What is the COSO model and what can you do with it?

The COSO model is a framework used to assess and improve internal control within an organisation. It provides insight into achieving organisational objectives in areas such as:

• The effectiveness and efficiency of business processes;
• Compliance with laws, regulations, policies and procedures;
• Risk management.

The COSO framework provides a kind of mapping tool for identifying and implementing processes and helping to improve them. COSO stands for Committee of Sponsoring Organisations of the Treadway Commission and was developed by a group of sponsoring organisations to help organisations manage risk and improve internal control. Since 2004, the COSO model has also been called COSO II or COSO ERM (Enterprise Risk Management). What exactly can you do with the COSO model and why should you implement it in your organisation?

COSO and integrated risk management: the perfect match

The COSO model is the ideal match for integrated risk management. You naturally want to identify, analyse, manage and monitor risks as best as possible. This process is also known as integral risk management (IRM). Do you have your IRM in place? Then you will build a relationship of trust with internal and external stakeholders. The COSO model helps you set up integral risk management properly. In this article, we tell you how to go about it.

What is de COSO-cube?

Let’s start at the beginning. What exactly does the COSO cube entail? The COSO framework is designed in a cube. The four organisational objectives (strategic, operational, from information provision and from laws and regulations) intertwined with the eight components, and the four organisational levels one has to deal with.

This visually designed cube is a tool to assess an organisation’s internal risk management. The model consists of eight cubes that together form a whole. Each of the cubes is associated with one specific aspect of internal control. Consider the management of risks, being in control of activities and reporting information and data.

The cubes are connected to each other by lines, indicating coherence between different aspects of internal control. In this way, this visual tool helps you understand and assess your organisation’s internal control.

The 4 organisational objectives

It all starts at the top of the cube. Here are the four organisational objectives:

1. Strategic- These are the objectives through which you realise your organisation’s vision and mission. Think, for example, of shorter production times or a more sustainable production process.
2. Operational – These are the activities carried out to achieve the goals, looking at effectiveness and efficiency.
3. Rapports – Provide clear information on activities and results. For example, communicate how you ensure a more sustainable production process.
4. Compliance – This layer describes how you comply with applicable laws and regulations.

The 8 control components

Now that the organisational goals are known, it is time to look at what is needed to achieve them. According to the COSO cube, there are eight components for this. From top to bottom, the components are as follows:

1. Internal environment

This includes topics such as culture, style of leadership, integrity, how ethics are handled, how duties and powers are distributed and the extent of risk-taking.

2. Setting objectives

What do we actually want to achieve?

3. Identification of events

What opportunities or risks do we see that could have a positive or negative impact on achieving the objectives?

4. The risk assessment

How likely is a risk to occur and what consequences does it entail?

5. The risk response

What responses are needed to mitigate, accept, transfer or prevent risks?

6. Management measures

What procedures and guidelines do we put in place to ensure that risk responses are successful?

7. Informatie en communicatie

The new procedures and guidelines will be communicated in a clear and accessible way, so that all stakeholders know what actions to take.

8. Monitoring

The effectiveness of the management and control system is regularly monitored and any improvements are implemented.

The 4 levels of organisation

Where are risk management weaknesses in your organisation? In which areas or departments is more control needed? To find the answer to those questions, the cube presents a third side: the organisation levels. You will find the following levels in the COSO cube:

1. The whole of the organisation;
2. Department;
3. Business units;
4. Subsidiaries.

Why choose to deploy the COSO framework?

So what exactly does implementing the COSO framework add value to your organisation? As you read earlier, the COSO model identifies the relationships between enterprise risks and the internal control system. This allows your organisation to:

The COSO model ensures not only that you identify risks, but also that you control risks on an ongoing basis. This way, you focus on integral risk management and increase risk maturity throughout the organisation. This way, you can continue to be successful in the future.

Applying the COSO model within your organisation? Use Zenya

By using quality and risk management software, such as Zenya, you can use the COSO model in a more efficient and effective way in your organisation. Zenya RISK can help you with this.

In addition, our software also helps in implementing improvements in internal control, through, for example, automating certain processes with Zenya FLOW and monitoring compliance with internal control guidelines with Zenya CHECK. This can lead to a more efficient and effective implementation of the COSO model and to improvements in the organisation’s internal controls. Find out for yourself how our software can help implement COSO by contacting us.