Originally issued in 1992, the Framework helps organisations design, implement, and evaluate the effectiveness of internal controls. The updates to the Framework are intended to clarify internal control concepts and simplify their use and application.

One of the most significant changes COSO made in the 2013 Framework was to codify into principles the internal control concepts introduced in the original Framework.

The Framework defines Internal control as follows:

Internal control is a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.

Consistent with the above definition, the Framework outlines three categories of objectives to allow a focus on differing aspects of internal control: operations objectives, reporting objectives and compliance objectives. The reporting objectives "pertain to internal and external financial and non-financial reporting and may encompass reliability, timeliness, transparency, or other terms as set forth by regulators, recognized standard setters, or the entity’s policies".  The reference to "internal and external financial and non-financial reporting" is broader than the previous framework which focused on published financial statements.

The 1992 Framework will remain available during the transition period, which ends December 15, 2014, after which time COSO will consider it superseded.

Along with the 2013 Framework, COSO also issued today Illustrative Tools for Assessing Effectiveness of a System of Internal Control and Internal Control Over External Financial Reporting (ICEFR): A Compendium of Approaches and Examples.

Additional information and resources, including an executive summary of the 2013 Framework, an FAQ document, and slides, are available on COSO’s website.