In this publication, we will be looking at the final two of the five COSO components and the related principles

Information and Communication:

Information is necessary for the entity to carry out internal control responsibilities to support the achievement of its objectives. Management obtains or generates and uses relevant and quality information from both internal and external sources to support the functioning of internal control. Communication is the continual, iterative process of providing, sharing, and obtaining necessary information. Internal communication is the means by which information is disseminated throughout the organization, flowing up, down, and across the entity. It enables personnel to receive a clear message from senior management that control responsibilities must be taken seriously. External communication is twofold: it enables inbound communication of relevant external information and provides information to external parties in response to requirements and expectations.

Monitoring Activities:

Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning. Ongoing evaluations, built into business processes at different levels of the entity, provide timely information. Separate evaluations, conducted periodically, will vary in scope and frequency depending on assessment of risks, effectiveness of ongoing evaluations, and other management considerations. Findings are evaluated against criteria established by regulators, standard-setting bodies, or management and the board of directors, and deficiencies are communicated to management and the board of directors as appropriate.

• The Information and Communication component and the Monitoring Activities component are the last two components of the Framework. The Information and Communication component has three (3) while the Monitoring Activities has two (2) principles.
• The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.
• The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
• The organization communicates with external parties regarding matters affecting the functioning of internal control.
• The organization selects, develops, and performs ongoing and or separate evaluations to ascertain whether the components of internal control are present and functioning.
• The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

The principles relating to Information and Communication include;

The principles relating to Monitoring Activities are;