COSO Internal Control: every control, and what you already have

72 controls 225 frameworks share controls with it Global (COSO; used for SOX 404 ICFR assessments in the United States and for internal control generally) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

COSO 2013 Internal Control Integrated Framework Evidence & Implementation Kit

72 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
COBIT 2019	13	measure it →
APPI	4	measure it →
Bahrain PDPL	4	measure it →
Barbados Data Protection Act 2019	4	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	4	measure it →
PDPA Singapore	4	measure it →
PDPA Thailand	4	measure it →
Peru DPL	4	measure it →
POPIA	4	measure it →
Qatar DPL	4	measure it →
Saudi Arabia PDPL	4	measure it →
South Korea PIPA	4	measure it →

Every control

Code	Control	Also in
`CA-10`	Selects and Develops Control Activities	121
`CA-11`	Selects and Develops General Controls over Technology	0
`CA-12`	Deploys Through Policies and Procedures	150
`CE-1`	Demonstrates Commitment to Integrity and Ethical Values	5
`CE-2`	Exercises Oversight Responsibility	0
`CE-3`	Establishes Structure, Authority, and Responsibility	0
`CE-4`	Demonstrates Commitment to Competence	5
`CE-5`	Enforces Accountability	0
`COSO-IC-CA-10`	The organization selects and develops control activities for asset safeguarding and mitigating risks to the achievement of objectives	0
`COSO-IC-CA-11`	The organization selects and develops general controls over technology	0
`COSO-IC-CA-12`	The organization deploys control activities through policies and procedures	0
`COSO-IC-CE-01`	The organization demonstrates commitment to integrity and ethical values	9
`COSO-IC-CE-02`	The board demonstrates independence from management and exercises oversight of internal control	16
`COSO-IC-CE-03`	Management establishes structures, reporting lines, authorities, and responsibilities	0
`COSO-IC-CE-04`	The organization demonstrates commitment to attract, develop, and retain competent individuals	0
`COSO-IC-CE-05`	The organization holds individuals accountable for their internal control responsibilities	0
`COSO-IC-IC-13`	The organization obtains or generates and uses relevant quality information	0
`COSO-IC-IC-14`	The organization internally communicates information including internal control objectives	10
`COSO-IC-IC-15`	The organization communicates with external parties regarding internal control matters	0
`COSO-IC-MA-16`	The organization selects and performs ongoing and/or separate evaluations	0
`COSO-IC-MA-17`	The organization evaluates and communicates internal control deficiencies in a timely manner	0
`COSO-IC-OV-01`	COSO Internal Control Framework - integrated operation of all five components (Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring Act	0
`IC-13`	Uses Relevant Information	0
`IC-14`	Communicates Internally	0
`IC-15`	Communicates Externally	0
`MON-16`	Conducts Ongoing and/or Separate Evaluations	0
`MON-17`	Evaluates and Communicates Deficiencies	0
`P1`	Demonstrates Commitment to Integrity and Ethical Values	32
`P10`	Selects and Develops Control Activities	0
`P11`	Selects and Develops General Controls over Technology	0
`P12`	Deploys through Policies and Procedures	0
`P13`	Uses Relevant Information	0
`P14`	Communicates Internally	0
`P15`	Communicates Externally	0
`P16`	Conducts Ongoing and/or Separate Evaluations	0
`P17`	Evaluates and Communicates Deficiencies	0
`P2`	Exercises Oversight Responsibility	0
`P3`	Establishes Structure, Authority, and Responsibility	0
`P4`	Demonstrates Commitment to Competence	0
`P5`	Enforces Accountability	0
`P6`	Specifies Suitable Objectives	0
`P7`	Identifies and Analyzes Risk	32
`P8`	Assesses Fraud Risk	0
`P9`	Identifies and Analyzes Significant Change	0
`RA-6`	Specifies Suitable Objectives	0
`RA-7`	Risk Response	11
`RA-8`	Assesses Fraud Risk	0
`COMP-CA`	Control Activities (Principles 10 to 12)	0
`COMP-CE`	Control Environment (Principles 1 to 5)	0
`COMP-IC`	Information and Communication (Principles 13 to 15)	0
`COMP-MA`	Monitoring Activities (Principles 16 to 17)	0
`COMP-RA`	Risk Assessment (Principles 6 to 9)	0
`EFFECTIVENESS`	Objectives, components, the requirements for effective internal control, and limitations	0
`FRAMEWORK`	COSO Internal Control, Integrated Framework (2013): what it is and what is held	0
`ICFR-SOX`	The framework's use for internal control over financial reporting, and COSO's later guidance	0
`P1`	Principle 1: Demonstrates commitment to integrity and ethical values	0
`P10`	Principle 10: Selects and develops control activities	1
`P11`	Principle 11: Selects and develops general controls over technology	1
`P12`	Principle 12: Deploys through policies and procedures	1
`P13`	Principle 13: Uses relevant information	0
`P14`	Principle 14: Communicates internally	1
`P15`	Principle 15: Communicates externally	1
`P16`	Principle 16: Conducts ongoing and/or separate evaluations	1
`P17`	Principle 17: Evaluates and communicates deficiencies	1
`P2`	Principle 2: Exercises oversight responsibility	1
`P3`	Principle 3: Establishes structure, authority and responsibility	1
`P4`	Principle 4: Demonstrates commitment to competence	1
`P5`	Principle 5: Enforces accountability	1
`P6`	Principle 6: Specifies suitable objectives	1
`P7`	Principle 7: Identifies and analyzes risk	1
`P8`	Principle 8: Assesses fraud risk	0
`P9`	Principle 9: Identifies and analyzes significant change	0

Tell me when COSO Internal Control files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Penetration test report with retest evidence
Threat intelligence feed subscriptions and triage workflow
Risk acceptance memos signed by accountable executives
Vulnerability scan reports for internal, external, and authenticated scopes
Risk register with likelihood, impact, and treatment owners
Control implementation statement for RA-7 citing the system mission and inheritance from common controls
Risk assessment methodology approved by leadership

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

High severity vulnerabilities exceed remediation SLA without risk acceptance named by 3 frameworks
Scan coverage gaps for containerised and ephemeral workloads named by 3 frameworks
Threat intelligence consumed but not operationalised into detections named by 3 frameworks
Penetration tests scope narrow and exclude key applications named by 3 frameworks

What this page is

A control-level reference for COSO Internal Control, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition