Committee of Sponsoring Organizations of the Treadway Commission
A U.S. private-sector organization that develops widely used frameworks for internal control, enterprise risk management, governance, and fraud deterrence.
Last updated August 24, 2026
AI crawler reads
No AI crawler has read this profile since Oct 28, 2026.
Overview
The Committee of Sponsoring Organizations of the Treadway Commission, commonly known as COSO, is a private-sector organization focused on improving the quality of corporate reporting, internal control, risk management, and fraud prevention. It was established in 1985 as an initiative responding to concerns about fraudulent financial reporting and a series of accounting and corporate-governance failures in the United States. The initiative was associated with the National Commission on Fraudulent Financial Reporting, whose first president was James C. Treadway Jr., a former commissioner of the U.S. Securities and Exchange Commission. The commission therefore became widely known as the Treadway Commission, while COSO became the continuing organization sponsored by five major professional associations. COSO's sponsoring organizations are the American Institute of Certified Public Accountants, Financial Executives International, the American Accounting Association, the Institute of Internal Auditors, and the Institute of Management Accountants. Rather than operating as a conventional commercial brand, COSO functions as a standards, guidance, and thought-leadership institution. Its publications are used by boards, executives, finance departments, internal auditors, external auditors, regulators, and risk professionals to design and assess control systems. COSO's best-known work is Internal Control—Integrated Framework, first issued in 1992 and substantially refreshed in 2013. The framework describes internal control as a process carried out by an entity's board, management, and other personnel to provide reasonable—not absolute—assurance regarding objectives in operations, reporting, and compliance. Its model is organized around five interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring. The 2013 version also expresses the model through seventeen principles, giving organizations a more explicit basis for evaluating whether controls are present, functioning, and operating together. The framework became especially influential after the Sarbanes-Oxley Act of 2002 increased expectations for public-company management to establish, assess, and report on internal control over financial reporting. Although the law does not require every organization to adopt COSO, the framework became a commonly used benchmark because it applies across industries and can be adapted to organizations of different sizes. COSO later broadened its work beyond financial-reporting controls. Enterprise Risk Management—Integrated Framework, published in 2004 after a project involving PricewaterhouseCoopers, expanded the control perspective into a broader risk-management model. It addressed strategic, operational, reporting, and compliance objectives and incorporated concepts such as risk appetite, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring. COSO also issued guidance for smaller public companies and guidance on monitoring internal control systems. COSO's influence comes from the practical portability of its frameworks. Organizations may use them to structure control assessments, support management certifications, improve audit planning, map risks to objectives, and communicate governance expectations. The frameworks do not eliminate uncertainty: COSO recognizes that human error, management override, collusion, and poor judgment can limit any control system. COSO remains an active reference point in accounting, auditing, compliance, governance, and enterprise risk management, but specific current leadership, location, and operating details are not established in the supplied sources.
History
COSO emerged from a U.S. private-sector effort to understand and reduce fraudulent financial reporting. In 1985, the sponsoring professional associations created an initiative known as the National Commission on Fraudulent Financial Reporting. The commission examined the causes of misleading or fraudulent financial statements, the responsibilities of independent public accountants, and measures that companies could take to prevent or detect improper reporting. James C. Treadway Jr., a former U.S. Securities and Exchange Commission commissioner, served as its first president, giving rise to the widely used name Treadway Commission. The commission conducted its initial examination from October 1985 through September 1987. Its report discussed the scale and causes of fraudulent financial reporting and recommended improvements involving corporate governance, management responsibility, audit functions, and organizational controls. COSO continued the broader mission after the commission's initial work, concentrating on practical frameworks that organizations could use to evaluate the effectiveness of their internal-control systems. In 1992, COSO published Internal Control—Integrated Framework. The framework became a major reference for internal control over operations, financial reporting, and legal and regulatory compliance. It defined internal control as a process involving the board, management, and other personnel and organized the process into five connected components: the control environment, risk assessment, control activities, information and communication, and monitoring. The model emphasized that all components should be present, functioning, and integrated rather than treated as isolated audit exercises. The framework's importance increased following corporate failures and accounting scandals in the late 1990s and early 2000s. The Sarbanes-Oxley Act of 2002 required U.S. public companies to maintain internal controls over financial reporting and required management to report on their effectiveness. COSO's framework was not the only possible control model, but it became commonly used because it was broad, principles-based, and adaptable across sectors and organization sizes. COSO expanded into enterprise risk management in 2001 by beginning a project with PricewaterhouseCoopers. The resulting Enterprise Risk Management—Integrated Framework was published in 2004. It broadened the earlier control model by addressing strategic, operational, reporting, and compliance objectives and by adding concepts such as risk appetite, event identification, risk response, and objective setting. The framework retained the importance of control activities, information and communication, and monitoring. COSO also produced guidance aimed at smaller public companies and organizations seeking more effective monitoring. Its 2006 guidance for small public companies explained how the core control concepts could be applied proportionately, while the 2009 monitoring guidance focused on continuous and separate evaluations and the timely escalation of control deficiencies. In 2013, COSO released an updated Internal Control—Integrated Framework, citing technological and global-business changes and providing a more explicit principles-based structure. COSO's frameworks are influential but do not promise certainty. The organization recognizes that controls depend on human judgment and can be weakened by error, collusion, coercion, or management override. Its work is therefore best understood as a structured basis for reasonable assurance, governance discussion, risk assessment, audit coordination, and continuous improvement rather than as a guarantee against fraud or business failure.
- 2013
Internal control framework is updated
[1]The revised framework incorporates changing technology and global business conditions and sets out seventeen principles.
- 2009
Monitoring guidance is published
[1]COSO provides additional guidance on evaluating controls over time and communicating deficiencies.
- 2004
Enterprise Risk Management—Integrated Framework is published
[1]COSO extends its work from internal control to enterprise-wide risk management.
- 2002
Sarbanes-Oxley increases the framework's practical importance
[1]New U.S. public-company control-reporting requirements make COSO a widely used reference for internal control over financial reporting.
- 1992
Internal Control—Integrated Framework is published
[1]COSO introduces its five-component model for evaluating internal control.
- 1987
Initial commission report is issued
[1]The commission publishes findings on fraudulent financial reporting, the role of auditors, and measures for preventing financial-reporting misconduct.
- 1985
National Commission on Fraudulent Financial Reporting is established
[1]Five U.S. professional associations launch a private-sector initiative to investigate fraudulent financial reporting and its causes.
Products and positioning
A nonprofit-oriented professional and standards body whose frameworks serve as practical reference models for corporate governance, internal control, financial reporting, auditing, fraud deterrence, and enterprise risk management.
Internal control framework · 1992
Internal Control—Integrated Framework
COSO's principal framework for designing, implementing, conducting, and assessing internal control. It addresses three broad objective categories—operations, reporting, and compliance—and organizes internal control into the control environment, risk assessment, control activities, information and communication, and monitoring. The 2013 version expresses the model through seventeen principles and is widely used in financial-reporting control programs.
Enterprise risk management framework · 2004
Enterprise Risk Management—Integrated Framework
A framework that expands internal-control thinking to enterprise risk management. It covers strategic, operational, reporting, and compliance objectives and addresses the internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring.
Control monitoring guidance · 2009
Guidance on Monitoring Internal Control Systems
Guidance explaining how organizations can determine whether control components continue to function through ongoing monitoring, separate evaluations, or both. It stresses timely identification and communication of deficiencies so that management and boards can take corrective action.
Internal control implementation guidance · 2006
Internal Control over Financial Reporting—Guidance for Smaller Public Companies
Practical guidance applying COSO's internal-control concepts to smaller public companies and emphasizing a principles-based approach to designing and implementing controls supporting reliable financial reporting.
Brand decisions
2013
Refresh the Internal Control—Integrated FrameworkGeneration changeBackground
COSO identified technological change, globalization, and evolving business practices as reasons to update its 1992 framework.
Action taken
It reissued the framework with an explicit set of seventeen principles supporting the five-component structure.
Aftermath
The refreshed version provided organizations with a more detailed basis for assessing whether controls were present, functioning, and integrated.
2004
Expand from internal control into enterprise risk managementStrategyBackground
Corporate failures and governance reforms increased demand for a framework addressing risks beyond financial-reporting controls.
Action taken
Following a project initiated in 2001 with PricewaterhouseCoopers, COSO issued Enterprise Risk Management—Integrated Framework.
Aftermath
COSO's scope broadened to include strategic, operational, reporting, and compliance risks.
1992
Adopt an integrated internal-control modelProduct launchBackground
COSO sought to provide organizations with a common method for evaluating controls after concerns about fraudulent financial reporting and inconsistent control practices.
Action taken
It published Internal Control—Integrated Framework, centered on five connected components and a reasonable-assurance objective.
Aftermath
The framework became a widely used reference for corporate control design, audit work, and financial-reporting assessments.
Recent events
- 2013
COSO refreshes its Internal Control—Integrated Framework[1]
Product generation · Product launch
COSO reissued its core internal-control framework to address changes in technology, globalization, and business practices, while articulating seventeen principles associated with the five components.
- 2009
COSO releases guidance for monitoring internal control systems[1]
Product launch
The organization issued monitoring guidance emphasizing continuous or separate evaluations and timely communication of control deficiencies for corrective action.
- 2004
COSO develops an enterprise risk management framework[1]
Product launch
COSO published Enterprise Risk Management—Integrated Framework, extending its internal-control model to broader strategic, operational, reporting, and compliance risks.
- 1992
COSO publishes Internal Control—Integrated Framework[1]
Product launch
COSO issued its foundational internal-control framework, defining a model based on five interrelated components and providing organizations with a structured way to design and evaluate controls.
Sources1 sources
Cite this profile: Cite the canonical profile. /brand-wiki/committee-of-sponsoring-organizations-of-the-treadway-commission · Editorial policy · How profiles are compiled