The Trouble with COSO

Critics say the Treadway Commission's controls framework is oudated, onerous, and overly complicated. But is there an alternative?

Mapping, Digging

In the meantime, the debate over COSO rages on. George Honig, audit manager and Sarbox-compliance head at Sears Holdings, believes there is a need for a management-centric framework, not just guidance for management. That sort of framework might develop organically over time. As companies go through the 404 drill several times, they will likely refine their approach to certifying controls. “Management-centric guidance is already coming about by virtue of what is happening in the marketplace,” notes Eric Hespenheide, managing partner of global internal-audit service at Deloitte & Touche LLP. Hespenheide also believes regulators such as the SEC and the PCAOB are clarifying what is expected of public issuers. “I think we will continue to see further speeches by SEC commissioners and [the release of] frequently asked questions,” he predicts. “And they will be data points for what is acceptable.”

For the moment, however, expect to see more mapping to COBIT and more digging through the details of AS2 — anything to help managers divine what their independent auditors will come looking for. Says Atkinson: “It’s a difficult way to go about building an internal-controls environment.”

Helen Shaw is a staff writer at

Standard Deviation
In a CFO magazine poll, respondents were asked to name the framework — or frameworks — they use for internal controls. Here’s what they said:
COSO (Committee of Sponsoring Organizations, Treadway Commission) 82%
AS2 (Auditing Standard No. 2, PCAOB) 28%
COBIT (Control Objectives for Information and Related Technology) 33%
SAS 55/78 (AICPA) 13%
Other 2%
Comply with Me
A breakdown of the rather lengthy COSO manual
Section Length
Executive Summary 7 pages
Reporting to External Parties 25 pages
Framework 118 pages
Evaluation Tools 203 pages
Total 353 pages


Your email address will not be published. Required fields are marked *