The COSO framework was the model considered when the Federal Deposit Insurance Corporation Improvement Act was enacted in 1991. FIDICIA 112 requires that management report annually on the quality of internal controls and that the outside auditors attest to that control evaluation.
Control assessments COSO requires all managers to, at least once a year, step back from their other duties and evaluate risks and controls. Each manager should consider the current and planned operational changes, identify the risks, determine the appropriate mitigating controls, establish an effective monitoring process, and evaluate the effectiveness of those controls.