Both the board and individual employees are accountable for internal controls, COSO maintains. The new framework states that “management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.” It further notes that “the organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.” 

“It also mentions the compensation committee, which wasn’t mentioned at all back in 1992,” adds Landsittel. Typically the board of directors appoints the compensation committee.

The changes are needed because “business models have become more complex since 1992,” he says. “The guidance is framed in a current context rather than a 1992 context,” meaning more practical applications to modern business operations are used. “There’s outsourcing, for example, which is much more common than it was then. The framework recognizes that.”

The old framework will continue to be available until December 15, 2014, says Landsittel. But COSO is encouraging a move to the new framework at a quicker pace. Both frameworks will be available initially, but those companies that apply the framework should explain which framework they are using in their financial statements, he notes. 

COSO launched the project to update the prior framework because that was what stakeholders said they wanted. “Do we need to start over with a clean piece of paper or do we need to just update it?” asked Landsittel, describing the process of how the framers determined what needed to be changed from the earlier framework. “Eighty percent of people said all you need to do is update it. The present existing framework was still relevant.”