In COSO, a company's overall control culture is called its ________.

• A. Control culture
• B. Tone at the top
• C. Control environment
• D. Security culture

Answer: (C)

In COSO, the overall control culture of an organization is described by the control environment. This sets the foundation for all other internal-control activities and shapes how people behave, make decisions, and carry out controls across the company.

The control environment includes factors like integrity and ethical values, management’s philosophy and operating style, the way authority and responsibility are assigned, the organizational structure, and human resource policies. Together, these elements establish the tone for how controls are perceived and followed, influencing reliability of reporting, compliance with laws and effectiveness of operations.

Note that tone at the top is a key aspect of the control environment—it's the leadership’s influence on the organizational culture—so it’s part of the broader environment rather than the term for the entire culture itself. Other terms like security culture refer to different domains and aren’t the formal COSO label for the overall control culture.