Which COSO component focuses on evaluating internal control deficiencies and communicating them to those responsible for corrective action, including senior management and the board?

• A. Control activities
• B. Monitoring
• C. Information and communication
• D. Risk assessment

Answer: (B)

In COSO, monitoring is the component that continuously assesses the effectiveness of internal control and determines whether deficiencies are identified and communicated to those responsible for corrective action, including senior management and the board. This ongoing or separate evaluation ensures weaknesses are surfaced and remediated, and that governance receives timely information about control performance. While other components focus on establishing control activities, the flow of information, or identifying risks, they do not center on evaluating deficiencies and communicating them for remediation in the governance chain. Monitoring keeps the control system accountable by confirming that controls work as intended and that any gaps are addressed.