1. The COSO Integrated Framework
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides the gold-standard internal control framework used globally to fulfill SOX compliance. It divides internal control systems into five vital structural components:
┌───────────────────────────────────────────────────────────────────────────┐
│                          COSO FRAMEWORK PYRAMID                           │
├───────────────────────────────────┬───────────────────────────────────────┤
│             COMPONENT             │         OPERATIONAL MECHANICS         │
├───────────────────────────────────┼───────────────────────────────────────┤
│ 1. Control Environment            │ Foundations: Ethics, tone-at-the-top, │
│                                   │ and structural accountability         │
├───────────────────────────────────┼───────────────────────────────────────┤
│ 2. Risk Assessment                │ Dynamic identification and analysis   │
│                                   │ of internal/external financial risks  │
├───────────────────────────────────┼───────────────────────────────────────┤
│ 3. Control Activities             │ Preventive & detective policies:      │
│                                   │ Approvals, reconciliations, approvals │
├───────────────────────────────────┼───────────────────────────────────────┤
│ 4. Information & Communication    │ Systems tracking and reporting clear, │
│                                   │ clean audit trails                    │
├───────────────────────────────────┼───────────────────────────────────────┤
│ 5. Monitoring Activities          │ Ongoing independent reviews to ensure │
│                                   │ controls do not degrade over time     │
└───────────────────────────────────┴───────────────────────────────────────┘

2. The Fraud Triangle Model
To prevent corporate fraud, finance professionals must understand the three behavioral conditions required for asset misappropriation or fraudulent financial reporting to occur:
  • Pressure / Incentive: The motivation behind the crime (e.g., personal debt, unrealistic corporate profit targets tied to executive bonuses).
  • Opportunity: A weakness in the internal control architecture that allows the fraud to be executed and concealed with a low perceived risk of detection (e.g., lack of segregation of duties, poor physical asset tracking).
  • Rationalization: The cognitive justification the fraudster constructs to align the crime with their personal ethics (e.g., “I am just borrowing the money,” or “Management treats me unfairly”).

3. Segregation of Duties (SoD) Internal Control Core Concept
To eliminate the Opportunity leg of the fraud triangle, organizations must ensure that no single employee has unchecked control over a financial transaction lifecycle. SoD requires that four distinct functions be split among separate personnel:

Authorization ≠ Recording ≠ Custody of the Asset ≠ Reconciliation
Example: The person who authorizes a vendor payment invoice must not be the person who writes the check, logs the entry in the ledger, or reconciles the bank statements.
PreviousNext