Which statement best describes COSO's focus?

• A. Corporate internal and financial controls
• B. IT governance
• C. IT security governance
• D. All of the above

Answer: (A)

COSO focuses on establishing and evaluating internal controls across the organization, with the primary aim of reliable financial reporting, compliance, and effective operations. The framework emphasizes components like control environment, risk assessment, control activities, information and communication, and monitoring to provide reasonable assurance that these objectives are met. IT controls can be part of internal controls, but COSO is not primarily about IT governance or IT security governance. Those areas are broader topics outside COSO’s main scope, even though IT considerations may support the overall internal control framework. That’s why describing COSO’s focus as corporate internal and financial controls best fits what the framework is intended to address.