COSO - which stands for the Committee of Sponsoring Organizations of the Treadway Commission - came up with what has been the gold standard of governance for FinTech firms. The COSO Framework helps companies evaluate and improve their internal controls, and, even more importantly, relate their internal controls to the strategy and business model.

The COSO definition of internal control is “a process effected by an entity’s board of directors, management and other personnel designed to provide reasonable assurance of the achievement of objectives” in the following categories:

• Operational Effectiveness and Efficiency

• Financial Reporting Reliability

• Applicable Laws and Regulations Compliance.

The COSO website makes numerous free resources available (we list them at the bottom of this article).

We will include only some of the key features of the five COSO framework components here:

Control Environment

• Make a commitment to competence.

• Use the board of directors and audit committee.

• Facilitate management’s philosophy and operating style.
  
  Risk Assessment

• Create companywide objectives.

• Define and Incorporate department-level and process-level objectives.

• Perform risk identification and analysis.

  Control Activities

• Follow policies and procedures.

• Improve cybersecurity, application security, data access security, etc.

• Plan business continuity, backups, disaster recovery.

• Identify areas for outsourcing and outsource to best-in-class vendors where needed.
  

  Information and Communication

• Measure quality of information.

• Measure effectiveness of communication.

  
  Monitoring

• Perform ongoing monitoring.

• Conduct independent evaluations.

• Report and fix deficiencies.

The COSO internal control framework makes it clear that business objectives, including risk tolerances, are a precondition for designing and evaluating the system of internal control.

The COSO framework helps the executive team pull together strategy and internal controls of risks (that are tactical) in a coherent and systematic way.