What are the main components of an internal control framework?

• A. Risk assessment, control activities, information and communication, monitoring, and a framework like COSO.
• B. Strategic planning, budgeting, and forecasting.
• C. Hiring, training, and performance reviews.
• D. IT infrastructure upgrades and data backups.

Answer: (A)

Internal control frameworks are built from components that help you manage risk and achieve objectives. The essential parts are risk assessment, control activities, information and communication, and monitoring, all tied together by a recognized framework such as COSO. Risk assessment identifies what could go wrong and how significant those risks are. Control activities are the policies and procedures that prevent or detect errors or irregularities. Information and communication ensure the right information flows to the right people at the right time, and monitoring provides ongoing evaluation to spot deficiencies and trigger corrective action. The other options describe planning, HR processes, or IT operations rather than a complete framework for controls, so they don’t capture how internal controls are designed and assessed as a whole.