This document provides an overview of updates to the COSO Internal Control-Integrated Framework made in 2013. The key changes include expanding the framework to apply to operations and compliance objectives in addition to financial reporting, reflecting changes in the business environment. It articulates principles for each of the five components of internal control (control environment, risk assessment, control activities, information and communication, and monitoring activities). The update also clarifies requirements for effective internal control, such as each component and principle needing to be present and functioning, and components operating together.

1. COMPANY CONFIDENTIAL
COSO 2013 Update
Internal Control–Integrated Framework
COSO Overview
Internal Control-Integrated Framework
Illustrative Documents
Illustrative Tools for Assessing Effectiveness of a System of Internal Control
Internal Control over External Financial Reporting: A Compendium of
Approaches and examples
Transition & Impact
Recommended Actions
Questions & Comments

2. Original
Framework
COSO’s Internal Control–Integrated Framework (1992 Edition)
Refresh
Objectives
Updated Framework COSO’s Internal Control–Integrated Framework (2013 Edition)
Broadens Application Clarifies Requirements
Articulate principles to
facilitate effective internal
control
COSO has become the most widely adopted control framework.
Updates
Context
Enhancements
Reflect changes in business
& operating environments
Expand operations and
reporting objectives
COSO 2013 Update

3. COMPANY CONFIDENTIAL
COSO 2013 Update
What is not changing... What is changing...
• Core definition of internal control
• Three categories of objectives and
five components of internal control
• Each of the five components of
internal control are required for
effective internal control
• Important role of judgment in
designing, implementing and
conducting internal control, and in
assessing its effectiveness
• Changes in business and operating
environments considered
• Operations and reporting objectives
expanded
• Fundamental concepts underlying
five components articulated as
principles
• Additional approaches and
examples relevant to operations,
compliance, and non-financial
reporting objectives added
Update has increased use and broadened application

4. COMPANY CONFIDENTIAL
COSO 2013 Update
Update reflects changes in business and operating environments
Environments changes... …have driven Framework updates
Expectations for governance oversight
Globalization of markets and operations
Changes and greater complexity in business
Demands and complexities in laws, rules,
regulations, and standards
Expectations for competencies and
accountabilities
Use of, and reliance on, evolving technologies
Expectations relating to preventing and
detecting fraud
COSO Cube (2013 Edition)

5. Control Environment
Risk Assessment
Control Activities
Information &
Communication
Monitoring Activities
Update articulates principles of effective
internal control
1. Demonstrates commitment to integrity and ethical values
2. Exercises oversight responsibility
3. Establishes structure, authority and responsibility
4. Demonstrates commitment to competence
5. Enforces accountability
6. Specifies suitable objectives
7. Identifies and analyzes risk
8. Assesses fraud risk
9. Identifies and analyzes significant change
10. Selects and develops control activities
11. Selects and develops general controls over technology
12. Deploys through policies and procedures
13. Uses relevant information
14. Communicates internally
15. Communicates externally
16. Conducts ongoing and/or separate evaluations
17. Evaluates and communicates deficiencies
COSO 2013 Update
5COSO 2013 Update

6. Control Environment
Update articulates principles of effective
internal control (continued)
1. The organization demonstrates a commitment to
integrity and ethical values.
2. The board of directors demonstrates independence
from management and exercises oversight of the
development and performance of internal control.
3. Management establishes, with board oversight,
structures, reporting lines, and appropriate authorities
and responsibilities in the pursuit of objectives.
4. The organization demonstrates a commitment to
attract, develop, and retain competent individuals in
alignment with objectives.
5. The organization holds individuals accountable for their
internal control responsibilities in the pursuit of
objectives.
COSO 2013 Update
6COSO 2013 Update

7. 6. The organization specifies objectives with
sufficient clarity to enable the identification and
assessment of risks relating to objectives.
7. The organization identifies risks to the
achievement of its objectives across the entity
and analyzes risks as a basis for determining
how the risks should be managed.
8. The organization considers the potential for
fraud in assessing risks to the achievement of
objectives.
9. The organization identifies and assesses
changes that could significantly impact the
system of internal control.
Risk Assessment
Update articulates principles of effective
internal control (continued)
COSO 2013 Update
7COSO 2013 Update

8. 10. The organization selects and develops control
activities that contribute to the mitigation of risks
to the achievement of objectives to acceptable
levels.
11. The organization selects and develops general
control activities over technology to support the
achievement of objectives.
12. The organization deploys control activities
through policies that establish what is expected
and procedures that put policies into place.
Control Activities
Update articulates principles of effective
internal control (continued)
COSO 2013 Update
8COSO 2013 Update

9. 13. The organization obtains or generates and uses
relevant, quality information to support the
functioning of internal control.
14. The organization internally communicates
information, including objectives and
responsibilities for internal control, necessary to
support the functioning of internal control.
15. The organization communicates with external
parties regarding matters affecting the
functioning of internal control.
Information &
Communication
Update articulates principles of effective
internal control (continued)
COSO 2013 Update
9COSO 2013 Update

10. 16. The organization selects, develops, and
performs ongoing and/or separate evaluations
to ascertain whether the components of internal
control are present and functioning.
17. The organization evaluates and communicates
internal control deficiencies in a timely manner
to those parties responsible for taking corrective
action, including senior management and the
board of directors, as appropriate.
Monitoring Activities
Update articulates principles of effective
internal control (continued)
COSO 2013 Update
10COSO 2013 Update

11. Update clarifies requirements for effective internal control
• Effective internal control provides reasonable assurance regarding
the achievement of objectives and requires that:
– Each component and each relevant principle is present and functioning
– The five components are operating together in an integrated manner
• Each principle is suitable to all entities; all principles are presumed
relevant except in rare situations where management determines
that a principle is not relevant to a component (e.g., governance,
technology)
• Components operate together when all components are present
and functioning and internal control deficiencies aggregated across
components do not result in one or more major deficiencies
• A major deficiency represents an internal control deficiency or
combination thereof that severely reduces the likelihood that an
entity can achieve its objectives
COSO 2013 Update
11COSO 2013 Update

12. Update describes important characteristics of principles, e.g.,
• Points of focus may not be suitable or relevant, and others may be identified
• Points of focus may facilitate designing, implementing, and conducting internal control
• There is no requirement to separately assess whether points of focus are in place
Control Environment 1. The organization demonstrates a commitment to
integrity and ethical values.
Points of Focus:
• Sets the Tone at the Top
• Establishes Standards of Conduct
• Evaluates Adherence to Standards of Conduct
• Addresses Deviations in a Timely Manner
COSO 2013 Update
12COSO 2013 Update

13. Update describes the role of controls to effect principles
• The Framework does not prescribe controls to be selected,
developed, and deployed for effective internal control
• An organization’s selection of controls to effect relevant principles
and associated components is a function of management judgment
based on factors unique to the entity
• A major deficiency in a component or principle cannot be mitigated
to an acceptable level by the presence and functioning of other
components and principles
• However, understanding and considering how controls effect
multiple principles can provide persuasive evidence supporting
management’s assessment of whether components and relevant
principles are present and functioning
COSO 2013 Update
13COSO 2013 Update

14. Update describes how various controls effect principles, e.g.,
Control Environment
1. The organization demonstrates a commitment to integrity and
ethical values.
Component
Principle
Controls
embedded in
other
components
may effect this
principle
Human Resources
review employees’
confirmations to
assess whether
standards of conduct
are understood and
adhered to by staff
across the entity
Control Environment
Management obtains
and reviews data
and information
underlying potential
deviations captured
in whistleblower hot-
line to assess quality
of information
Information &
Communication
Internal Audit
separately evaluates
Control Environment,
considering
employee behaviors
and whistleblower
hotline results and
reports thereon
Monitoring Activities
COSO 2013 Update
14COSO 2013 Update

15. • Principles
– Provide clarity regarding the role of principles in designing, implementing, and
conducting internal control, and assessing its effectiveness
– Clarify descriptions of some principles, but no additional principles
• Effectiveness
– Recognize effective internal control can provide reasonable assurance of achieving
effective and efficient operations objectives (as noted before)
– Clarify requirement that each of the components and relevant principles must be
present and functioning and components must operating together
– Remove presumption that points of focus are present and functioning, and clarify
that no separate assessment of points of focus is required
– Standardize classification of internal control deficiencies, and clarify use of only
relevant criteria established in laws, rules, regulations and standards
COSO 2013 Update
15COSO 2013 Update