The University at Buffalo has adopted the internal control methodology defined by the Committee of Sponsoring Organizations (COSO). The COSO methodology or framework identifies five interrelated components of internal control:

Control Environment

The control environment is the attitude toward internal control set by those in authority – “the tone at the top”. The control environment is a product of management’s philosophy, style, and supportive attitude, as well as the competence, ethical values, integrity, and morale of the organization’s people. Assignment of authority, responsibility, and accountability are key factors. The control environment provides discipline and structure.

Risk Assessment

Risks are events that threaten the accomplishment of objectives and ultimately impact an organization’s ability to accomplish its mission. Risk assessment is the process of identifying, evaluating, and determining how to manage these events.

Control Activities

Control activities are the policies and procedures that help ensure compliance with management’s objectives and help prevent or reduce risks that can impede accomplishment of objectives.

Information and Communication

The transmittal of quality data, regardless of format to the right people at the appropriate time must take place to ensure that employees have adequate information to effectively carry out their responsibilities. Effective communication must also occur in a broader sense, flowing down, across, and up the organization.

Monitoring

Monitoring is the review of an organization’s internal control system to assess the quality of performance over time. Establishing an ethical environment and setting the tone at the top of the organization is the most important element of the accountability and control environment. Achieving institutional objectives is directly related to the strength of an organization’s internal controls. All of the components work together to create a comprehensive system capable of deterring fraud, as well as preventing, detecting, and correcting problems that could jeopardize the organization’s ability to achieve its mission and objectives.