COSO focuses on ________.

• A. Corporate internal and financial controls
• B. IT governance
• C. IT security governance
• D. All of the above

Answer: (A)

COSO is a framework built to ensure reliable financial reporting through strong internal controls. It guides how an organization creates and monitors processes across the control environment, risk assessment, control activities, information and communication, and ongoing monitoring to achieve objectives in financial reporting, operations, and compliance. While the broader COSO Enterprise Risk Management view expands to risks across the organization, the emphasis remains on corporate internal controls and financial reporting rather than IT governance or IT security programs. IT governance and IT security governance are typically addressed by other frameworks such as COBIT or ISO/IEC 27001, not COSO. So the best fit is internal and financial controls.