This guidance, which serves as a supplement to COSO's "Internal Control - Integrated Framework," originally published in 1992, focuses on the unique needs of smaller public companies in regard to compliance with Sarbanes-Oxley section 404.

COSO's new guidance outlines 26 fundamental principles associated with the five key components of internal control: control environment, risk assessment, control activities, information and communication; and monitoring. The report defines each principle and describes its attributes, lists a variety of approaches smaller companies can use to incorporate the principles, and includes real-world examples of how smaller companies have effectively applied the principles.

A project task force, overseen by Task Force Chair Debbie Lambert, COSO Chairman Larry Rittenberg and led by PricewaterhouseCoopers partner Miles Everson, consisted of approximately twenty members with experience in small business. Because of similar initiatives at the SEC and PCAOB, those organizations each provided an observer to the project.

The task force focused on providing examples that demonstrate how the principle-based framework can be applied to small public businesses. The document is intended for use by board members, senior management, other personnel and external auditors. 

According to Everson, "The guidance does not change the requirements for effective internal control over financial reporting, but it does more clearly articulate how smaller businesses can achieve effective internal control in a more cost-efficient and practical manner."

"While the control principles addressed in the new document may be applicable to both large and small companies," said Rittenberg, "it was important for us to demonstrate how smaller public companies can implement effective internal control in a different manner than do their larger counterparts. For example, management's hands-on approach in smaller businesses may create opportunities for controls to be less formal without decreasing their quality. Further, the scale of those controls may differ and the opportunity to shift many of the controls from a fixed cost to a variable cost structure may be available to smaller companies."

The guidance asserts that internal control over financial reporting may be accomplished by choosing approaches to applying the COSO principles that best fit each company’s circumstances in the most effective and efficient manner. According to the guidance, smaller public companies may strengthen internal controls by broadening the pool of audit committee members, using controls built into accounting software, leveraging management monitoring, and outsourcing some activities. This new guidance provides a tool for management to use in determining the appropriate level of internal controls over financial reporting for smaller businesses.

The report can be accessed at www.coso.org. Comments may be submitted at www.ic.coso.org.  The comment period ends on December 31, 2005. Final guidance is expected in the first quarter of 2006.

Formed in 1985 to sponsor the National Commission on Fraudulent Financial Reporting, COSO is a voluntary private sector organization comprised of the Institute of Internal Auditors (IIA), the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), and the Institute of Management Accountants (IMA).