COSO, Achieving Effective Internal Control Over Generative AI

Summary

COSO released Achieving Effective Internal Control Over Generative AI (GenAI) on February 23, 2026. The publication adapts the five components and 17 principles of COSO's 2013 Internal Control – Integrated Framework to generative AI rather than creating a separate governance framework. It states that generative AI outputs are probabilistic and can be confidently wrong, and that controls should treat them as claims requiring validation. Where management relies on AI outputs as evidence for internal control over financial reporting (ICFR), it says the AI control patterns should meet the same evidence standards expected for ICFR. The publication describes itself as general information whose views may differ from those of regulators. Two different PDF files of the publication are served from COSO's website. Their text differs in one Appendix B section heading, which reads "Knowledge retrieval and summarization" in one file and "Human-AI interaction and productivity assistants" in the other, and in one spelling correction; neither file carries a version or revision notice.

Key dates

1. February 23, 2026Key date
2. October 20, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: January 20, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. NEW YORK, February 23, 2026 – The Committee of Sponsoring Organizations of the Treadway Commission (COSO), today released a new publication, Achieving Effective Internal Control Over Generative AI (GenAI)

   Supports: Release date February 23, 2026

   COSO Releases Practical Roadmap for Managing Generative AI Risks and Controls (press release) Committee of Sponsoring Organizations of the Treadway Commission (COSO) Primary source

2. adapts the five components and 17 principles

   Supports: Adapts the five components and 17 principles of the 2013 ICIF (the publication's executive summary adds that this is instead of a separate governance framework; sentence split across PDF columns)

   outputs as claims requiring validation, rather

   Supports: Controls should treat GenAI outputs as claims requiring validation (sentence split across PDF columns; the passage also says outputs can be confidently wrong)

   When reliance exists, AI control patterns should meet the same evidence standards expected for ICFR

   Supports: Same ICFR evidence standards where management relies on AI outputs

   Views, opinions or interpretations expressed herein may differ from those of relevant regulators, self-regulatory organizations or other authorities

   Supports: Disclaimer: views may differ from regulators

   GenAI is probabilistic, not deterministic.

   Supports: Outputs are probabilistic (the same passage says they can be confidently wrong)

   creating a separate governance framework, it

   Supports: Adapts the framework rather than creating a separate governance framework (sentence split across PDF columns)

   Human–AI interaction and productivity assistants(augment human capabilities through chat-based interfaces)

   Supports: Appendix B heading in this file

   Achieving Effective Internal Control Over Generative AI (GenAI) Committee of Sponsoring Organizations of the Treadway Commission (COSO) Primary source

3. Achieving Effective Internal Control Over Generative AI (2026/02/23)

   Supports: COSO news page lists the publication dated 2026/02/23 (listing; no later generative AI item)

   News | COSO Committee of Sponsoring Organizations of the Treadway Commission (COSO) Primary source

4. Achieving Effective Internal Control Over Generative AI COSO Releases Practical Roadmap for Managing Generative AI Risks and Controls

   Supports: COSO's landing page for the publication; shows one title and links 'Publication' and 'Press Release' (page text only)

   GenAI | COSO Committee of Sponsoring Organizations of the Treadway Commission (COSO) Primary source

5. Knowledge retrieval and summarization (summarize large volumes of information) These tools are often the most accessible GenAI entry point

   Supports: Second file of the publication; its Appendix B heading differs from the other file over the same body text

   Achieving Effective Internal Control Over Generative AI (GenAI) (file 719ba0_08f358f2, also on COSO's file host), Appendix B Committee of Sponsoring Organizations of the Treadway Commission (COSO) Primary source