CoCo Internal Control Framework: Definition & Key Concepts

An error occurred trying to load this video.

Try refreshing the page, or contact customer support.

Coming up next: Managing the Audit Function in Government: Policies, Planning & Procedures

You're on a roll. Keep up the good work!

Take Quiz Watch Next Lesson
Your next lesson will play in 10 seconds
  • 0:03 What Is CoCo?
  • 2:13 Purpose
  • 3:09 Commitment
  • 3:59 Capability
  • 4:42 Monitoring and Learning
  • 5:48 Lesson Summary
Save Save Save

Want to watch this again later?

Log in or sign up to add this lesson to a Custom Course.

Log in or Sign up

Speed Speed Audio mode

Recommended Lessons and Courses for You

Lesson Transcript
Instructor: Deborah Schell

Deborah teaches college Accounting and has a master's degree in Educational Technology and is holds certifications as a CIA, CISA, CFSA, and CPA, CA.

Management must ensure controls are in place to minimize risk and ensure financial reporting is reliable. Let's examine a control framework, CoCo, which can help with identifying controls.

What Is CoCo?

All companies have to have controls to minimize risk and make sure financial reporting is reliable. Controls represent procedures, processes, and methods implemented by management to ensure the company's efficiency and effectiveness, their reliability of internal and external financial reporting, and adherence to rules and laws.

But what controls to use? The criteria of control (CoCo) framework was developed by the Canadian Institute of Chartered Accountants (now CPA Canada) and outlines 20 control criteria that management can use to manage company performance and improve its decision-making. External financial reporting is prepared for individuals and organizations outside of the company, such as shareholders and tax authorities.

The framework emphasizes that control involves the entire organization but begins on an individual level, with the employee. The CoCo framework outlines criteria for effective control in the following four areas:

  • Purpose
  • Commitment
  • Capability
  • Monitoring and learning

In order to assess whether controls exist and are operating effectively, each criterion would be examined to identify the controls that are in place to address them. Let's apply this framework in an example.

Brendan performs a task that he completes based on an understanding of why it is being performed (its purpose). He is supported by required resources including access to information, skills, and supplies (capability). In order to complete the task well, Brendan will have to show commitment, or dedication, to the task. Finally, he should look at his performance and identify changes he could make to do better next time (monitoring and learning).

Now, let's meet Mr. I.N. Control, the owner of a company that has experienced tremendous growth in the past few years. He has heard about the benefits of CoCo and is wondering if the control framework can be used in his organization. Let's review the criteria in the framework to help Mr. I.N. Control decide if it can be useful for his company.


The criteria for purpose address the direction of the company:

  • First, company objectives need to be established and communicated to all concerned parties.

  • Then, an assessment of the internal and external risks that might stand in the way of the company achieving the objective needs to be completed.

  • Next, policies can be developed to ensure the company successfully manages the identified risks. These policies should also be communicated so employees are aware of the expectations.

  • Then, concrete plans are developed and communicated. Objectives and plans developed in this phase should include targets that can be measured as a way to monitor performance.

Mr. I.N. Control can use the criteria in the purpose section to determine if the current mission and company objectives are still appropriate given the recent growth of his company. Do his existing performance targets include all the measures and departments they should?


The criteria in the commitment section address the company's identity and values:

  • Specifically, the company's ethical values should be created and documented, practiced and communicated to all employees.

  • Management should ensure that human resource policies are updated to reflect the company's ethical values.

  • Additionally, accountability and responsibility should be clearly established and consistent with the company's objectives.

  • Finally, there should be an environment of trust to ensure that information is available to all employees who need it to achieve the company's objectives.

Do Mr. I.N. Control's employees and managers understand the tasks for which they are accountable? By asking questions, he could identify situations where department's ethical values are not in alignment with the company's values.


The criteria in the capability section address competence:

To unlock this lesson you must be a Member.
Create your account

Register to view this lesson

Are you a student or a teacher?

Unlock Your Education

See for yourself why 30 million people use

Become a member and start learning now.
Become a Member  Back
What teachers are saying about
Try it risk-free for 30 days

Earning College Credit

Did you know… We have over 200 college courses that prepare you to earn credit by exam that is accepted by over 1,500 colleges and universities. You can test out of the first two years of college and save thousands off your degree. Anyone can earn credit-by-exam regardless of age or education level.

To learn more, visit our Earning Credit Page

Transferring credit to the school of your choice

Not sure what college you want to attend yet? has thousands of articles about every imaginable degree, area of study and career path that can help you find the school that's right for you.

Create an account to start this course today
Try it risk-free for 30 days!
Create an account