While it’s not mandatory to adopt the COSO framework, the U.S. Securities and Exchange Commission (SEC) requires a “suitable framework” for public companies to comply with internal control of financial reporting. … The COSO framework has been used by virtually every public company to achieve compliance.

Is COSO required by SOX?

Even though the COSO framework wasn’t specifically created for the Sarbanes-Oxley Act, the guidelines of the COSO framework satisfy SOX requirements. Consequently, many auditors use COSO to audit for SOX compliance.

Does COSO apply to private companies?

Although private companies are not required to adopt and follow COSO guidelines, any company can benefit by putting them into practice. After all, sound internal controls are the best defense against employee theft, fraud and embezzlement, no matter the size of your company.