COSO 2013 framework: a practical guide to COSO internal control testing

The COSO 2013 framework is the current version of the COSO internal control framework: five components and 17 principles for judging whether internal control works. In control testing, you use it to tie each control to the risk it addresses, decide what evidence proves it ran, and see what else it depends on. It does not tell you how many samples to pull or what passes. Your methodology and your auditor do that.

This guide explains the COSO framework in testing terms, including the COSO cube, then walks a seven-step way to apply it to a real control, with a payment approval running through the steps and a monthly bank reconciliation as the worked example.

What is the COSO framework? The 2013 version explained

The COSO framework is the Committee of Sponsoring Organizations' model for internal control. Its current version, the COSO 2013 framework, is formally the COSO Internal Control - Integrated Framework. It is a guide to designing and evaluating internal control. COSO published the update in May 2013. The original 1992 version was treated as superseded after December 15, 2014.

It covers three kinds of objectives: operations, reporting and compliance. SOX programs use the reporting side, specifically internal control over financial reporting (ICFR).

The structure is five components, each backed by principles, 17 in total. COSO's test for an effective system is that every component and relevant principle is present and functioning, and that the five operate together. That last part is the one teams skip. A strong approval control does not rescue a reviewer working from an incomplete report.

The 2013 update also added points of focus under each principle. They describe what a principle usually looks like in practice. They are not a checklist you must evidence one by one.

Why the COSO internal control framework matters for SOX

This is where SOX and COSO meet. Section 404 of the Sarbanes-Oxley Act requires management to assess ICFR every year, and SEC rules require that assessment to use a suitable, recognized control framework. The COSO framework of internal control is the one most US public companies name in their report. Your external auditor then evaluates ICFR against the same framework under PCAOB AS 2201.

So COSO is the yardstick for the overall conclusion. Control testing is how you gather the evidence to use it. For a journal entry approval control, COSO helps you name the risk (unauthorized entries), shape the control (approval before posting) and decide what proves it ran (an approval record with a name, a role and a date).

If testing itself is new to your team, SOX testing 101 covers the RCM-to-sign-off basics this post builds on.

The 5 COSO components and the COSO cube

The five components of COSO are usually drawn as the COSO cube: objectives across the top, components down the front, and the parts of the organization along the side.

In testing terms, each component answers a different question about a control. Pick one below to see its principles, what a tester checks and the evidence to ask for.

The 17 principles of the COSO Internal Control - Integrated Framework

The 17 COSO principles turn each component into something you can evaluate. Here is where they sit and what a tester considers for each group.

The principles frame the assessment. They do not replace understanding the specific control, its risk and the evidence it needs. A useful program connects each relevant principle to a real process and a real control, not to a slide.

COSO internal control in practice: 7 steps to test a control

Here is how to apply the COSO framework to a single control, which is where COSO control testing actually happens. The running example is a payment approval control: an authorized manager approves each payment before it is released. Each step shows the COSO component it leans on most.

1. 01
   Risk assessment

   Understand the control objective

   Start with what the control is supposed to achieve. Four questions get you there:

   Ask first4

   • What risk does it address?
   • What could go wrong?
   • Does it prevent or detect?
   • Who performs it?

   For the payment approval, the risk is an unauthorized payment, and the control is meant to prevent it. Read the approval rules before you open a single payment record.

2. 02
   All five

   Map it to the relevant components and principles

   The payment approval sits in control activities (principle 10). It also depends on the control environment for approval authority, on information for an accurate payment run, and on monitoring for what happens when an approval is missed.

   Do not force each control into one box. COSO has 17 principles, and no single control needs to be filed under all of them. Most lean on two or three.

3. 03
   Control activities

   Assess design effectiveness

   Design asks whether the control, done as described, could stop or catch the risk.

   Design check5

   • A clear purpose
   • A named performer
   • Happens at the right time
   • Precise enough for the risk
   • Leaves evidence behind

   Timing is where this example breaks. If the manager approves after the payment is released, the control cannot prevent an unauthorized payment, however neat the approvals look.

4. 04
   Control activities

   Test operating effectiveness

   Operation asks whether the control actually ran, as designed, across the period. Select instances using your methodology (the sample size guide has illustrative ranges by frequency) and inspect each one.

   Evidence per sampled payment5

   • The payment record
   • The approval workflow entry
   • The approver's identity and role
   • The approval date
   • Any exception or follow-up

   Compare each item to the control's requirements. A policy alone does not prove the control operated.

5. 05
   Information and communication

   Evaluate the evidence

   Control testing is only as good as the evidence behind it. Run each item through four questions:

   Is the evidence

   • RelevantTied to this control and this period
   • CompleteNothing important missing
   • ReliableFrom a source you can trust
   • ClearAnother reviewer can see what it shows

   If the answer to any of them is no, ask for clarification or more support before you conclude. Evidence that arrives as a screenshot of a screenshot usually needs a second request.

6. 06
   Monitoring activities

   Record exceptions and assess their impact

   When a control did not operate as required, write down what happened, which requirement was missed, the evidence that shows it and whether it could affect financial reporting.

   Potential first, confirmed second

   A late approval might be a timing exception, a second approval record you have not seen yet, or a misread date. Investigate before you call it a deficiency. Confirmed ones then need a severity call, which the deficiency classification guide walks through.

7. 07
   Monitoring activities

   Document the conclusion

   The workpaper should let another qualified reviewer follow the work without redoing it.

   The workpaper states6

   • The control and the risk
   • Period and population or sample
   • Procedures performed
   • Evidence reviewed
   • Exceptions found
   • The conclusion and why

Worked example: a COSO audit test of a monthly bank reconciliation

This is the kind of test internal audit or your external auditor runs when they audit COSO-based controls. The control: a finance manager reviews and approves each month's bank reconciliation. Its objective is to find and resolve differences between the bank statement and the general ledger.

It sits mainly in control activities. It also depends on reliable information (the statement and the ledger report) and on monitoring (what happens when a review is missed). Applied step by step:

1. Understand the risk. Unreconciled or wrong cash balances could misstate the financial statements.
2. Review the design. Confirm the reconciliation is prepared, reviewed and approved by the required people, before the close deadline.
3. Select the months. Pick instances from the period under review using your methodology. For a monthly control that is often 2 to 5 (illustrative; your auditor's minimums win).
4. Inspect the evidence. The reconciliation, its support, the approval and the explanations for reconciling items.
5. Check performance. Confirm the review and approval happened as required, by the right person, on time.
6. Investigate exceptions. Follow up any missing approval or any material difference nobody explained.
7. Document the result. Record the evidence and say whether the control operated as intended, and why.

The useful tag is the middle one. Information and communication reminds you to test the ledger report the reviewer relied on, not only the reviewer's signature.

COSO in accounting: how the framework relates to SOX testing

People search "COSO vs SOX", but they are not rivals. They are related, not the same. COSO is the framework for evaluating internal control. SOX control testing is the set of procedures that shows whether specific controls are designed and operating effectively.

In accounting and financial reporting, the COSO framework and SOX work as a pair: SOX sets the obligation, COSO sets the yardstick. A company can use COSO to organize its whole assessment. It still has to decide which controls are relevant, how to test them and what evidence supports each conclusion. Timing matters too: interim and roll-forward testing covers how to spread that work across the year.

Common mistakes when applying the COSO framework

• Treating COSO as a checklist. Ticking 17 principles proves nothing about whether controls work. Real processes and real evidence do.
• Testing the policy instead of the control. A policy is a very confident document. It says what should happen, not what did.
• Losing the risk behind the control. A signature exists, but was the approval timely, and by someone authorized? Test the purpose, not the ink.
• Accepting weak evidence. If it does not support the specific testing criteria, ask for more before you conclude.
• Dropping exceptions. A missed step noted and forgotten is a monitoring failure of its own. Assess it, size it and decide the response.

Rule of thumb: start from the risk, not from principle 1

Working through the framework from the top produces mapping exercises. Working back from a risk produces tests. Pick the risk, find the control that addresses it, then ask COSO what that control depends on: authority, information, monitoring. Those dependencies are where the surprising exceptions live.

And keep the mapping light. If mapping a control to principles took longer than testing it, the mapping has stopped helping.

Where SOXLayer fits with the COSO framework

SOXLayer is SOX compliance software for planning, performing, reviewing and evidencing control tests. For COSO work specifically:

• COSO 2013 coverage (beta). Each entity is scored against the 17 principles as Covered, Partial or Gap. Some principles are evidenced by the workflow itself, such as owners, scoping, fraud risk and classified deficiencies. Others need an approved control mapped, with mappings suggested from the control's wording. Every gap becomes an owned, dated action.
• Risks mapped to controls in a versioned RCM, so each test starts from its risk.
• Tests in fixed steps: population, sampling, evidence, test attributes, conclusion, review and approval.
• An AI first pass with citations. For each sample, the AI proposes Pass, Fail, Insufficient or N/A with the exact quote and page it relied on. AI never submits, reviews or approves a test. See how AI testing works.
• Deficiencies raised from exceptions and classified, with remediation tracked to close.
• A hash-chained audit trail of who did what, when and why.

What it will not do: judge whether your board's oversight is effective or whether the tone at the top is real. Those principles need people, and evidence that mostly lives outside any testing tool.

Whatever you evaluate, ask the same questions of it: can you see each control's objective, tie evidence to the control and period, record procedures and exceptions, and let a reviewer follow the conclusion? Check those on your own controls, not in a demo. The free trial is $0 for 14 days with no card, and the pricing page lists the rest.

COSO framework FAQ

What is the COSO 2013 framework?

It is COSO's Internal Control - Integrated Framework, updated in 2013, for designing and evaluating internal control. It has five components and 17 principles, and SOX programs use it to assess internal control over financial reporting.

How is COSO used in SOX control testing?

Teams use it to tie each control to its risk, assess its design and organize the evaluation of whether it operated. The testing itself still needs suitable procedures, samples and evidence.

What are the five COSO components?

Control environment, risk assessment, control activities, information and communication, and monitoring activities.

How many principles are in COSO 2013?

Seventeen. Control environment has principles 1 to 5, risk assessment 6 to 9, control activities 10 to 12, information and communication 13 to 15, and monitoring activities 16 and 17.

Does COSO require every control to be tested?

No. COSO is a framework for evaluating internal control. Your risk assessment, compliance obligations and testing methodology decide which controls are tested and how.

What is the difference between design and operating effectiveness?

Design effectiveness asks whether a control, done as described, could address its risk. Operating effectiveness asks whether it was actually performed as intended during the period tested.

Can COSO help identify control deficiencies?

Yes. Applying it can surface weaknesses in a control's design, its performance, the information it relies on or how it is monitored. The company then has to evaluate and fix what it finds.

What is the COSO cube?

It is the diagram COSO uses for the framework. The top shows the three objectives (operations, reporting, compliance), the front shows the five components, and the side shows entity levels from the whole entity down to a single function.

Is the COSO ERM framework the same as the COSO internal control framework?

No. COSO's Enterprise Risk Management framework, last updated in 2017, covers how an organization manages risk alongside strategy and performance. SOX programs assess ICFR against the 2013 internal control framework, which is the one this guide covers.

Is the 1992 COSO framework still used?

COSO treated the 1992 framework as superseded after December 15, 2014. SOX programs that name COSO now use the 2013 version.

Sources and further reading

The documents behind this article. Your external auditor's methodology and your own policies still set the requirements for your program.

• COSO, Internal Control - Integrated Framework: the framework itself and COSO's supporting guidance
• SEC Release 33-8810: interpretive guidance for management's evaluation of ICFR
• PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting: the auditor's standard, which uses the same framework as management

Five components, 17 principles, and still one control at a time.

Furqan Abaid

Furqan Abaid builds SOXLayer, AI-assisted SOX control testing software, and writes about how SOX programs scope, test, review and document their controls.

Read these next

SOX basics

SOX testing 101: how to test SOX controls, from RCM to sign-off

Seven steps from RCM row to signed-off test, with a worked bank reconciliation control description and a checklist for a test file that stands on its own.

Furqan Abaid·July 14, 2026·9 min read

AI in audit

AI for SOX control testing: how it actually works

Eight steps from control criteria to signed-off workpaper, what AI takes off a tester's plate, when it isn't worth it, and what it costs.

Furqan Abaid·October 19, 2026·8 min read

AI in audit

AI in auditing: what it should and should not do in control testing

Why every AI verdict in SOX testing needs a quoted line and page, and why AI should never sign off a test, even when it is sure.

Furqan Abaid·September 15, 2026·8 min read