What is Criteria of Control: CoCo

CoCo, sponsored by the Canadian Institute of Chartered Accountants, is intended to translate COSO into practical, implementable activities and defines three major control objectives:

1. Effectiveness and efficiency of operations
2. Reliability of internal and external reporting
3. Compliance with applicable laws and regulations and internal policies

Within the CoCo framework, control is defined as encompassing:
- Purpose, which defines criteria that promote an understanding of the organization direction. They use techniques such as vision and strategy; risks and opportunities, planning, policy development, and use of performance targets and indicators.

- Commitment, which defines criteria that promote a belief in the organization's identity and values. They impact ethical values, including integrity; human resource policies; responsibility and accountability, authority, and mutual trust.

- Capability, which defines criteria that address an organization's competence. They involve knowledge and competencies, skills and tools, information, use of appropriate communication processes, coordination, and control activities.

- Monitoring and Learning, which defines criteria that will facilitate the organization's evolution. They involve monitoring internal and external environments, monitoring performance, challenging assumptions, reassessing information needs and information systems, execution of follow-up procedures, and assessing the overall effectiveness of control.

CoCo promotes the treatment of risk through:
- Avoidance of risk
- Reducing the likelihood of risk occurring
- Reducing the impact should a risk occur
- Transferring the risk to a third party
- Accepting or retaining the risk

This is seen to be effected using controls of the five basic types, namely: Directive, Preventative, Detective, Corrective, and Recovery controls.

Source: Auditor’s guide to information systems auditing, Richard E. Cascarino 2007