COSO Framework: 5 Components & 17 Principles (CMA Part 1 Study Guide)

The COSO Internal Control–Integrated Framework is one of the most tested topics in CMA Part 1, Section E (Internal Controls). This guide covers the full framework the way CMA examiners test it: components, principles, objectives — and a memory aid that makes it stick.

Origin of the COSO Framework

The Watergate investigations of 1973–74 revealed that U.S. companies were bribing foreign government officials and political parties. That scandal produced the Foreign Corrupt Practices Act (FCPA) of 1977. The private sector responded by forming the National Commission on Fraudulent Financial Reporting (NCFFR) in 1985 — known as the Treadway Commission after its first chair, James C. Treadway.

The Treadway Commission was sponsored by five U.S. professional accounting organizations. This group became the Committee of Sponsoring Organizations of the Treadway Commission — COSO. Its recommendation led to the Internal Control–Integrated Framework, published in 1992 and updated in 1994 and 2013.

COSO definition of internal control

Internal control is a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance — not absolute assurance — regarding the achievement of the entity's objectives relating to operations, reporting, and compliance.

Five things this definition tells you:

• It targets three classes of objectives: operations, reporting, and compliance.
• It is an ongoing process, not a one-time setup.
• It is effected by people at all levels — board, management, and every employee.
• It provides reasonable, never absolute, assurance.
• It adapts to the entity's structure.

The 5 components of internal control

Memorize with: “Controls stop CRIME” — Control activities, Risk assessment, Information and communication, Monitoring, control Environment.

Component 1: Control Environment (5 principles)

• The organization demonstrates commitment to integrity and ethical values — tone at the top through words and actions, proper performance evaluation, and timely correction of deviations.
• The board of directors is independent from management and exercises oversight of internal control — including asking management the difficult questions.
• Management establishes structures, reporting lines, and assigns authority and responsibility under board oversight.
• The organization attracts, develops, and retains competent people aligned with its objectives.
• Individuals are held accountable for internal control responsibilities — clear structure, authority, and incentive systems.

Component 2: Risk Assessment (4 principles)

• The organization specifies objectives with enough clarity (operations, external financial reporting, external nonfinancial reporting, internal reporting, compliance) to identify related risks.
• It analyzes risks to determine the response: avoid (end the activity), retain (accept it), reduce/mitigate (lower it), share (transfer via insurance, hedging, joint ventures), or exploit (seek the upside — e.g., accelerating a launch ahead of a competitor).
• It considers the potential for fraud in assessing risks to objectives.
• It identifies and assesses significant changes — in the external environment, business model, or leadership — and adapts controls accordingly.

Component 3: Control Activities (3 principles)

• Select and develop control activities that manage risk.
• Select and develop control activities over technology.
• Deploy control activities through policies — turning policies into procedures.

Component 4: Information & Communication (3 principles)

• Obtain, generate, and use relevant, quality information to support internal control.
• Communicate internally — objectives and responsibilities — to support the control function.
• Communicate with external parties on matters affecting internal control.

Component 5: Monitoring (2 principles)

• Select, develop, and perform ongoing and/or separate evaluations to check that controls are present and functioning.
• Evaluate and communicate control deficiencies in a timely manner.

Exam tips: how CMA tests this topic

• CMA loves the CRIME mnemonic — expect a question asking you to list or identify the five components.
• Know the counts: 5 components, 17 principles (5+4+3+3+2), 3 objectives.
• 'Reasonable assurance, not absolute assurance' appears in correct answers repeatedly.
• Risk responses (avoid, retain, reduce, share, exploit) are a favorite MCQ set — learn each with one example.
• Distinguish monitoring (component 5) from control activities (component 3): monitoring checks that controls work; control activities ARE the controls.

Frequently asked questions

What are the 5 components of the COSO framework?

Control environment, risk assessment, control activities, information and communication, and monitoring — memorized as “Controls stop CRIME.”

How many principles does COSO 2013 have?

17 principles across the 5 components: 5 + 4 + 3 + 3 + 2.

What are the 3 objectives of internal control under COSO?

Operations, reporting, and compliance.

What is the difference between risk assessment and control activities?

Risk assessment identifies and analyzes risks and chooses a response; control activities are the policies and procedures put in place to manage those risks.

Study CMA (USA) with Knowledge Valley

These notes come straight from our CMA (USA) live classes. If you want the full Section E — taught live, with exam-focused short notes, 4,000+ practice MCQs and 14 mock exams — book a free orientation and trial class at knowledgevalley.net. 10+ years coaching CMA candidates across Pakistan, the Gulf and worldwide.