The Real Coso, and Nothing but the Real Coso

Abstract

Within the international corporate governance debate, one recommendation which appears to be gaining ground internationally is that management should report, publicly or otherwise, on the effectiveness of management control systems or aspects of it. With respect to evaluation and standards for effectiveness, all reports in the field of corporate governance make reference to the conceptual framework included in the final report of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control – Integrated Framework [1992]. In our opinion, the international reference to the current COSO report is therefore unjustified: the COSO framework does not include the assumed and widely acclaimed unequivocal standards.

This paper is divided into two sections. In the first section we will analyse the current COSO framework in more depth and argue for what reasons the COSO framework does not comprise the internationally widely acclaimed standard. First, we discuss the backgrounds leading to, and the methodology applied by the Committee of Sponsoring Organisations of the Treadway Commission (COSO). Secondly, we evaluate the definition and accompanying content of the COSO framework. Thirdly, we argue why – in our opinion – the COSO framework does not comprise the widely acclaimed standards. Fourthly, we evaluate the guidance for evaluation of the effectiveness of management control systems and the general applicability of this guidance.

In section two we present a new management control framework to overcome the deficiencies of the current COSO framework, in order to fulfil the international widespread corporate governance recommendations for organisations to report on the effectiveness of their management control system. The revised management control evaluation framework comprises four perspectives on control, which are derived from the main existing paradigms in organisation theory, which represent the general developments of organisation theory. First, we position the COSO framework between business practice and the different levels of analysis applied science (management control theory), basic science (organisation theory) and relevant paradigms. Secondly, we discuss the origin of the four control perspectives. Thirdly, we will evaluate the arguments mentioned in the COSO framework to include management control features, using our control evaluation framework, to analyse whether the partial and restricted view on control of COSO (see section one) is confirmed.

Keywords: COSO, internal control, internal control assessment, corporate governance

JEL Classification: K22, K42, M14, M41