Overview – Trust Services Criteria
COSO’s CC3.1 for the component Risk Assessment requires the following “Principle 6: The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.”
Points of Focus
Below are the points of focus and any related mappings to other frameworks and standards.
| Description | Mapping to other frameworks and standards |
| Operations Objectives | |
| Reflects Management’s Choices — Operations objectives reflect management’s choices about structure, industry considerations, and performance of the entity. | · NIST CSF – ID.BE-1 – The organization’s role in the supply chain is identified and communicated · NIST CSF – ID.BE-2 – The organization’s place in critical infrastructure and its industry sector is identified and communicated · NIST CSF – ID.BE-3 – Priorities for organizational mission, objectives, and activities are established and communicated · NIST CSF – ID.BE-4 – Dependencies and critical functions for delivery of critical services are established · NIST CSF – ID.BE-5 – Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations) |
| Considers Tolerances for Risk — Management considers the acceptable levels of variation relative to the achievement of operations objectives. | · NIST CSF – ID.RM-2 – Organizational risk tolerance is determined and clearly expressed · NIST CSF – ID.RM-3 – The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis |
| Includes Operations and Financial Performance Goals — The organization reflects the desired level of operations and financial performance for the entity within operations objectives. | NIST CSF – ID.GV-4 – Governance and risk management processes address cybersecurity risks |
| Forms a Basis for Committing of Resources — Management uses operations objectives as a basis for allocating resources needed to attain desired operations and financial performance. | NIST CSF – ID.RM-3 – The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis |
| External Financial Reporting Objectives | |
| Complies With Applicable Accounting Standards — Financial reporting objectives are consistent with accounting principles suitable and available for that entity. The accounting principles selected are appropriate in the circumstances. | |
| Considers Materiality — Management considers materiality in financial statement presentation. | NIST CSF – ID.RM-2 – Organizational risk tolerance is determined and clearly expressed |
| Reflects Entity Activities — External reporting reflects the underlying transactions and events to show qualitative characteristics and assertions. | |
| External Nonfinancial Reporting Objectives | |
| Complies With Externally Established Frameworks — Management establishes objectives consistent with laws and regulations or standards and frameworks of recognized external organizations. | |
| Considers the Required Level of Precision — Management reflects the required level of precision and accuracy suitable for user needs and based on criteria established by third parties in nonfinancial reporting. | NIST CSF – ID.RM-2 – Organizational risk tolerance is determined and clearly expressed |
| Reflects Entity Activities — External reporting reflects the underlying transactions and events within a range of acceptable limits. | |
| Internal Reporting Objectives | |
| Reflects Management’s Choices — Internal reporting provides management with accurate and complete information regarding management’s choices and information needed in managing the entity. | |
| Considers the Required Level of Precision — Management reflects the required level of precision and accuracy suitable for user needs in nonfinancial reporting objectives and materiality within financial reporting objectives. | NIST CSF – ID.RM-2 – Organizational risk tolerance is determined and clearly expressed |
| Reflects Entity Activities — Internal reporting reflects the underlying transactions and events within a range of acceptable limits. | |
| Compliance Objectives | |
| Reflects External Laws and Regulations — Laws and regulations establish minimum standards of conduct, which the entity integrates into compliance objectives. | NIST CSF – ID.GV-3 – Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed |
| Considers Tolerances for Risk — Management considers the acceptable levels of variation relative to the achievement of operations objectives. | NIST CSF – ID.RM-3 – The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis |
| Establishes Sub-objectives to Support Objectives — Management identifies sub-objectives related to security, availability, processing integrity, confidentiality, and privacy to support the achievement of the entity’s objectives related to reporting, operations, and compliance. | NIST CSF – ID.RM-2 – Organizational risk tolerance is determined and clearly expressed |
What is the COSO Framework?
COSO means the Committee of Sponsoring Organizations of the Treadway Commission. It is a joint initiative of five private sector organizations and provides thought leadership through the development of frameworks and guidance on enterprise risk management, internal control, and fraud deterrence.
Source: https://us.aicpa.org/interestareas/businessindustryandgovernment/resources/riskmanagmentandinternalcontrol/coso-integrated-framework-project
The COSO Internal Control Framework was developed to help “organizations design and implement internal control in light of the many changes in business and operating environments.” The Treadway Commission designed the framework with SOX in mind, but the framework goes beyond financial reporting controls since it applies to operations, compliance, and reporting (both internal and external). For most public companies, the process of using the COSO Internal Control Framework is an exercise in mapping their SOX controls to the COSO Internal Control Framework and then evaluating the control environment in total against the framework.
The COSO Internal Control Framework is a comprehensive model comprising of the following five (5) integrated Components supported by seventeen (17) Principles. Below are the five (5) Components:
- Control Environment
- Risk Assessment
- Control Activities
- Information and Communication
- Monitoring
Source: https://www.auditboard.com/blog/difference-between-coso-and-sox/
Internal Control Categories
The COSO framework divides internal control objectives into three (3) categories: Operations, Reporting and Compliance.
- Operations objectives, such as performance goals and securing the organization’s assets against fraud, focus on the effectiveness and efficiency of your business operations.
- Reporting objectives, including both internal and external financial reporting as well as non-financial reporting, relate to transparency, timeliness and reliability of the organization’s reporting habits.
- Compliance objectives are internal control goals based around adhering to laws and regulations that the organization must comply with.
Source: https://www.i-sight.com/resources/coso-framework-what-it-is-and-how-to-use-it/