Control Environment, Risk Assessment, Control Activities, Information and Communication and Monitoring are all components of:

Question

Options

• AState Insurance Statutes
• BCommittee of Sponsoring Organization
• CTrade Organizations/Associations
• DAccounting Firms and Business Partners

• A
  17% (5)
• B
  72% (21)
• C
  7% (2)
• D
  3% (1)

Explanation

B is correct because the five elements listed - Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring - are precisely the five components of the COSO Internal Control – Integrated Framework, published by the Committee of Sponsoring Organizations of the Treadway Commission. COSO is the widely adopted standard for designing and evaluating internal control systems.

Why the distractors are wrong:

• A (State Insurance Statutes) are laws governing insurance at the state level - they regulate industry conduct, not internal control frameworks.
• C (Trade Organizations/Associations) are membership bodies that advocate for industries; they don't define internal control components.
• D (Accounting Firms and Business Partners) are private entities that may apply internal control frameworks but did not author or define COSO's components.

Memory tip: Think of the acronym "CRAM-I" - Control environment, Risk assessment, Activities, Monitoring, Information & Communication - and pair it with COSO (sounds like "co-so," as in "co-sponsored organizations"). If a question lists all five components together, it's always pointing to COSO.

No community discussion yet for this question.