust internal control will assess each risk according to the level of the threat to company objectives and established risk tolerances.
Importantly, businesses must consider internal and external risks that can weaken internal control.
3 – Control activities
Once risks have been identified, policies and procedures must be devised to mitigate against them.
These so-called “control activities” must be implemented across the organization to help it achieve stated goals without taking unnecessary risks.
Here, internal control is maintained by authorizations, approvals, verifications, and performance reviews. If possible, employee duties should also be segregated commensurate with experience or skill level.
4 – Information and communication
COSO framework principles help ensure that all internal and external communications adhere to company procedures and further company objectives.
Information must also be disseminated only when appropriate. For example, a new policy should be communicated to every employee in the organization.
However, share price-sensitive information should be confined to upper management until released to the market.
5 – Monitoring activities
Monitoring controls is just as important – if not more important – than establishing them.
Periodic evaluation should be incorporated into all business practices to ensure that controls are being maintained.
Externally, financial reporting is particularly important in deterring fraud.
COSO framework example
The development of the COSO framework is a complex and detailed process, so we’ll focus on a single example to conclude this article.
In this case, we’ve taken inspiration from an implementation guide released by the COSO coalition itself in 2019 for the healthcare industry.
Hospitals need to comply with a substantial amount of laws and other directives.
In addition to laws that relate to patient care, they must be compliant from the moment the patient enters the building until the moment they are discharged and billed.
If any of these internal processes do not function properly, the hospital is unable to receive reimbursement for services rendered or, in some cases, its ability to do is severely hampered.
This has obvious impacts on financial performance and organizational success – particularly for healthcare institutions that are run privately and do not receive governmental support.
However, since all hospitals depend on the compliance and coordination of numerous departments and stakeholders to provide proper care, there is no institution that would not benefit from a robust internal control system.
With that said, let’s take a look at how the COSO framework can be implemented in a healthcare organization across five important phases.
Phase 1 – Planning and scoping
According to COSO, the first phase is comprised of three components that are specific to healthcare contexts:
Orientation – to start, executive management must be fully supportive of the initiative and communicate with strong, consistent messaging to the rest of the organization. This is seen as important in large and complex healthcare organizations that have undergone multiple mergers and acquisitions.
Planning – since there are often competing simultaneous priorities in hospitals, timelines should be flexible and responsive to match.
Scoping – in healthcare organizations, risk management scoping should focus on the quality of care, patient and employee safety, IT capacity, compliance, and cybersecurity.
Phase 2 – Assessment and documentation
Like most other organizations, the existing control structure of a hospital depends on variables such as size, location, and various state or federal requirements. Some aspects that are more pertinent to healthcare include:
Centralized vs. decentralized system structure – whether the system structure is centralized or decentralized affects the implementation approach. This may encompass the departments under consideration, the number of personnel to interview, and the number of hospital system locations to visit. Some healthcare organizations with a global presence may also find it useful to create process maps to illustrate control-related variability. In turn, this enables management to minimize absenteeism and travel disruption for important staff.
Fraud risk assessment – hospitals are not immune to fraud. Some of the most common instances of fraud are related to drug and supply theft, billing patients for procedures that have not been performed, and unauthorized access to confidential patient information.
Gap assessment – for an example of where controls may be lacking, consider the clinical documentation improvement (CDI) process. Some hospital systems may perform a CDI review before the medical bill is sent to the patient, with this weakness resulting in substantial financial reporting errors.
Phase 3 – Remediation planning and implementation
Once all gaps have been assessed and the deficiencies identified and rated, the healthcare organization can start the process of remediation and action plan design.
Remediation plans in hospitals tend to be complex and may require the collaboration of multiple processes, personnel, systems, and third-party service providers.
These plans also require management to devote extra time and attention to ensuring their successful implementation.
Phase 4 – Design, testing, and reporting of controls
In the fourth phase, the healthcare organization selects controls for testing and then designs the tests for each control. COSO advocates two main testing methods in these contexts:
Observation – where the team observes the actual performance of the control. This method works well for real-time error messages such as a patient record returning a “not authorized” error message. Observation is also useful to validate control design for manual processes since it can determine whether written procedures are being followed to the letter in practice.
Documentation examination – where the entire population of activities or transactions that necessitate control performance is understood. If a control stated that journal entries need to be reviewed and approved by qualified personnel, for example, tests would examine the supporting evidence generated by the control. In other words, proof that the journal entry was in fact reviewed and approved before its entry.
Phase 5 – Optimization of the effectiveness of internal controls
In the final phase, the healthcare organization optimizes its internal control system by continuously ensuring it is aligned with its vision, mission, strategies, and objectives.
It’s also important to select a mix of preventative and detective controls, and the same can also be said for manual and automated controls.
An example of a manual control in a hospital is the documentation review performed by a CDI specialist when interacting with patient charts or electronic health record (EHR) screens.
This control needs to check for completeness, accuracy, and appropriateness of the information since the risk of inaccurate information, as we discussed at the outset, can lead to patient dissatisfaction, non-compliance, and financial loss.
Key takeaways
The COSO framework is a fraud risk management tool that businesses use to design, implement, and evaluate internal control procedures.
The COSO framework guides the best practices for operational effectiveness, financial reporting, and legal or regulatory compliance.
The COSO framework has five core components. In combination, each allows a business to maintain internal control without sacrificing the ability to meet goals or uphold company values.
A failure mode and effects analysis (FMEA) is a structured approach to identifying design failures in a product or process. Developed in the 1950s, the failure mode and effects analysis is one the earliest methodologies of its kind. It enables organizations to anticipate a range of potential failures during the design stage.
Agile Business Analysis (AgileBA) is certification in the form of guidance and training for business analysts seeking to work in agile environments. To support this shift, AgileBA also helps the business analyst relate Agile projects to a wider organizational mission or strategy. To ensure that analysts have the necessary skills and expertise, AgileBA certification was developed.
Business valuations involve a formal analysis of the key operational aspects of a business. A business valuation is an analysis used to determine the economic value of a business or company unit. It’s important to note that valuations are one part science and one part art. Analysts use professional judgment to consider the financial performance of a business with respect to local, national, or global economic conditions. They will also consider the total value of assets and liabilities, in addition to patented or proprietary technology.
A paired comparison analysis is used to rate or rank options where evaluation criteria are subjective by nature. The analysis is particularly useful when there is a lack of clear priorities or objective data to base decisions on. A paired comparison analysis evaluates a range of options by comparing them against each other.
The Monte Carlo analysis is a quantitative risk management technique. The Monte Carlo analysis was developed by nuclear scientist Stanislaw Ulam in 1940 as work progressed on the atom bomb. The analysis first considers the impact of certain risks on project management such as time or budgetary constraints. Then, a computerized mathematical output gives businesses a range of possible outcomes and their probability of occurrence.
A cost-benefit analysis is a process a business can use to analyze decisions according to the costs associated with making that decision. For a cost analysis to be effective it’s important to articulate the project in the simplest terms possible, identify the costs, determine the benefits of project implementation, assess the alternatives.
The CATWOE analysis is a problem-solving strategy that asks businesses to look at an issue from six different perspectives. The CATWOE analysis is an in-depth and holistic approach to problem-solving because it enables businesses to consider all perspectives. This often forces management out of habitual ways of thinking that would otherwise hinder growth and profitability. Most importantly, the CATWOE analysis allows businesses to combine multiple perspectives into a single, unifying solution.
It’s possible to identify the key players that overlap with a company’s business model with a competitor analysis. This overlapping can be analyzed in terms of key customers, technologies, distribution, and financial models. When all those elements are analyzed, it is possible to map all the facets of competition for a tech business model to understand better where a business stands in the marketplace and its possible future developments.
The Pareto Analysis is a statistical analysis used in business decision making that identifies a certain number of input factors that have the greatest impact on income. It is based on the similarly named Pareto Principle, which states that 80% of the effect of something can be attributed to just 20% of the drivers.
A comparable company analysis is a process that enables the identification of similar organizations to be used as a comparison to understand the business and financial performance of the target company. To find comparables you can look at two key profiles: the business and financial profile. From the comparable company analysis it is possible to understand the competitive landscape of the target organization.
A SWOT Analysis is a framework used for evaluating the business’s Strengths, Weaknesses, Opportunities, and Threats. It can aid in identifying the problematic areas of your business so that you can maximize your opportunities. It will also alert you to the challenges your organization might face in the future.
The PESTEL analysis is a framework that can help marketers assess whether macro-economic factors are affecting an organization. This is a critical step that helps organizations identify potential threats and weaknesses that can be used in other frameworks such as SWOT or to gain a broader and better understanding of the overall marketing environment.
Business analysis is a research discipline that helps driving change within an organization by identifying the key elements and processes that drive value. Business analysis can also be used in Identifying new business opportunities or how to take advantage of existing business opportunities to grow your business in the marketplace.
In corporate finance, the financial structure is how corporations finance their assets (usually either through debt or equity). For the sake of reverse engineering businesses, we want to look at three critical elements to determine the model used to sustain its assets: cost structure, profitability, and cash flow generation.
Financial modeling involves the analysis of accounting, finance, and business data to predict future financial performance. Financial modeling is often used in valuation, which consists of estimating the value in dollar terms of a company based on several parameters. Some of the most common financial models comprise discounted cash flows, the M&A model, and the CCA model.
Value investing is an investment philosophy that looks at companies’ fundamentals, to discover those companies whose intrinsic value is higher than what the market is currently pricing, in short value investing tries to evaluate a business by starting by its fundamentals.
The Buffet Indicator is a measure of the total value of all publicly-traded stocks in a country divided by that country’s GDP. It’s a measure and ratio to evaluate whether a market is undervalued or overvalued. It’s one of Warren Buffet’s favorite measures as a warning that financial markets might be overvalued and riskier.
Financial accounting is a subdiscipline within accounting that helps organizations provide reporting related to three critical areas of a business: its assets and liabilities (balance sheet), its revenues and expenses (income statement), and its cash flows (cash flow statement). Together those areas can be used for internal and external purposes.
Post-mortem analyses review projects from start to finish to determine process improvements and ensure that inefficiencies are not repeated in the future. In the Project Management Book of Knowledge (PMBOK), this process is referred to as “lessons learned”.
Retrospective analyses are held after a project to determine what worked well and what did not. They are also conducted at the end of an iteration in Agile project management. Agile practitioners call these meetings retrospectives or retros. They are an effective way to check the pulse of a project team, reflect on the work performed to date, and reach a consensus on how to tackle the next sprint cycle.
In essence, a root cause analysis involves the identification of problem root causes to devise the most effective solutions. Note that the root cause is an underlying factor that sets the problem in motion or causes a particular situation such as non-conformance.
A break-even analysis is commonly used to determine the point at which a new product or service will become profitable. The analysis is a financial calculation that tells the business how many products it must sell to cover its production costs. A break-even analysis is a small business accounting process that tells the business what it needs to do to break even or recoup its initial investment.
Stanford University Professor Ronald A. Howard first defined decision analysis as a profession in 1964. Over the ensuing decades, Howard has supervised many doctoral theses on the subject across topics including nuclear waste disposal, investment planning, hurricane seeding, and research strategy. Decision analysis (DA) is a systematic, visual, and quantitative decision-making approach where all aspects of a decision are evaluated before making an optimal choice.
A DESTEP analysis is a framework used by businesses to understand their external environment and the issues which may impact them. The DESTEP analysis is an extension of the popular PEST analysis created by Harvard Business School professor Francis J. Aguilar. The DESTEP analysis groups external factors into six categories: demographic, economic, socio-cultural, technological, ecological, and political.
The STEEP analysis is a tool used to map the external factors that impact an organization. STEEP stands for the five key areas on which the analysis focuses: socio-cultural, technological, economic, environmental/ecological, and political. Usually, the STEEP analysis is complementary or alternative to other methods such as SWOT or PESTEL analyses.
The STEEPLE analysis is a variation of the STEEP analysis. Where the step analysis comprises socio-cultural, technological, economic, environmental/ecological, and political factors as the base of the analysis. The STEEPLE analysis adds other two factors such as Legal and Ethical.
Gennaro is the creator of FourWeekMBA, which reached about four million business people, comprising C-level executives, investors, analysts, product managers, and aspiring digital entrepreneurs in 2022 alone | He is also Director of Sales for a high-tech scaleup in the AI Industry | In 2012, Gennaro earned an International MBA with emphasis on Corporate Finance and Business Strategy.
