COSOPS is a modified version of the COSO framework applied to public sector organizations. COSOPS highlights internal controls aimed at efficiency, reliability of reporting, and compliance with laws. Key changes include emphasizing public accountability, the role of civil service, fiscal matters, and external oversight, aiming for improvement in public policy functions.

Have you tried to apply COSO to a public sector organization, how is that working out for you?  Perhaps you are like me and over the decades you have picked and chosen what part of COSO to apply,  The framework, components or maybe just the general concepts.

How about a control framework built first and foremost for the public sector? So with a small drum roll, I present COSO – Public Sector edition (COSOPS – cool acronym or what).

Internal Control Defined – Public Sector

Internal control is a process, effected by a public sector entity (government, public agency, international organization) board of directors, management and other personnel, designed to provide “reasonable assurance” regarding the achievement of objectives in the following categories:

• Effectiveness and efficiency of operations
• Reliability of reporting (financial and others)
• Development and enactment of public policies through good government
• Compliance with and management of applicable laws and regulations.

Three Lines of Defense

Similar to COSO classic, COSOPS also has Three Lines of Defense, albeit with modifications.  In particular the role of the public, electorate, free press and public interest groups is paramount for not only the internal operations but the achievement of organizational objectives via public policy.

A key changes to the model relative to the original are as follows:

1. Public Policy measures whether a government/organization has done what it said it would do?  Is this what the stakeholders want from the government/organization?
2. Professional Civil Service is different from a for-profit organization as the service should transcend a change in government or changes to public policy for organizations. The dark side to a Civil Service is what happens if they are politically orientated or untouchable through things like strong unionization.
3. Public Budgeting and Accounts is more central and critical than a corporate budget as it represents an authority to expend and indirectly a request to supply tax monies or debt.
4. Privacy and Freedom of Information legislation or policies provides a reminder to management and civil service of the citizen’s right to know and the obligation to protect their information.  While this may lead to occasional perverse incentives, on the whole it acts as a powerful internal control.
5. Internal Audit and Internal Oversight Offices include the classic internal audit functions but also such things as investigative powers of a public service commissioner, appeals bodies, ombudsmen, etc.
6. Free Press, Public Interest Groups, Open Government may seem to be redundant to the first line of defense, but they represent the other side of the coin.  These are the consumers of information about government operations.
7. Government Efficiency a precursor for corruption (and thus loss of corresponding control) is an inefficient or ineffective government that leads to bribes and circumvention of controls.  An ease of doing business is a critical control factor for the public sector.
8. Effective and Independent Judiciary is a key control to manage excesses of governments and its abuse of power.
9. Government of the Day is the group of individuals and associations who have decision-making authority – for the moment.  As institutions they also have authority over elements of the lines of defense.  For example, an external auditor may report to the legislature or senate as opposed to the executive functions of a government or organization.
10. Constitutional Functions are the legislative structures of the political entity in question including such things as the degree of enfranchisement among the population, political structure, constitutional powers, etc.

Where Internal Ends and External Begins

Unlike a for-profit or even non-governmental organization, there is a fuzzy area of where a government stops and political process begins.  In other words, it is not the job of the civil service to maintain the government of the day through the next election.  The civil service’s job is to be as faithful, competent, and diligent no matter who their political masters-of-the-day area. 

To this end, much of COSO is completely relevant to a public sector entity with some acknowledged deviations to support the public policy functions. This is the introduction and further work is required to better fit COSO to governments – such as in its 17 principles.

Thoughts, am I going down the right path for the public sector and for internal control?