Each of these is described in more detail in the COSO literature. Notably, the COSO framework states explicitly that, while its components will not function identically within every entity, its principles should apply to all sizes of institutions.
Small and mid-size entities, for example, may choose to apply the framework in a less formal and less structured way and scale it to their own needs - as long as quality is maintained. This underscores the message from bank supervisors that good risk management is expected of every institution, regardless of size or sophistication.