In response to another wave of
reporting incidents, the U.S.
Congress and U.S. Securities
and Exchange Commission
(SEC) enacted the Sarbanes-
Oxley Act of 2002 (SOX) and
formed the Public Company
Accounting Oversight Board
(PCAOB). SOX required an
evaluation of internal control
over Nnancial reporting by using
a “suitable framework,” which
the 1992 COSO framework
qualiNed. Management
certiNcation of that evaluation,
and for large companies,
external auditor assurance
of internal control over Nnancial
reporting (ICFR), is also
required.
The revised 2013 Internal
Control — Integrated Framework
(ICIF-2013) is the most
prevalent framework meeting
the SOX 404 requirement, and is
also used widely in jurisdictions
around the world with similar
internal control mandates.2
COSO also developed the
original COSO Enterprise Risk
Management — Integrated
Framework, issued in 2004, and
updated in 2017. In addition to
their internal control and
enterprise risk management
integrated frameworks, speciNc
guidance has been provided on
a range of related risk and
internal control topics, including
board oversight and
governance, cloud,
cybersecurity, blockchain, and
previous papers on
sustainability.
Published in March 2023,
Achieving Effective Internal
Control Over Sustainability
Reporting (ICSR): Building Trust
and Con4dence Through the
COSO Internal Control —
Integrated Framework provides
supplementary for organizations
using 2013 Internal Control —
Integrated Framework
(ICIF-2013).3