Study guide
Internal Control Frameworks
CMA Part 1 Certified Management Accountant
Track your progress as you read
Finished sections get a check mark.
1 Introduction
About the CMA Part 1 Exam Exam Structure and Content Breakdown Pass Rates and Scoring How to Use This Study Guide
2 1. External Financial Reporting Decisions
1.A Financial Statement Preparation 1.B Revenue Recognition 1.C Lease Accounting 1.D Inventory and Fixed Assets 1.E Financial Statement Analysis
3 Planning, Budgeting, and Forecasting
Strategic Planning Process Budgeting Methodologies Sales and Production Budgets Financial Budgets Forecasting Techniques
4 Performance Management
Variance Analysis Fundamentals Manufacturing Variances Responsibility Accounting Transfer Pricing Performance Measurement Systems
5 Cost Management
Cost Concepts and Classifications Job-Order and Process Costing Activity-Based Costing Cost-Volume-Profit Analysis Relevant Costing and Decision Making
6 Internal Controls
Internal Control Frameworks Enterprise Risk Management Internal Audit Function Governance and Compliance Fraud Prevention and Detection
7 Technology and Analytics
Data Governance and Management Business Intelligence and Dashboards Predictive Analytics and Modeling Data Visualization Best Practices Emerging Technologies in Finance
Internal Control Frameworks
Key Takeaways Explain This Topic AI
COSO Internal Control Framework consists of five interrelated components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring.
The Control Environment is the foundation—it sets the tone at the top and establishes the organization's commitment to integrity and ethical values.
Control Activities are the policies and procedures that help ensure management directives are carried out.
Effective internal controls require all five components to be present and functioning together.
The 17 principles under COSO provide specific guidance for implementing each of the five components.
Last updated: January 2026
Quick Answer: The COSO Internal Control Framework is the most widely used framework for designing and evaluating internal controls. It consists of five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. All five must work together for effective internal control.
What Are Internal Controls?
Internal controls are processes designed and implemented by management to provide reasonable assurance regarding the achievement of objectives in three categories:
- Effectiveness and efficiency of operations
- Reliability of financial reporting
- Compliance with applicable laws and regulations
Internal controls are NOT about detecting every error or fraud—they provide reasonable assurance, not absolute assurance.
The COSO Framework
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control—Integrated Framework in 1992 and updated it in 2013. This framework is the gold standard for internal control design and evaluation.
COSO Framework Structure
- Component Description Key Focus
- Control Environment Foundation of all other components Tone at the top, integrity, ethics
- Risk Assessment Identification and analysis of risks Risk identification, fraud risk
- Control Activities Policies and procedures Segregation of duties, authorizations
- Information & Communication Relevant information flow Quality information, internal/external communication
- Monitoring Ongoing and separate evaluations Continuous monitoring, deficiency reporting
- Component 1: Control Environment
The Control Environment is the foundation of the entire internal control system. It sets the tone for the organization and influences the control consciousness of employees.
Control Environment Principles
- Principle Description
- Commitment to Integrity Demonstrates commitment to ethical values
- Board Independence Board exercises oversight responsibility
- Structure & Authority Establishes organizational structure and reporting lines
- Commitment to Competence Attracts, develops, and retains competent individuals
- Accountability Holds individuals accountable for internal control
- Key Elements of Control Environment
- Integrity and ethical values — The organization's code of conduct and ethics policies
- Board of directors oversight — Independent board members and audit committee
- Management philosophy and operating style — How management leads and communicates
- Organizational structure — Clear reporting relationships and responsibilities
- Human resource policies — Hiring, training, evaluation, and compensation practices
- Component 2: Risk Assessment
Risk Assessment involves identifying and analyzing risks that could prevent the organization from achieving its objectives.
Risk Assessment Process
- Step Activity Output
- 1 Specify Objectives Clear, measurable objectives
- 2 Identify Risks List of potential risks
- 3 Analyze Risks Risk significance and likelihood
- 4 Assess Fraud Risk Fraud opportunities and pressures
- 5 Identify Changes Changes that could impact controls
- Risk Assessment Principles
- Specify suitable objectives across operations, reporting, and compliance
- Identify and analyze risks to achieving objectives
- Consider the potential for fraud including incentives, opportunities, and rationalization
- Identify and assess changes that could significantly impact internal control
- Types of Risks
- Risk Type Description Example
- Inherent Risk Risk before controls are applied High-volume cash transactions
- Residual Risk Risk remaining after controls Risk that passes despite controls
- Control Risk Risk that controls fail Inadequate segregation of duties
- Component 3: Control Activities
Control Activities are the policies and procedures that help ensure management directives are carried out. They occur throughout the organization at all levels and functions.
Types of Control Activities
- Type Description Example
- Preventive Controls Prevent errors/fraud before they occur Requiring dual signatures
- Detective Controls Identify errors/fraud after they occur Bank reconciliations
- Corrective Controls Fix errors after detection Adjusting entries
- Manual Controls Performed by people Approval signatures
- Automated Controls Performed by IT systems Password requirements
- Key Control Activities
- Segregation of Duties — Separating authorization, custody, and recordkeeping
- Authorization and Approval — Proper approval for transactions
- Verification and Reconciliation — Comparing records to source documents
- Physical Controls — Safeguarding assets through locks, security, access controls
- Performance Reviews — Analyzing actual vs. budgeted performance
- IT General Controls — Controls over IT infrastructure and operations
- Segregation of Duties
The most fundamental control activity is segregation of duties :
- Function Should Be Separate From Risk if Combined
- Authorization Custody Could authorize theft
- Authorization Recordkeeping Could hide unauthorized transactions
- Custody Recordkeeping Could steal and cover up
- Component 4: Information and Communication
Information and Communication ensures that relevant, quality information is identified, captured, and communicated in a form and timeframe that enables people to carry out their responsibilities.
Information Quality Criteria
- Criterion Description
- Relevant Supports control decisions
- Timely Available when needed
- Current Reflects latest data
- Accurate Correct and reliable
- Accessible Available to those who need it
- Communication Types
- Internal Communication — Upward, downward, and across the organization
- External Communication — With customers, suppliers, regulators, external auditors
- Reporting Channels — Whistleblower hotlines, anonymous reporting mechanisms
- Component 5: Monitoring Activities
Monitoring evaluates whether each of the five components of internal control is present and functioning. It includes ongoing evaluations and separate evaluations.
Types of Monitoring
- Type Description Frequency
- Ongoing Monitoring Built into normal operations Continuous
- Separate Evaluations Periodic assessments Periodic
- Combination Both approaches together As needed
- Monitoring Activities Include
- Regular management review of operations
- Supervisory review of work performed
- Internal audit assessments
- Self-assessments by departments
- External audit findings review
- Regulatory examination results
- The 17 Principles of COSO
The 2013 COSO framework includes 17 principles that support the five components:
- Component Number of Principles
- Control Environment 5
- Risk Assessment 4
- Control Activities 3
- Information & Communication 3
- Monitoring 2
- Total 17
For internal controls to be effective, all 17 principles must be present and functioning .
Limitations of Internal Control
Even well-designed internal controls have limitations:
- Human error — Mistakes in judgment or fatigue
- Collusion — Multiple people working together to circumvent controls
- Management override — Senior management bypassing controls
- Cost vs. benefit — Some controls may cost more than the risk they prevent
- Changes in conditions — Controls may become obsolete as conditions change