Almost every audit report you write rests on one question: is internal control working? The COSO Internal Control – Integrated Framework is the most widely used yardstick for answering it. Banks, listed companies, state-owned enterprises, public sector ministries and NGOs across Africa use it, whether they name it or not, to design controls, and auditors use it to evaluate them. This guide explains what the framework requires, why it matters, where organisations commonly fall short, and gives you a checklist you can use on your next engagement.
What the COSO framework is
COSO (the Committee of Sponsoring Organizations of the Treadway Commission) first published the Integrated Framework in 1992. An updated version was released in May 2013, and COSO treated the original 1992 framework as superseded after 15 December 2014. The 2013 edition is the current version.
The framework defines internal control as a process, carried out by the board, management and other personnel, designed to provide reasonable assurance about achieving objectives in three categories:
- Operations – effectiveness and efficiency of operations, including safeguarding assets.
- Reporting – internal and external, financial and non-financial reporting.
- Compliance – adherence to applicable laws and regulations.
Two words in that definition deserve attention. “Process” means control is ongoing, not a policy manual on a shelf. “Reasonable” means control cannot guarantee outcomes; collusion, management override and human error remain limitations the framework openly acknowledges.
The five components and 17 principles
The biggest change in 2013 was codifying the five components into 17 principles. Each principle is supported by “points of focus”, which are important characteristics to consider but are not mandatory requirements.
| Component | Principles | What it means in practice |
|---|---|---|
| Control Environment | 1–5 | Commitment to integrity and ethical values; board independence and oversight; structures, reporting lines and authority; commitment to competence; accountability for control responsibilities. |
| Risk Assessment | 6–9 | Clear objectives; identifying and analysing risks; considering the potential for fraud; identifying and assessing significant changes. |
| Control Activities | 10–12 | Selecting and developing control activities; general controls over technology; deploying controls through policies and procedures. |
| Information and Communication | 13–15 | Using relevant, quality information; communicating internally; communicating with external parties. |
| Monitoring Activities | 16–17 | Ongoing and/or separate evaluations; evaluating and communicating deficiencies in a timely manner. |
The framework is often drawn as a cube: the three objective categories across the top, the five components down the front, and the entity’s structure (entity, division, operating unit, function) along the side. The message is that every component applies to every objective at every level of the organisation.
When is internal control “effective”?
Under the 2013 framework, an effective system of internal control requires that:
- Each of the five components and each relevant principle is present (exists in design) and functioning (operates as designed).
- The five components operate together in an integrated manner.
Where a deficiency, or combination of deficiencies, severely reduces the likelihood that the entity can achieve its objectives, the framework calls this a major deficiency, and the system cannot be concluded to be effective. Management judgement is required throughout, which is why auditors should document the reasoning behind each conclusion, not just the result.
Why it matters for auditors in Zimbabwe and the region
For external auditors, COSO’s components map closely onto the components of internal control described in ISA 315 (Revised 2019), so a COSO-literate team understands its client’s control system faster. For internal auditors, COSO provides the criteria for findings: a weak segregation of duties is not just “bad practice”, it is a failure of Principle 10.
The framework is also relevant beyond financial reporting. Banks working under Reserve Bank of Zimbabwe supervision, public entities accountable to Parliament and the Auditor-General, and donor-funded NGOs reporting to multiple funders all face operations, reporting and compliance objectives at once. COSO gives them one shared language. In March 2023 COSO also issued supplemental guidance, Achieving Effective Internal Control over Sustainability Reporting (ICSR), applying the same 17 principles to sustainability and ESG data, a growing area as more African organisations publish sustainability reports.
Common gaps seen in practice
1. Control environment “on paper”
A code of ethics exists, but staff have never signed it, there is no whistleblowing channel that works, and the audit committee meets irregularly or lacks financial expertise.
2. Risk assessment done once and filed
Risk registers are compiled for the annual plan and not revisited when significant changes occur, such as currency changes, new systems, restructuring or new regulations. Principle 9 specifically requires assessing change.
3. Fraud risk not assessed separately
Principle 8 expects organisations to consider fraud risk, including incentives, opportunities and rationalisation. Many risk registers list “fraud” as a single line with no analysis.
4. Weak IT general controls
Shared passwords, users with excessive access, no review of system logs and uncontrolled changes to accounting or payroll systems all undermine Principle 11, and with it the reliability of every automated control.
5. Monitoring without follow-through
Audit findings are reported but not tracked to closure, so the same issues reappear year after year. Principle 17 requires deficiencies to be communicated and corrected in a timely manner.
Practical COSO checklist for your next engagement
- Is there a documented, communicated code of conduct, with periodic staff acknowledgement?
- Does the board or audit committee exercise independent oversight, with documented minutes and follow-up?
- Are organisational objectives defined clearly enough for risks to be identified against them?
- Is the risk register reviewed at least annually and whenever significant changes occur?
- Has a specific fraud risk assessment been performed?
- Are key control activities mapped to the risks they address, with segregation of duties considered?
- Are IT general controls (access, change management, operations) designed and tested?
- Is information used for decisions complete, accurate and timely?
- Are there both ongoing monitoring and separate evaluations, such as internal audit reviews?
- Are deficiencies reported to the right level and tracked until they are resolved?
- For each of the 17 principles, can you show evidence that it is both present and functioning?
For ongoing monitoring, data analytics adds real strength: testing whole populations of payments, journals or payroll records rather than samples. When transaction volumes outgrow Excel, a tool such as ProDataTool can handle datasets from thousands to millions of rows, with filtering, summarisation and pivot analysis to support those tests.
Conclusion
COSO is not a compliance checklist to complete once; it is a way of thinking about whether an organisation can reliably achieve what it sets out to do. Mapping your audit work to the five components and 17 principles strengthens your findings, gives management clear criteria and helps boards see where control is weak. Start small: pick one process, map its controls to the principles, and see where the evidence of “present and functioning” runs thin.
Put COSO into practice with Auditors Track GRC
Mapping risks and controls to COSO principles across many departments quickly becomes difficult in spreadsheets. Auditors Track GRC is internal audit management software that helps organisations across Africa digitise audit work, from risk assessments and audit reviews to findings, report writing and evidence attachments. Built-in libraries of controls, audits, working papers and risks give your team a head start, dashboards by department and engagement type show where control weaknesses are concentrated, and multi-user department assignments keep everyone accountable. Book a free demo of Auditors Track GRC and see how your team can bring COSO-based audit work into one system.
What the COSO framework is
COSO (the Committee of Sponsoring Organizations of the Treadway Commission) first published the Integrated Framework in 1992. An updated version was released in May 2013, and COSO treated the original 1992 framework as superseded after 15 December 2014. The 2013 edition is the current version.
The framework defines internal control as a process, carried out by the board, management and other personnel, designed to provide reasonable assurance about achieving objectives in three categories:
- Operations – effectiveness and efficiency of operations, including safeguarding assets.
- Reporting – internal and external, financial and non-financial reporting.
- Compliance – adherence to applicable laws and regulations.
Two words in that definition deserve attention. “Process” means control is ongoing, not a policy manual on a shelf. “Reasonable” means control cannot guarantee outcomes; collusion, management override and human error remain limitations the framework openly acknowledges.
The five components and 17 principles
The biggest change in 2013 was codifying the five components into 17 principles. Each principle is supported by “points of focus”, which are important characteristics to consider but are not mandatory requirements.
| Component | Principles | What it means in practice |
|---|---|---|
| Control Environment | 1–5 | Commitment to integrity and ethical values; board independence and oversight; structures, reporting lines and authority; commitment to competence; accountability for control responsibilities. |
| Risk Assessment | 6–9 | Clear objectives; identifying and analysing risks; considering the potential for fraud; identifying and assessing significant changes. |
| Control Activities | 10–12 | Selecting and developing control activities; general controls over technology; deploying controls through policies and procedures. |
| Information and Communication | 13–15 | Using relevant, quality information; communicating internally; communicating with external parties. |
| Monitoring Activities | 16–17 | Ongoing and/or separate evaluations; evaluating and communicating deficiencies in a timely manner. |
The framework is often drawn as a cube: the three objective categories across the top, the five components down the front, and the entity’s structure (entity, division, operating unit, function) along the side. The message is that every component applies to every objective at every level of the organisation.
When is internal control “effective”?
Under the 2013 framework, an effective system of internal control requires that:
- Each of the five components and each relevant principle is present (exists in design) and functioning (operates as designed).
- The five components operate together in an integrated manner.
Where a deficiency, or combination of deficiencies, severely reduces the likelihood that the entity can achieve its objectives, the framework calls this a major deficiency, and the system cannot be concluded to be effective. Management judgement is required throughout, which is why auditors should document the reasoning behind each conclusion, not just the result.
Why it matters for auditors in Zimbabwe and the region
For external auditors, COSO’s components map closely onto the components of internal control described in ISA 315 (Revised 2019), so a COSO-literate team understands its client’s control system faster. For internal auditors, COSO provides the criteria for findings: a weak segregation of duties is not just “bad practice”, it is a failure of Principle 10.
The framework is also relevant beyond financial reporting. Banks working under Reserve Bank of Zimbabwe supervision, public entities accountable to Parliament and the Auditor-General, and donor-funded NGOs reporting to multiple funders all face operations, reporting and compliance objectives at once. COSO gives them one shared language. In March 2023 COSO also issued supplemental guidance, Achieving Effective Internal Control over Sustainability Reporting (ICSR), applying the same 17 principles to sustainability and ESG data, a growing area as more African organisations publish sustainability reports.
Common gaps seen in practice
1. Control environment “on paper”
A code of ethics exists, but staff have never signed it, there is no whistleblowing channel that works, and the audit committee meets irregularly or lacks financial expertise.
2. Risk assessment done once and filed
Risk registers are compiled for the annual plan and not revisited when significant changes occur, such as currency changes, new systems, restructuring or new regulations. Principle 9 specifically requires assessing change.
3. Fraud risk not assessed separately
Principle 8 expects organisations to consider fraud risk, including incentives, opportunities and rationalisation. Many risk registers list “fraud” as a single line with no analysis.
4. Weak IT general controls
Shared passwords, users with excessive access, no review of system logs and uncontrolled changes to accounting or payroll systems all undermine Principle 11, and with it the reliability of every automated control.
5. Monitoring without follow-through
Audit findings are reported but not tracked to closure, so the same issues reappear year after year. Principle 17 requires deficiencies to be communicated and corrected in a timely manner.
Practical COSO checklist for your next engagement
- Is there a documented, communicated code of conduct, with periodic staff acknowledgement?
- Does the board or audit committee exercise independent oversight, with documented minutes and follow-up?
- Are organisational objectives defined clearly enough for risks to be identified against them?
- Is the risk register reviewed at least annually and whenever significant changes occur?
- Has a specific fraud risk assessment been performed?
- Are key control activities mapped to the risks they address, with segregation of duties considered?
- Are IT general controls (access, change management, operations) designed and tested?
- Is information used for decisions complete, accurate and timely?
- Are there both ongoing monitoring and separate evaluations, such as internal audit reviews?
- Are deficiencies reported to the right level and tracked until they are resolved?
- For each of the 17 principles, can you show evidence that it is both present and functioning?
For ongoing monitoring, data analytics adds real strength: testing whole populations of payments, journals or payroll records rather than samples. When transaction volumes outgrow Excel, a tool such as ProDataTool can handle datasets from thousands to millions of rows, with filtering, summarisation and pivot analysis to support those tests.
Conclusion
COSO is not a compliance checklist to complete once; it is a way of thinking about whether an organisation can reliably achieve what it sets out to do. Mapping your audit work to the five components and 17 principles strengthens your findings, gives management clear criteria and helps boards see where control is weak. Start small: pick one process, map its controls to the principles, and see where the evidence of “present and functioning” runs thin.
Put COSO into practice with Auditors Track GRC
Mapping risks and controls to COSO principles across many departments quickly becomes difficult in spreadsheets. Auditors Track GRC is internal audit management software that helps organisations across Africa digitise audit work, from risk assessments and audit reviews to findings, report writing and evidence attachments. Built-in libraries of controls, audits, working papers and risks give your team a head start, dashboards by department and engagement type show where control weaknesses are concentrated, and multi-user department assignments keep everyone accountable. Book a free demo of Auditors Track GRC and see how your team can bring COSO-based audit work into one system.