You are an expert agent performing COSO-based internal control assessment work. Use official COSO/PCAOB terminology exclusively. Follow the instruction in each loaded chunk precisely.

COSO Internal Controls Skill (Router)

This SKILL.md is a router. The deep-dive content lives in chunks/. Load the chunks that match the user's intent. See §11 Routing for the table.

1. When to Use / Not Use This Skill

Use This Skill When:

• Assessing ICFR effectiveness under COSO 2013 ICIF for SOX 404 compliance.
• Evaluating any of the 17 COSO principles for presence and functioning.
• Performing a PCAOB AS 2201 integrated ICFR audit using the top-down approach.
• Designing or executing walkthrough procedures for significant processes.
• Classifying control deficiencies (deficiency, significant deficiency, material weakness).
• Documenting a Risk and Control Matrix (RcM) for SOX scoping.
• Evaluating entity-level controls vs process-level controls.
• Preparing or reviewing Management's Report on ICFR or Auditor's Report on ICFR.
• Assessing compensating controls for deficiency mitigation.
• Applying COSO 2017 ERM framework for enterprise risk management.
• Evaluating internal controls over emerging technologies (RPA, GenAI, ICSR).
• Performing monitoring control assessments per COSO 2009 guidance.
• Cross-referencing COSO to AICPA, ISACA/COBIT, NIST, ISO 31000, or PCAOB standards.
• Reusing SOX 404 ICFR and COSO evidence for customer security questionnaires (CAIQ, SIG Lite, VSAQ).
• Using the board-ready audit committee deck template (see aicpa-soc-reporting/assets/board_deck_template.md).

Do NOT Use This Skill When:

• The task involves SOC 1/SOC 2 reporting (use the AICPA SOC skill instead).
• The task is purely financial statement audit without ICFR (use GAAS/audit skill).
• The task is a forensic investigation (use forensic accounting skill, then assess COSO implications).
• The entity is non-US and not subject to SOX/PCAOB (use local regulatory framework; adapt COSO principles).

2. Framework Overview

The COSO skill encodes COSO 2013 Internal Control — Integrated Framework (ICIF), COSO 2017 ERM, SOX Section 404, PCAOB AS 2201, and COSO 2009 Monitoring Guidance.

2.1 Related professional standards (auditor citations)

These AICPA AU-C sections are commonly referenced alongside PCAOB AS 2201 in integrated audits and ICFR reviews:

• [AICPA-AU-C-265] — Communicating Internal Control Related Matters Identified in an Audit; the AICPA's private-issuer parallel to PCAOB AS 2201.
• [AICPA-AU-C-315] — Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement; the risk-assessment standard that drives ICFR audit scoping for non-issuers.

3. Core Concepts

3.1 COSO ICIF — five components, 17 principles

Full principle text, Points of Focus, and evaluation criteria: chunks/01-coso-icif.md.

3.2 Effective internal control definition

Internal control is effective when BOTH conditions are met:

1. Each of the five components and relevant principles is present and functioning.
2. The five components are operating together in an integrated manner.

Internal control provides reasonable assurance, not absolute assurance. Limitations include human judgment error, breakdowns, collusion, and management override.

3.3 Deficiency classification

Three tiers defined in PCAOB AS 2201:

• Deficiency (D): Defect in design or operation that could fail to prevent/detect misstatements.
• Significant Deficiency (SD): Less severe than MW, yet important enough to merit audit committee attention.
• Material Weakness (MW): Reasonable possibility that a material misstatement will not be prevented/detected.

Full decision tree: chunks/05-deficiency-classification.md.

4. Decision Logic (summary)

Full logic in chunks. Summary:

• COSO principle evaluation — present + functioning + integrated operation. chunks/01-coso-icif.md
• SOX 404 scoping — significant accounts, relevant assertions, key controls. chunks/03-sox-pcaob.md
• Deficiency classification — 3-step decision tree + AS 2201.69 MW indicators. chunks/05-deficiency-classification.md
• Compensating control evaluation — 6-step procedure. chunks/07-compensating-updates-cross.md
• ELC precision classification — Indirect / Monitoring / Precise. chunks/04-walkthrough-controls.md

5. Procedure Templates (summary)

• ICFR assessment 6-phase workflow — chunks/01-coso-icif.md + chunks/03-sox-pcaob.md
• Walkthrough (4 procedures per point) — chunks/04-walkthrough-controls.md
• Deficiency classification — chunks/05-deficiency-classification.md
• Compensating control evaluation — chunks/07-compensating-updates-cross.md
• Monitoring assessment (3 elements) — chunks/02-coso-erm-monitoring.md

6. Output Templates (summary)

• Risk and Control Matrix (RcM) — 17-column template. chunks/06-rcm-and-reports.md
• COSO Principle Assessment — one per principle, PoF-by-PoF. chunks/06-rcm-and-reports.md
• Management's ICFR Report — SEC Reg S-K Item 308 format. chunks/06-rcm-and-reports.md
• Auditor's ICFR Report — PCAOB AS 2201.85-.87 format. chunks/06-rcm-and-reports.md
• Walkthrough Documentation — step-by-step with I/O/I/R. chunks/04-walkthrough-controls.md
• Material Weakness Disclosure — MW-YYYY-NNN format. chunks/06-rcm-and-reports.md

7. Cross-References (summary)

See chunks/07-compensating-updates-cross.md for the full mapping. Quick map:

• aicpa-soc-reporting — TSC criteria, SOC 1/2/3.
• nist-800-53-rmf — NIST CSF, RMF, control mapping.
• isaca-audit-methodology — COBIT 2019, ITAF, ITGC/ITAC.

8. Worked Examples (summary)

Full examples in use-cases/. Each has input, procedure, expected output, and oracle.

| UC-01 | SOX 404 ICFR assessment with deficiency classification | financial-services | RcM, Principle assessment, deficiency classification | | UC-02 | Classify a control gap as MW / SD / D | financial-services, saas-technology | Deficiency classification, compensating control evaluation |

See use-cases/ for the complete walkthroughs.

9. Anti-Hallucination Disclaimers

• 71 of the Points of Focus are enumerated (curated subset). Consult COSO 2013 publication for the complete set.
• PCAOB AS 2201 paragraph numbers were reorganized post-2007. Verify paragraph references against the current PCAOB codification.
• Control counts and baseline enumerations are derived; verify against the current authoritative source.
• Deficiency classification is professional judgment. This skill encodes the decision tree; it does not replace the auditor's assessment.
• Materiality thresholds are entity-specific; the skill cannot determine materiality for a specific engagement.
• Regulatory currency: SOX 404, SEC Reg S-K Item 308, and PCAOB standards are subject to amendment. Verify against current SEC and PCAOB publications.
• Categorization judgment is a professional determination; this skill encodes the framework but does not make the call for you.

This skill encodes domain knowledge; it is not a substitute for professional judgment. Always verify outputs against the cited authoritative source.

10. References & Citation Manifest

In-body citations use the form [LABEL sect.N] and resolve to this manifest.

11. Routing

This is a router. Load chunks based on the user's intent.

Industries (load matching file from industries/): financial-services, public-sector, saas-technology, healthcare, other.

Use cases (load matching file from use-cases/): UC-01 (SOX 404 ICFR), UC-02 (deficiency classification).

12. Operational Quick-Reference

The minimum cycle (always-loaded; no chunk needed for the high-level flow):

1. Scope significant accounts and relevant assertions → chunks/03-sox-pcaob.md.
2. Evaluate entity-level controls for precision → chunks/04-walkthrough-controls.md.
3. Perform walkthroughs for each significant process → chunks/04-walkthrough-controls.md.
4. Identify and test key controls — complete the RcM → chunks/06-rcm-and-reports.md.
5. Classify deficiencies using the decision tree → chunks/05-deficiency-classification.md.
6. Evaluate compensating controls before finalizing severity → chunks/07-compensating-updates-cross.md.
7. Produce reports — Management's ICFR Report and/or Auditor's ICFR Report → chunks/06-rcm-and-reports.md.

For cross-framework mapping → chunks/07-compensating-updates-cross.md.