Which is NOT a component of the COSO Internal Control framework?

Which is NOT a component of the COSO Internal Control framework?

• A. Ethics program
• B. Control environment
• C. Risk assessment
• D. Information and communication

Answer: (A)

The framework is built around five components: control environment, risk assessment, control activities, information and communication, and monitoring. An ethics program fits into the control environment because it embodies the organization’s integrity and ethical values that set the tone at the top and guide behavior throughout the entity. Since ethics and values are considered part of the environment that supports all other controls, they’re not listed as a separate component. The other options are all actual components of the framework, but the ethics program is encompassed within the control environment.

The framework is built around five components: control environment, risk assessment, control activities, information and communication, and monitoring. An ethics program fits into the control environment because it embodies the organization’s integrity and ethical values that set the tone at the top and guide behavior throughout the entity. Since ethics and values are considered part of the environment that supports all other controls, they’re not listed as a separate component. The other options are all actual components of the framework, but the ethics program is encompassed within the control environment.