Governance, Risk, and Compliance Handbook: Technology, Finance, Environmental, and International Guidance and Best Practices

CHAPTER 3

COSO—IS IT FIT FOR PURPOSE?

Tim Leech

3.1 THE ROOTS OF COSO

(a) The Definition

3.2 COSO THE COMMITTEE AND COSO THE 1992 INTEGRATED CONTROL FRAMEWORK: HAVE THEY STOOD THE TEST OF TIME?

3.3 ACTUAL MARKET ACCEPTANCE OF THE COSO 1992 FRAMEWORK PRIOR TO SOX

3.4 EXPECTATIONS OF COSO ESCALATE OVERNIGHT

3.5 IS COSO 1992 FREE FROM BIAS?

3.6 DOES COSO 1992 PERMIT CONSISTENT QUANTITATIVE/QUALITATIVE MEASUREMENT?

3.7 IS COSO 1992 SUFFICIENTLY COMPLETE SO THAT RELEVANT FACTORS ARE NOT OMITTED?

3.8 IS COSO 1992 RELEVANT TO AN ANALYSIS OF CONTROLS OVER FINANCIAL REPORTING?

3.9 COSO: LOOKING FORWARD

NOTES

The title of this chapter begs a question: What is "it"? Many think the term COSO refers to a now fairly dated four-volume control framework originally issued in 1992, titled Internal Control—Integrated Framework. Others know that COSO is the commonly used name for an unincorporated, loosely constituted private sector committee formed in the United States in 1985 in response to the savings and loan crisis. This chapter explores two important questions:

1. Is COSO, the committee originally formed over 20 years ago to sponsor a research study, commonly known as the Treadway Commission after its chairman, James C. Treadway, as currently constituted still fit for purpose?
2. More important, is the 1992 Internal Control—Integrated Framework, a COSO Committee work product now approaching its 15th birthday, up to the task of meeting new, complex, onerous, and hugely important expectations imposed ...