COSO and Data Security Internal Controls

Use the framework for the correct purpose

COSO's internal control framework supports designing and assessing internal control. It brings together the control environment, risk assessment, control activities, information and communication, and monitoring. It is a framework rather than a data-protection statute or a fixed technical detection catalogue.

Sources: [1] [2]

Write a specific data-handling objective

Choose an outcome such as limiting unauthorised release of a confidential reporting package. Identify the process owner, authorised recipients and the consequences of failure. Distinguish the objective from a product feature: enabling a rule does not establish that the business outcome has been achieved.

Describe preventive and detective activities separately. A sharing restriction, an exception approval and a periodic review may each contribute different evidence.

Make the control operable by named people

Document who reviews a finding, what information they need and when an exception must be escalated. Test a legitimate business transfer and a prohibited scenario. A control that relies on an unassigned mailbox or unavailable reviewer may appear configured while failing in operation.

Use monitoring to change the process

Review a sample of events and exceptions with the process owner. Decide whether the policy, workflow or training needs adjustment, then retest the change. Keep the decision and action owner with the evidence. The practical mapping in this guide is editorial guidance, not an official COSO endorsement of a technology.

Applying this with TRIAS

Use TRIAS policy tests and event samples as evidence for a defined data-handling control. Map them to the organisation's control narrative and confirm reviewer responsibilities. Product logs alone do not demonstrate the effectiveness of the entire internal control system.

• Financial reporting controls →
• Central policy management →