Which is the correct list of COSO internal control components?

Which is the correct list of COSO internal control components?

• A. Control environment; Risk assessment; Control activities; Information and communication; Monitoring
• B. Control environment; Information and communication; Control activities; Monitoring; Risk assessment
• C. Information and communication; Monitoring; Control environment; Risk assessment; Control activities
• D. Monitoring; Control environment; Information and communication; Risk assessment; Control activities

Answer: (A)

In COSO, internal control is built from five components that work together to create effective governance and operations. The five are control environment, risk assessment, control activities, information and communication, and monitoring. The list you should recognize reflects these five elements in the standard order. The control environment sets the tone at the top—ethics, integrity, and oversight that influence how all other controls are designed and carried out. Risk assessment follows, focusing on identifying and evaluating the risks that could prevent objectives from being achieved. Control activities are the policies and procedures put in place to address those risks. Information and communication ensure relevant data is identified, captured, and shared in a timely way to support control activities and decision-making. Monitoring involves ongoing or separate evaluations to ensure controls continue to operate effectively and to identify deficiencies. That is why this sequence is correct: it captures the full set of components and the logical flow from setting the tone and identifying risks, to implementing controls, communicating information, and continuously assessing performance. Other options mix or omit components or place them in a different order, which does not align with the established framework.

In COSO, internal control is built from five components that work together to create effective governance and operations. The five are control environment, risk assessment, control activities, information and communication, and monitoring. The list you should recognize reflects these five elements in the standard order.

The control environment sets the tone at the top—ethics, integrity, and oversight that influence how all other controls are designed and carried out. Risk assessment follows, focusing on identifying and evaluating the risks that could prevent objectives from being achieved. Control activities are the policies and procedures put in place to address those risks. Information and communication ensure relevant data is identified, captured, and shared in a timely way to support control activities and decision-making. Monitoring involves ongoing or separate evaluations to ensure controls continue to operate effectively and to identify deficiencies.

That is why this sequence is correct: it captures the full set of components and the logical flow from setting the tone and identifying risks, to implementing controls, communicating information, and continuously assessing performance. Other options mix or omit components or place them in a different order, which does not align with the established framework.