COSOGASB / FASAB / GAO / OMBcgfmVerified 2026-11-12

COSO: Green Book, A-123, and ERM

Authoritative Rule Summary (COSO)

Under COSO (GASB / FASAB / GAO / OMB), green Book, A-123, and ERM establishes the authoritative rules tested on the AGA CGFM. This lesson provides a comprehensive understanding of internal control frameworks critical for government financial managers, focusing on the GAO Green Book, OMB Circular A-123, and Enterprise Risk Management (ERM). VoraPrep verifies every threshold, worked table, and practice question below against the current AGA CGFM blueprint.

Core Concepts: Authoritative Internal Control Frameworks

FeatureGAO Green Book (2014)OMB Circular A-123 (2016)COSO (2013)
PurposeStandards for internal control design/implementation in federal governmentMandates federal agencies to implement Green Book & ERM; annual assurancePrivate sector internal control framework (basis for Green Book)
AuthorityGAO (legislative branch)OMB (executive branch)Private sector consortium
ScopeAll federal agenciesAll executive branch agenciesPrivate sector entities (can be adapted)
Key Elements5 components, 17 principlesRequires Green Book compliance; integrates ERM5 components, 17 principles
Mandatory for Feds?Yes, via OMB A-123YesNo, but influential
Test Yourself on COSO in 30 Seconds (No Login)AGA CGFM · medium

A federal agency's management team is conducting its annual assessment of the internal control system, focusing on whether transactions are being recorded promptly and accurately, and whether financial data is being properly aggregated and reported. This evaluation specifically scrutinizes the policies and procedures established to ensure that management's directives are being carried out. Which of the following best applies to this situation?

Worked Practitioner Scenario

Practitioner Application: Green Book, A-123, and ERM

Imagine you are a federal agency's Chief Financial Officer (CFO). During your annual review, significant internal control deficiencies are identified within the procurement department, leading to unauthorized purchases and potential fraud. Your task is to evaluate these deficiencies, design corrective actions, and ensure compliance with federal mandates. Which authoritative guidance document provides the foundational standards for designing and implementing effective internal controls in your agency? Is it the GAO Yellow Book, the GAO Green Book, or OMB Circular A-123? Understanding the precise role of each is crucial for both effective financial management and success on the CGFM exam.

  1. Effective internal control is paramount in government to safeguard assets, ensure reliable financial reporting, promote operational efficiency, and encourage compliance with laws and regulations. For federal agencies, specific frameworks and mandates govern the design, implementation, and evaluation of these controls.
  2. GAO Green Book: The Standard for Internal Control The GAO Green Book, officially titled 'Standards for Internal Control in the Federal Government' (GAO-14-704G, September 2014 revision), establishes the foundational internal control standards for federal agencies. It is the authoritative guidance for designing, implementing, and operating effective internal control systems. The Green Book outlines five components of internal control and seventeen principles that support these components. These principles are derived from the COSO framework but are adapted for the unique governmental environment.
The Five Components of Internal Control (GAO Green Book): 1. Control Environment: Sets the tone of an organization, influencing the control consciousness of its people. 2. Risk Assessment: The organization's identification and analysis of relevant risks to the achievement of its objectives, forming a basis for determining how the risks should be managed. 3. Control Activities: The actions management establishes through policies and procedures to achieve objectives and respond to risks. 4. Information and Communication: The continual, iterative process of providing, sharing, and obtaining necessary information. 5. Monitoring Activities: Evaluations used to ascertain whether the components of internal control are present and functioning.
Exam Watchouts & Statutory Boundaries

Common AGA CGFM Distractors on COSO

  • 1Confusing COSO with Green Book: While the Green Book is based on COSO, the Green Book is the authoritative standard for federal government internal controls. Do not cite COSO as the primary standard for federal agencies on the CGFM exam.
  • 2Underestimating OMB A-123's Scope: Remember that OMB A-123 not only mandates Green Book compliance but also requires the integration of Enterprise Risk Management (ERM). This is a critical update from the 2016 revision.
  • 3Outdated Information: Always ensure you are referencing the most current versions of these documents (e.g., Green Book 2014, A-123 2016 revision).
  • 4The GAO Green Book ('Standards for Internal Control in the Federal Government') is the authoritative standard for designing and implementing internal controls in federal agencies, outlining 5 components and 17 principles.
  • 5The COSO Framework is a private-sector standard that influenced the Green Book but is not the primary authoritative standard for federal government internal controls.

Frequently Asked Questions: COSO

What is the core rule under COSO (Green Book, A-123, and ERM)?

Under COSO (GASB / FASAB / GAO / OMB), green Book, A-123, and ERM establishes the authoritative rules tested on the AGA CGFM. This lesson provides a comprehensive understanding of internal control frameworks critical for government financial managers, focusing on the GAO Green Book, OMB Circular A-123, and Enterprise Risk Management (ERM). VoraPrep verifies every threshold, worked table, and practice question below against the current AGA CGFM blueprint.

How is COSO tested on the AGA CGFM?

Confusing COSO with Green Book: While the Green Book is based on COSO, the Green Book is the authoritative standard for federal government internal controls. Do not cite COSO as the primary standard for federal agencies on the CGFM exam. Underestimating OMB A-123's Scope: Remember that OMB A-123 not only mandates Green Book compliance but also requires the integration of Enterprise Risk Management (ERM). This is a critical update from the 2016 revision.

Where can I practice AGA CGFM questions on Green Book, A-123, and ERM?

Test yourself instantly with the free playable AGA CGFM question on this page, or launch VoraPrep's full AGA CGFM adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cgfm.

Master COSO Across the VoraPrep Platform

Related Statutory & Regulatory Rules

All Rules →