Adopting the 2013 COSO Framework: Fiscal 2017 Update

On May 14, 2013, COSO released an updated version of its Internal Control – Integrated Framework. The original version, which was released in 1992, was superseded by the 2013 version – effective for fiscal years ended after December 15, 2014.

As we approach the fourth anniversary of the implementation of the 2013 COSO Framework, adoption is nearly complete for companies with audited Internal Control over Financial Reporting (ICFR) opinions, though companies with management-only reports are still lagging.

In 2017, only two companies with audited ICFR opinions reported using the 1992 Framework (less than 1%), while an additional six did not identify the framework used.

Yet, only 70% of companies with management-only reports have adopted the 2013 Framework. Although there is improvement from last year (up from 63% in 2016), it is unclear why almost one-third of the companies are not using the new Framework.

As illustrated below, the rate of adoption has slowed. While the number of companies relying on the new Framework continues to climb, the increase from 2016 to 2017 was not as large as the increase from 2015 to 2016.

In last year’s analysis, we suggested that there is a strong correlation between 2013 COSO Framework adoption rate and ineffective internal controls, and that controls that are not effective under the 1992 Framework may be just as ineffective once the more rigorous 2013 Framework is used.

This year’s analysis supports that assertion. There were 250 companies that implemented the 2013 Framework between 2016 and 2017. Of these companies, 162 had ineffective controls in 2017 with 148 (91%) also reporting ineffective controls in 2016 under the previous framework.

One possible explanation is that companies with ineffective ICFR simply do not have the resources needed to either adopt the new framework or to remediate the ICFR weaknesses.

Whatever the reason, COSO has indicated that it no longer supports the original version of the Framework released in 1992 and considers it to be superseded by the 2013 version. While more than 99% of companies with audited ICFR opinions have completed the implementation, there is still a large amount of companies with management-only reports relying on the old Framework.

For more information on this analysis, please email us at or call (508) 476-7007.