Question

Two frameworks developed by Coso have been updated in recent years: COSO 2013 internal control framework and the COSO ERM 2017 framework. What are the differences between the two frameworks.

Answer 1

• One important distinction between COSO’s 2017 ERM framework and COSO’s 2013 internal control-integrated framework is that COSO 2013 is the de facto standard for regulatory reporting purposes to comply with Sarbanes-Oxley Section 404(a) and 404(b) reporting on internal control over financial reporting by management and auditors.
• De facto acceptance of COSO’s 2013 internal control framework traces to its widespread use in practice, as amplified in the explicit acknowledgement of the acceptability of COSO’s internal control framework in the SEC’s rule on management reporting on internal control. AICPA rules relating to internal control engagements for private companies similarly reference COSO.
• Internal control is a component of ERM, subsumed within the ERM framework. However, COSO’s internal control framework is not superseded by the COSO 2017 ERM framework.
• COSO says as much in the forward to its ERM framework: “The two publications are distinct and have different focuses; neither supersedes the other.” This point is detailed further in COSO’s FAQs, which note that internal control over financial reporting is a fundamental aspect of ERM, and that the two documents complement each other, but neither document supersedes the other.