Overview – Trust Services Criteria
COSO’s CC5.3 for the component Control Activities requires the following “Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.”
Points of Focus
Below are the points of focus and any related mappings to other frameworks and standards.
| Description | Mapping to other frameworks and standards |
| Establishes Policies and Procedures to Support Deployment of Management ‘s Directives — Management establishes control activities that are built into business processes and employees’ day-to-day activities through policies establishing what is expected and relevant procedures specifying actions. | NIST CSF – ID.GV-1 – Organizational information security policy is established |
| Establishes Responsibility and Accountability for Executing Policies and Procedures — Management establishes responsibility and accountability for control activities with management (or other designated personnel) of the business unit or function in which the relevant risks reside. | NIST CSF – ID.GV-2 – Information security roles & responsibilities are coordinated and aligned with internal roles and external partners |
| Performs in a Timely Manner — Responsible personnel perform control activities in a timely manner as defined by the policies and procedures. | |
| Takes Corrective Action — Responsible personnel investigate and act on matters identified as a result of executing control activities. | |
| Performs Using Competent Personnel — Competent personnel with sufficient authority perform control activities with diligence and continuing focus. | |
| Reassesses Policies and Procedures — Management periodically reviews control activities to determine their continued relevance and refreshes them when necessary. | · NIST CSF – PR.IP-7 – Protection processes are continuously improved · NIST CSF – PR.IP-12 – A vulnerability management plan is developed and implemented · NIST CSF – DE.DP-5 – Detection processes are continuously improved |
What is the COSO Framework?
COSO means the Committee of Sponsoring Organizations of the Treadway Commission. It is a joint initiative of five private sector organizations and provides thought leadership through the development of frameworks and guidance on enterprise risk management, internal control, and fraud deterrence.
Source: https://us.aicpa.org/interestareas/businessindustryandgovernment/resources/riskmanagmentandinternalcontrol/coso-integrated-framework-project
The COSO Internal Control Framework was developed to help “organizations design and implement internal control in light of the many changes in business and operating environments.” The Treadway Commission designed the framework with SOX in mind, but the framework goes beyond financial reporting controls since it applies to operations, compliance, and reporting (both internal and external). For most public companies, the process of using the COSO Internal Control Framework is an exercise in mapping their SOX controls to the COSO Internal Control Framework and then evaluating the control environment in total against the framework.
The COSO Internal Control Framework is a comprehensive model comprising of the following five (5) integrated Components supported by seventeen (17) Principles. Below are the five (5) Components:
- Control Environment
- Risk Assessment
- Control Activities
- Information and Communication
- Monitoring
Source: https://www.auditboard.com/blog/difference-between-coso-and-sox/
Internal Control Categories
The COSO framework divides internal control objectives into three (3) categories: Operations, Reporting and Compliance.
- Operations objectives, such as performance goals and securing the organization’s assets against fraud, focus on the effectiveness and efficiency of your business operations.
- Reporting objectives, including both internal and external financial reporting as well as non-financial reporting, relate to transparency, timeliness and reliability of the organization’s reporting habits.
- Compliance objectives are internal control goals based around adhering to laws and regulations that the organization must comply with.
Source: https://www.i-sight.com/resources/coso-framework-what-it-is-and-how-to-use-it/