COSO Control Activities: Policies and Procedures Implementation

I remember sitting in a conference room in 2017 with a CFO who was visibly frustrated. "We have 247 policies," he said, sliding a thick binder across the table. "And I'd bet my next bonus that nobody actually follows half of them."

He was right. When we interviewed his staff, we discovered that most employees couldn't even locate the policies, let alone implement them. The company had spent years creating documents that gathered dust while controls failed and risks materialized.

That's when I learned a critical truth: policies without implementation are just expensive fiction.

After fifteen years of implementing COSO frameworks across industries, I've seen the same pattern repeat: organizations focus obsessively on writing perfect policies while completely neglecting the procedures and control activities that make those policies work in the real world.

Today, I'm going to share everything I've learned about implementing COSO control activities—not the theoretical textbook version, but the battle-tested approach that actually works.

Understanding Control Activities: Beyond the Textbook Definition

Let me start with what COSO actually says. The Committee of Sponsoring Organizations defines control activities as:

"The actions established through policies and procedures that help ensure that management's directives to mitigate risks to the achievement of objectives are carried out."

Now let me translate that into English: Control activities are the stuff people actually do to prevent bad things from happening and make good things happen consistently.

Think of it this way. If your objective is "don't lose customer data," then:

• Policy says: "We protect customer data through access controls and encryption"

• Control Activity says: "Every quarter, IT reviews user access lists and removes terminated employees within 24 hours of notification"

• Procedure says: "Here's the step-by-step process for how IT conducts that review"

The policy is your intention. The control activity is your action. The procedure is your instruction manual.

The Three-Layer Reality I've Observed

In my experience, successful control implementation follows a three-layer model:

I worked with a manufacturing company in 2019 that had beautiful policies but chaotic execution. Their purchase order policy stated "appropriate segregation of duties," but nobody had defined what "appropriate" meant. Different departments interpreted it differently. Some required three approvals for a $500 purchase. Others had single-person authority up to $100,000.

When we implemented actual control activities with specific procedures, fraud dropped by 73% in the first year. Not because people were more ethical—but because the controls made fraud harder and legitimate work easier.

The COSO Framework: Five Types of Control Activities

COSO identifies several categories of control activities. Here's how they actually work in practice:

1. Authorization and Approval Controls

This is about making sure the right people make the right decisions at the right time.

The Theory: Management authorizes transactions and activities.

The Reality: I've seen "authorization" mean anything from the CEO personally signing every check to an automated workflow that nobody monitors.

Here's what actually works:

I implemented this at a healthcare organization in 2020. Before controls, they had 12 employees with ability to create vendors, issue purchase orders, AND process payments—the fraud triangle's dream scenario.

We implemented segregation:

• Accounts Payable: Creates vendors, but can't approve

• Purchasing: Issues POs, but can't create vendors or pay

• Treasury: Processes payments, but can't create vendors or POs

Within six months, they caught three fraudulent vendor schemes that had been running for over two years. The schemes didn't stop because people got more honest—they stopped because the controls removed the opportunity.

"Good controls don't assume people are dishonest. They remove temptation and create accountability. That protects both the organization and the employees."

2. Performance Reviews

This is about comparing what should happen with what actually happened.

Real-World Implementation:

I helped a SaaS company implement performance review controls in 2021. Their monthly close took 18 days, and they routinely discovered $200K+ errors weeks after the books closed.

We implemented these control activities:

The results were dramatic:

• Month-end close reduced from 18 days to 7 days

• Material errors dropped from 4-6 per quarter to less than 1

• They caught a $340,000 billing error in week 1 instead of discovering it during the annual audit

The Procedure Detail That Matters:

Here's what most organizations miss—they create the review requirement but don't specify what happens when variances are found.

The procedure needs to spell it out:

1. Controller runs variance report (automated, 1st business day)
2. Variances >5% flagged automatically
3. Accounting manager investigates within 2 business days
4. Investigation documented in variance tracking system
5. CFO reviews all unresolved variances weekly
6. Unresolved variances >$50K escalated to Audit Committee

Notice the specificity. No ambiguity about who does what, when, or what happens next.

3. Information Processing Controls

These controls ensure data accuracy and completeness. In 2024, this is overwhelmingly about technology.

Application Controls (controls within the software):

General IT Controls (controls over the technology infrastructure):

I audited a financial services firm in 2018 that had excellent application controls but terrible IT general controls. Their loan origination system had robust validations—but 27 people had administrative access to the underlying database and could change any value directly.

We implemented these control activities:

The key insight: application controls are worthless if someone can bypass them through database access or system manipulation.

4. Physical Controls

Despite living in a digital world, physical security still matters enormously.

In 2019, I investigated a breach at a law firm. Sophisticated hackers? Nation-state attackers? Nope.

A cleaning contractor found an executive's laptop in a conference room. It was unlocked. He opened Outlook, found client bank account information in emails, and transferred $230,000 before anyone noticed.

Physical Controls That Actually Work:

I worked with a healthcare provider that had excellent technical controls but terrible physical controls. Medical records were stored on a server in a closet that anyone could access. We found the "server room" unlocked 6 times during a 10-day observation period.

The fix was simple: move servers to locked room, implement badge access, require two-person access for any physical server interaction. Cost: $12,000. Value: prevented potential HIPAA violations worth millions in fines.

5. Segregation of Duties

This deserves its own deep dive because it's the most violated control I've encountered.

The Principle: No single individual should control all phases of a transaction.

The Reality: "We're too small for segregation of duties" is the most expensive lie in business.

Here's the segregation matrix I use:

Small Organization Strategy:

I hear it constantly: "We only have 5 people in accounting. We can't segregate duties."

Yes, you can. Here's how:

I implemented this approach at a 12-person startup in 2020. The bookkeeper was literally doing everything—vendor setup, invoice entry, payment processing, bank reconciliation. The owner trusted her completely.

We implemented:

• Owner approval required for all new vendors

• Automated exception reports for duplicate vendors, unusual payment amounts

• Owner performed monthly bank reconciliation

• Quarterly surprise cash counts

Three months later, the exception report flagged a vendor with a PO Box address similar to the bookkeeper's home address. Investigation revealed $67,000 in fraudulent payments over 14 months.

The bookkeeper wasn't a criminal mastermind. She was a good person who faced a financial crisis and saw an opportunity. Good controls protect good people from bad moments.

"Segregation of duties isn't about trust. It's about creating a system where fraud requires conspiracy, and conspiracy is hard."

The Implementation Framework That Actually Works

After implementing COSO controls at 40+ organizations, I've developed a framework that consistently succeeds:

Phase 1: Risk-Based Prioritization (Weeks 1-4)

Don't try to implement every control simultaneously. Start with the highest risks.

Risk Assessment Matrix:

I worked with a retail company that wanted to implement all 127 control activities we identified simultaneously. I convinced them to focus on the top 15 highest-risk areas first.

Result: 80% of their risk addressed by implementing 12% of the controls. We then rolled out the remaining controls over 18 months in priority order.

Phase 2: Control Design (Weeks 5-12)

For each priority control, document using this template:

Phase 3: Procedure Documentation (Weeks 13-20)

This is where most implementations fail. The procedure must be so clear that a new employee could execute it without asking questions.

Bad Procedure (what I see constantly):

"Manager reviews access requests and approves as appropriate."

Good Procedure (what actually works):

1. Employee submits access request via ServiceNow ticket (required fields: system name, access level needed, business justification, duration)

2. System automatically routes to employee's direct manager

3. Manager reviews within 2 business days:

   • Verify business need matches employee role

   • Confirm access level is minimum necessary

   • Check if temporary access has end date

4. Manager approves/denies in ServiceNow with comment

5. If approved, ticket routes to IT Security

6. IT Security provisions access within 1 business day

7. System sends confirmation to employee and manager

8. For denied requests, manager must provide alternative solution

Exceptions:

• Emergency access: CISO can approve provisionally, manager must approve within 24 hours

• Access >90 days: Requires director-level approval

• Administrative access: Requires CISO approval regardless of role

See the difference? The second version removes all ambiguity.

Phase 4: Technology Enablement (Weeks 21-32)

Manual controls fail. Automate everything possible.

Automation Opportunities:

I implemented automated access reviews at a financial services company in 2022. Previously, managers received quarterly spreadsheets with 200+ access rights to review. Compliance rate: 23%.

We implemented automated certification in Okta. Managers now receive individual access requests to approve/deny with one click. Compliance rate jumped to 94% in the first quarter.

Phase 5: Training and Communication (Weeks 33-40)

The Brutal Truth: People won't follow controls they don't understand or that make their jobs unnecessarily difficult.

Training That Works:

I helped a manufacturing company roll out new expense approval controls in 2021. Initial approach: sent email with new policy, expected compliance.

Result: 56% compliance after 3 months, lots of frustrated employees.

We revised the approach:

• Recorded 10-minute video explaining WHY controls changed (3 real fraud cases)

• Held lunch-and-learn sessions showing step-by-step process

• Created quick reference guide with screenshots

• Designated "control champions" in each department for questions

Compliance jumped to 91% within 6 weeks. Employees weren't resistant to controls—they were resistant to confusion.

"People don't resist controls. They resist change they don't understand and processes that feel punitive rather than protective."

Phase 6: Monitoring and Testing (Ongoing)

Controls degrade over time. Monitoring is non-negotiable.

Three-Tiered Monitoring Approach:

Key Metrics to Track:

Common Implementation Pitfalls (And How I've Fixed Them)

Pitfall #1: "Control Theater" - Looking Good on Paper

I audited a company in 2020 that had 300+ documented controls. On paper, they looked amazing. In practice, virtually none were operating.

They had:

• Policies nobody read

• Procedures nobody followed

• Checklists people signed without performing

• Reviews that consisted of "looks good" with no actual analysis

The Fix: Cut controls by 60%, automated the remaining ones, made compliance easy and non-compliance hard.

Pitfall #2: The Compliance Bottleneck

A tech company I consulted with required CEO approval for any expense over $5,000. Sounds conservative, right?

The CEO was approving 40-60 transactions daily. Each took an average of 4 minutes to review. That's 4+ hours of CEO time daily on expense approvals.

And because the CEO was busy, approvals took 3-7 days, slowing the entire business.

The Fix: Risk-based approval matrix:

CEO time freed up: 18 hours weekly. Business velocity improved dramatically. Control effectiveness actually increased because appropriate-level people were making decisions.

Pitfall #3: The "Trust Me" Exception

"We trust Sarah, so she can bypass the approval process."

I've heard variations of this hundreds of times. Here's what happens:

Case Study - 2018 Manufacturing Company:

• Sarah had 15 years of exemplary service

• Trusted implicitly by ownership

• Given authority to bypass normal controls "when urgent"

• "Urgent" became routine

• Over 3 years, processed $890,000 in fraudulent transactions

Sarah wasn't a career criminal. She had a gambling problem, faced bankruptcy, and saw an opportunity. Good person, bad situation, weak controls.

The Principle: Controls exist to protect everyone, including trusted employees. When you create exceptions for "trusted" people, you create:

1. Opportunity for the trusted person to fail

2. Resentment from other employees

3. Audit findings and control deficiencies

4. Legal liability when fraud occurs

The Solution: If someone needs faster processing, improve the process for everyone. Don't create special exceptions.

Real-World Implementation: A Complete Case Study

Let me share a detailed implementation I led in 2021 for a $50M healthcare technology company:

Starting Point:

• 50 employees

• Growing 40% annually

• Zero documented controls

• Monthly close took 15 days

• Failed first SOC 2 audit with 23 findings

• Lost $1.8M contract due to control deficiencies

Implementation Timeline:

Controls Implemented (top 20):

1. Dual approval for all journal entries >$10,000

2. Quarterly access recertification for all systems

3. Automated variance analysis (>10% triggers investigation)

4. Segregation of duties matrix enforced in ERP

5. Change management workflow for all production changes

6. Daily backup verification with monthly restore testing

7. Vendor master file review and approval process

8. Password policy enforcement (complexity + MFA)

9. Incident response procedures with escalation paths

10. Monthly reconciliation requirements for all balance sheet accounts

11. Annual security awareness training for all employees

12. Data classification and handling procedures

13. Physical security controls for server room

14. Encryption requirements for data at rest and in transit

15. Contract review and approval workflow

16. Budget vs. actual variance review process

17. Customer credit approval procedures

18. Inventory count and reconciliation procedures

19. Fixed asset tracking and disposal procedures

20. Compliance monitoring and reporting dashboard

Results After 12 Months:

ROI Calculation:

• Total investment: $275,000

• New revenue from compliance: $3.2M

• Cost savings (reduced close time, fewer errors): $180,000/year

• First-year ROI: 1,125%

The CFO told me: "We viewed controls as a cost center and compliance burden. Now we see them as a revenue enabler and competitive advantage."

The Technology Stack for Modern Control Activities

Based on implementations across 40+ companies, here's the technology stack that delivers the best ROI:

Small Business Alternative Stack (under 50 employees):

Maintaining Controls: The Long Game

Here's the hard truth: getting certified is easier than staying certified.

I've seen companies lose SOC 2 certification, fail follow-up audits, and regress to pre-implementation chaos. Here's how to prevent that:

The Quarterly Control Health Check

The Annual Control Refresh

Every year, dedicate time to:

1. Risk reassessment: What's changed in your business, industry, threat landscape?

2. Control effectiveness review: Which controls are working? Which aren't?

3. Efficiency analysis: Can we automate more? Eliminate unnecessary controls?

4. Technology evaluation: Are our tools still optimal?

5. Training refresh: Update content, engage employees, reinforce culture

I worked with a SaaS company that maintained SOC 2 certification for 6 consecutive years with zero findings. Their secret?

"We schedule control review like we schedule product releases. It's not optional, it's not negotiable, it's just how we operate."

"Compliance isn't a destination. It's a journey. The moment you think you've arrived is the moment you start sliding backward."

Your Implementation Roadmap

If you're starting your COSO control activities implementation, here's my recommended path:

Months 1-2: Foundation

• Conduct risk assessment

• Identify critical processes and controls

• Define control ownership

• Establish governance structure

Months 3-4: Design

• Document top 20 high-risk controls

• Create detailed procedures

• Design monitoring and reporting

• Select technology solutions

Months 5-6: Build

• Implement technology platforms

• Configure workflows and automation

• Create training materials

• Develop testing protocols

Months 7-9: Deploy

• Phased rollout by department

• Comprehensive training

• Initial testing and refinement

• Issue remediation

Months 10-12: Validate

• Internal control testing

• Process refinement

• Documentation completion

• Readiness assessment

Year 2+: Optimize

• Continuous monitoring

• Annual refresh and updates

• Technology optimization

• Culture reinforcement

The Bottom Line: Controls as Competitive Advantage

I started this article talking about a CFO frustrated with 247 unused policies. Let me close with what happened after we fixed it.

We reduced their control set to 68 critical controls with clear procedures. We automated 70% of them. We made compliance easy and visible.

Within 18 months:

• They closed a $12M Series B (investors cited strong controls)

• Won 3 major enterprise customers requiring SOC 2

• Reduced month-end close from 12 days to 4 days

• Eliminated material audit findings completely

• Cut compliance costs by 40% through automation

The CFO told me: "I used to see controls as bureaucracy. Now I see them as the operating system that allows us to scale safely. We're growing 100% year-over-year, and our control environment is actually getting stronger, not weaker."

That's the power of COSO control activities implemented correctly.

They're not about restriction—they're about sustainable growth. They're not about bureaucracy—they're about clarity. They're not about compliance—they're about capability.

Implement them right, and they become your competitive advantage.

Implement them wrong, and they become expensive theater that provides neither protection nor value.

The choice is yours.