Small Business Shared Interest Group

@Larry White 

Feedback on the COSO IC and ERM Frameworks: During my time at Deloitte, I worked on several audit and assurance projects that involved regulatory inquiries and financial reporting, the COSO frameworks played important roles in maintaining compliance and managing risk - pivotal compliance aspects. While tailored for larger public companies, I believe that smaller businesses could benefit from more streamlined, resource-efficient guidance and built in concepts.

A) The underlying concepts of risk management, internal control, and governance are AWESOME, though the application and complexity of can be overwhelming for smaller entities (requiring all sorts of 3rd party services). Its a problem: For many small businesses, the focus is often on day-to-day operations, and there can be a disconnect between the high-level guidance and the practical steps needed to implement it effectively.

B) I believe that more streamlined, simplified guidance with practical examples specifically tailored to smaller businesses would be highly beneficial. (Resources: more real-world case studies for diff industries, templates, and trimmed-down versions of the frameworks that are more straightforward to apply, manage, audit, and comply.

C) Different guidance, tailored more to small businesses. How do you start COSO application, what is most important, where do you begin, foundation, walls, roof, or landscaping??? (jk - like building a house)

How would the COSO frameworks interact w other regulatory frameworks, how can efficiency be gained? Are there overlapping aspects of applicable frameworks to your business?

D) Corporate Governance Framework (CGF): The approach for smaller businesses needs to be practical and flexible. A COSO Governance Framework could indeed be useful if it is designed with scalability in mind. Customization: Offering tools to customize governance structures based on the business's growth stage, industry, and resources could help smaller companies adopt effective governance practices without unnecessary overhead. Education: Providing more educational resources aimed at smaller business owners and managers to understand the value of governance and how it can be implemented incrementally as the business grows.

Thank you, Illya and Amanda, for the very thoughtful responses.  I'm collecting these responses in a document that I will share with the Chair and Board members of COSO.    The Corporate Governance Framework is just commencing work, there will be a public exposure period in the Summer of 2025 (current plan).  I encourage you to look for this and make comments on this new COSO Framework.

I want to encourage other members of the Small Business SIG to also provide comments.

@Larry White 

Feedback on the COSO IC and ERM Frameworks: During my time at Deloitte, I worked on several audit and assurance projects that involved regulatory inquiries and financial reporting, the COSO frameworks played important roles in maintaining compliance and managing risk - pivotal compliance aspects. While tailored for larger public companies, I believe that smaller businesses could benefit from more streamlined, resource-efficient guidance and built in concepts.

A) The underlying concepts of risk management, internal control, and governance are AWESOME, though the application and complexity of can be overwhelming for smaller entities (requiring all sorts of 3rd party services). Its a problem: For many small businesses, the focus is often on day-to-day operations, and there can be a disconnect between the high-level guidance and the practical steps needed to implement it effectively.

B) I believe that more streamlined, simplified guidance with practical examples specifically tailored to smaller businesses would be highly beneficial. (Resources: more real-world case studies for diff industries, templates, and trimmed-down versions of the frameworks that are more straightforward to apply, manage, audit, and comply.

C) Different guidance, tailored more to small businesses. How do you start COSO application, what is most important, where do you begin, foundation, walls, roof, or landscaping??? (jk - like building a house)

How would the COSO frameworks interact w other regulatory frameworks, how can efficiency be gained? Are there overlapping aspects of applicable frameworks to your business?

D) Corporate Governance Framework (CGF): The approach for smaller businesses needs to be practical and flexible. A COSO Governance Framework could indeed be useful if it is designed with scalability in mind. Customization: Offering tools to customize governance structures based on the business's growth stage, industry, and resources could help smaller companies adopt effective governance practices without unnecessary overhead. Education: Providing more educational resources aimed at smaller business owners and managers to understand the value of governance and how it can be implemented incrementally as the business grows.

How can we keep track and observe the evolution of this project?  What is the purpose of the project? Is IMA taking part in revamping or contributing to changing the direction of COSO altogether? Where can I learn more about the scope and nature of this work?

(I get super curios easily)

Tnx @Larry White

Thank you, Illya and Amanda, for the very thoughtful responses.  I'm collecting these responses in a document that I will share with the Chair and Board members of COSO.    The Corporate Governance Framework is just commencing work, there will be a public exposure period in the Summer of 2025 (current plan).  I encourage you to look for this and make comments on this new COSO Framework.

I want to encourage other members of the Small Business SIG to also provide comments.

@Larry White 

Feedback on the COSO IC and ERM Frameworks: During my time at Deloitte, I worked on several audit and assurance projects that involved regulatory inquiries and financial reporting, the COSO frameworks played important roles in maintaining compliance and managing risk - pivotal compliance aspects. While tailored for larger public companies, I believe that smaller businesses could benefit from more streamlined, resource-efficient guidance and built in concepts.

A) The underlying concepts of risk management, internal control, and governance are AWESOME, though the application and complexity of can be overwhelming for smaller entities (requiring all sorts of 3rd party services). Its a problem: For many small businesses, the focus is often on day-to-day operations, and there can be a disconnect between the high-level guidance and the practical steps needed to implement it effectively.

B) I believe that more streamlined, simplified guidance with practical examples specifically tailored to smaller businesses would be highly beneficial. (Resources: more real-world case studies for diff industries, templates, and trimmed-down versions of the frameworks that are more straightforward to apply, manage, audit, and comply.

C) Different guidance, tailored more to small businesses. How do you start COSO application, what is most important, where do you begin, foundation, walls, roof, or landscaping??? (jk - like building a house)

How would the COSO frameworks interact w other regulatory frameworks, how can efficiency be gained? Are there overlapping aspects of applicable frameworks to your business?

D) Corporate Governance Framework (CGF): The approach for smaller businesses needs to be practical and flexible. A COSO Governance Framework could indeed be useful if it is designed with scalability in mind. Customization: Offering tools to customize governance structures based on the business's growth stage, industry, and resources could help smaller companies adopt effective governance practices without unnecessary overhead. Education: Providing more educational resources aimed at smaller business owners and managers to understand the value of governance and how it can be implemented incrementally as the business grows.

COSO has formed an Advisory Council to guide PWC who is the lead contractor.   IMA has appointed Mike Phillips as its Advisory Council member; he will lead IMA input into the new Corporate Governance Framework.  I'm the COSO Board member for IMA and will also be engaged in the project to a less direct extent.   The first real exposure of the CGF will be when it is put out for public exposure next summer.  That is the critical review period for those not "in" the development process.   I don't anticipate much being released outside the working groups during the development process.

How can we keep track and observe the evolution of this project?  What is the purpose of the project? Is IMA taking part in revamping or contributing to changing the direction of COSO altogether? Where can I learn more about the scope and nature of this work?

(I get super curios easily)

Tnx @Larry White

Thank you, Illya and Amanda, for the very thoughtful responses.  I'm collecting these responses in a document that I will share with the Chair and Board members of COSO.    The Corporate Governance Framework is just commencing work, there will be a public exposure period in the Summer of 2025 (current plan).  I encourage you to look for this and make comments on this new COSO Framework.

I want to encourage other members of the Small Business SIG to also provide comments.

@Larry White 

Feedback on the COSO IC and ERM Frameworks: During my time at Deloitte, I worked on several audit and assurance projects that involved regulatory inquiries and financial reporting, the COSO frameworks played important roles in maintaining compliance and managing risk - pivotal compliance aspects. While tailored for larger public companies, I believe that smaller businesses could benefit from more streamlined, resource-efficient guidance and built in concepts.

A) The underlying concepts of risk management, internal control, and governance are AWESOME, though the application and complexity of can be overwhelming for smaller entities (requiring all sorts of 3rd party services). Its a problem: For many small businesses, the focus is often on day-to-day operations, and there can be a disconnect between the high-level guidance and the practical steps needed to implement it effectively.

B) I believe that more streamlined, simplified guidance with practical examples specifically tailored to smaller businesses would be highly beneficial. (Resources: more real-world case studies for diff industries, templates, and trimmed-down versions of the frameworks that are more straightforward to apply, manage, audit, and comply.

C) Different guidance, tailored more to small businesses. How do you start COSO application, what is most important, where do you begin, foundation, walls, roof, or landscaping??? (jk - like building a house)

How would the COSO frameworks interact w other regulatory frameworks, how can efficiency be gained? Are there overlapping aspects of applicable frameworks to your business?

D) Corporate Governance Framework (CGF): The approach for smaller businesses needs to be practical and flexible. A COSO Governance Framework could indeed be useful if it is designed with scalability in mind. Customization: Offering tools to customize governance structures based on the business's growth stage, industry, and resources could help smaller companies adopt effective governance practices without unnecessary overhead. Education: Providing more educational resources aimed at smaller business owners and managers to understand the value of governance and how it can be implemented incrementally as the business grows.

Hi Larry, I appreciate you asking for feedback from the small business community for your work related to the COSO framework through IMA!   

In my opinion, it varies widely with the size of the small business.  The COSO internal control framework is very scalable to mid-size businesses.  There are a lot of privately held companies that are organized and operate similar to public entities.  Very small businesses, on the other hand, struggle to implement in the most basic control activities let alone adopt the entire internal control framework.  Some of the framework components like risk assessment and monitoring are not on their radar at all.  Unfortunately this sometimes carries over as the small business grows, so even some of the larger small to mid-size businesses still fail to fully implement the framework unless they've brought an experienced accountant on board who can help them through this process.  When I ask board members or small business owners about their risk assessment process, the most common answer they give is that they review the monthly financial statements - clearly not an actual risk assessment.  The second most common answer from board members is that their controller or CFO does the risk assessment, and they'd let them know if there were any issues - there is no formal process.  I believe one of the keys to adoption of the COSO framework at the small business level is education.

Same goes for implementing a framework related to corporate governance.  Mid-size entities would find this valuable, but most small family-owned businesses may not even have a board of directors.  "Board meetings" are just conversations they have about the business while sitting down at the dinner table.  In these situations, a Corporate Governance Framework is not very relevant to them at all.