COSO’s new Framework is the result of a significant multiyear
project—including two rounds of public exposure—
to review, refresh, and modernize the original Framework,
ensuring it remains relevant. As we all know, the
world has undergone a seismic shift since 1992 that has
led to dramatic business and operating environment
changes. Markets continue to globalize. Business models
have changed significantly, including greater use of
shared services and outsourced service providers. The
complexity and pace of change in rules, regulations, and
standards have intensified demands on companies.
Reliance on evolving technology—increasingly important
in improving business performance, business processes,
and decision making—continues to grow. Finally, regulators
and other stakeholders have higher expectations
regarding governance oversight, risk management, and
the detection and prevention of fraud. While advances
have been made in better connecting risk management
and internal control practices in pursuit of organizational
strategic goals, the many changes since 1992 have significantly
increased business risk, resulting in a much greater
need for competence and accountability than ever before.
In addition, collectively we have learned lessons in
applying the 1992 Framework. First, the original Framework
included lengthy discussions of internal control
concepts that are now institutional knowledge. Second,