The COSO Internal Control Programme

COSO is widely referenced and thinly implemented. Organisations document their controls, then discover at audit that the documentation describes a process rather than a control, that nobody can evidence the control operated, and that the control environment and monitoring components were never addressed because they are harder to put in a matrix. This week covers the five components with the emphasis on design and evidence: what makes a control a control, how to document one so somebody else can test it, and how to assess a deficiency honestly.

It runs 7 times over the published calendar, in 6 cities and live online. Every date is the same programme with the same content and the same certificate.

• Tell a control from a process step, and document it so it can be tested.
• Address the control environment and monitoring, not only control activities.
• Map controls to the risks and assertions they exist to address.
• Design a control that leaves evidence it operated.
• Assess a deficiency and decide whether it is significant.

Internal control and compliance staff, financial controllers responsible for the framework, internal auditors who test it, and process owners accountable for controls.

Short input, then work. Across 5 days of roughly 6 teaching hours each, the balance sits deliberately with the second: a programme where the trainer talks for six hours produces notes rather than capability.

• Your own material

  Exercises run on situations delegates bring, not on a case study written for a different organisation in a different decade.

• A capped cohort

  Small enough that everybody is asked something. Executive programmes are capped tighter still.

• Practice under scrutiny

  The difficult conversation, the challenged assumption, the decision defended out loud. Judgement is not built by watching.

• Something to take back

  Each day ends with a thing you can use on Monday rather than a slide deck you will not reopen.

• A control matrix for one process, mapped to risks and assertions.
• A redesign of two controls so that operation is evidenced.
• A deficiency assessment with the aggregation logic written down.

A GATI certificate recording what you attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended.

Every certificate carries a code that anybody can check against GATI's own record, which is what makes it worth holding. It records participation. This site will not imply one it does not have.