The standards behind our work
Each framework we map work to: what it covers, where it stands in November 2026, and how we use it.
Internal control starts with COSO
The structure auditors, lenders and boards already recognize, and the base for our controls and fraud work.
| Framework | What it covers | Status (Nov 2026) | How we use it |
|---|---|---|---|
| COSO Internal Control: Integrated Framework (2013) | Five components and 17 principles for designing and evaluating internal control over operations, reporting and compliance. | Current. Issued May 2013, replacing the 1992 framework. | We map every controls finding to a component and principle. Our Controls Health Self-Check is built on the five components. |
| COSO and ACFE Fraud Risk Management Guide (second edition) | Five fraud risk management principles aligned with COSO 2013: governance, fraud risk assessment, preventive and detective controls, investigation and corrective action, and monitoring. | Current. Second edition published May 2023, updating the 2016 guide. | The structure for our fraud risk assessments and for the ledger analytics that test fraud controls. |
| COSO, Achieving Effective Internal Control Over Generative AI | Maps the 17 COSO principles to generative AI use, with a six-step roadmap and attention to shadow AI. | Published 23 February 2026. Guidance, not a standard. | We use it to place AI tools and agents inside a finance team's existing control framework rather than beside it. |
We map to frameworks, never certify
A framework gives a finding a name that auditors, lenders and boards already understand. When we report that vendor bank changes go unverified, we also say which COSO principle the gap sits under and which DOJ question it would raise. That makes the finding easier to act on and easier to share.
We do not certify organizations against ISO standards, issue opinions on compliance with any framework, or perform audits or attest engagements of any kind. Where a client wants certification or assurance, we work alongside the certification body or auditor it chooses. Our principles explain why we stay on this side of the line.
The internal control frameworks above underpin our Financial Process & Controls work and the free Controls Health Self-Check.
Compliance programs are judged by questions
What prosecutors and certification bodies expect a compliance program to show.
| Framework | What it covers | Status (Nov 2026) | How we use it |
|---|---|---|---|
| DOJ Evaluation of Corporate Compliance Programs (ECCP) | The questions prosecutors use to judge whether a program is well designed, adequately resourced and given authority, and working in practice. The 2024 update added questions on AI and emerging technology, data access and whistleblower protection. | September 2024 version is current. No later revision published as of November 2026. | The question set for our compliance program evaluations, scaled to mid-size companies. |
| ISO 37001:2025 Anti-bribery management systems | Requirements for preventing, detecting and responding to bribery through a certifiable management system. The 2025 edition adds explicit expectations on anti-bribery culture. | Current. The 2025 edition replaced ISO 37001:2016. | A reference for anti-bribery policies, due diligence and supplier integrity questionnaires. We do not certify against it. |
| ISO 37301:2021 Compliance management systems | Requirements and guidance for a certifiable compliance management system: obligations, compliance risk, culture, controls, reporting and review. | Current, with Amendment 1:2024 adding climate action changes. | A structural reference for compliance documentation and program reviews. We do not certify against it. |
A framework describes what good looks like. Only the ledger shows whether you have it.
Federal grants carry their own rulebook
For nonprofits and others that spend federal awards, directly or through a pass-through entity.
| Framework | What it covers | Status (Nov 2026) | How we use it |
|---|---|---|---|
| Uniform Guidance, 2 CFR 200 (2024 revision) | Federal rules for grants and cooperative agreements: written procurement and conflict policies, cost principles, indirect costs, subrecipient monitoring and equipment. | In effect since 1 October 2024; some agencies, including HHS, completed adoption on 1 October 2025. Equipment threshold $10,000; de minimis indirect rate up to 15 percent of modified total direct costs. | The basis for the written policies and records we prepare for grant-funded organizations. |
| 2 CFR 200 Subpart F, single audit | Audit requirements for non-federal entities that expend federal awards, including program-specific audits and submission to the Federal Audit Clearinghouse. | Threshold $1,000,000 for fiscal years beginning on or after 1 October 2024; $750,000 for earlier years. | Our Single Audit Threshold Checker applies these rules. We prepare clients for the audit; an independent auditor performs it. |
| OMB proposed revision of the Uniform Guidance | A proposed rewrite that would, among other changes, expand termination for convenience and recast the guidance as binding regulation. | Proposed 29 May 2026; comments closed 13 July 2026. Not final. A continuing resolution bars finalization through 11 December 2026. | We track it, and we do not ask clients to rewrite policies until a final rule is published. |
Every status here carries a date
Rules on this page move. Each status was checked against the primary source or a dated professional summary as of November 2026, and proposals are labeled as proposals until they are final. A status here is general information, not legal advice; confirm with counsel before you rely on it for a filing.
For grant-funded organizations, Grant & Uniform Guidance Compliance turns the 2 CFR 200 requirements into written policies and records. Changes to these rules are covered in our regulation insights.
AI controls are still being written
Voluntary frameworks, one certifiable standard and one EU law with moving dates.
| Framework | What it covers | Status (Nov 2026) | How we use it |
|---|---|---|---|
| NIST AI Risk Management Framework 1.0 (NIST AI 100-1) | A voluntary framework that organizes AI risk work into four functions: govern, map, measure and manage. | Version 1.0, published January 2023, remains current. Under revision following the July 2025 AI Action Plan. | The vocabulary for AI risk in our AI governance work for finance teams. |
| NIST Generative AI Profile (NIST AI 600-1) | A companion profile that applies the AI RMF to generative AI risks such as confabulation, information integrity and data privacy. | Published July 2024. Current. | A checklist source for AI use policies and for vendor and model due diligence. |
| ISO/IEC 42001:2023 AI management systems | Requirements for a certifiable AI management system: policy, roles, risk and impact assessment, and controls across the AI lifecycle. | Current. Published December 2023. | A structural reference when a client expects to seek certification. We do not certify against it. |
| EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 | Risk-based EU rules for AI systems: prohibited practices, AI literacy, general-purpose AI, transparency duties and high-risk obligations. Creditworthiness assessment of individuals is a listed high-risk use. | Amendment in force 27 July 2026. AI literacy since 2 February 2025; general-purpose AI since 2 August 2025; Article 50 transparency from 2 August 2026; Annex III high-risk from 2 December 2027; Annex I from 2 August 2028. | Relevant only where a client places AI systems on the EU market or uses them in the EU. We flag exposure and refer legal questions to counsel. |
In finance, treat an AI agent as a user, with its own login, limited permissions and a log of every action.
Reporting rules are narrowing, not vanishing
Mandatory scope has shrunk, but large customers still pass data requests down the supply chain.
| Framework | What it covers | Status (Nov 2026) | How we use it |
|---|---|---|---|
| ISSB, IFRS S1 and IFRS S2 | IFRS S1 covers general sustainability-related financial disclosures; IFRS S2 covers climate, including Scope 1, 2 and 3 emissions. | Issued June 2023, effective for periods beginning on or after 1 January 2024 where a jurisdiction adopts them. Voluntary in the United States. | A source of structure for voluntary financial integrity reports that investors or lenders will read. |
| GRI Standards | Impact reporting standards widely used for voluntary sustainability reports. | GRI 101 Biodiversity applies from 1 January 2026; GRI 102 Climate Change and GRI 103 Energy from 1 January 2027. | Concepts for the governance and impact sections of voluntary reports, where clients want them. |
| CSRD and ESRS after the 2026 Omnibus | EU sustainability reporting law and its reporting standards. | Directive (EU) 2026/470 in force 18 March 2026: scope narrowed to more than 1,000 employees and more than €450 million turnover; transposition by 19 March 2027. Simplified ESRS adopted by the Commission on 3 July 2026. | We help US suppliers work out which EU customer requests they must answer and how much detail is reasonable. |
| VSME, the voluntary standard for smaller companies | A voluntary sustainability reporting standard for companies outside CSRD scope, which also caps what CSRD reporters may request from value-chain companies with up to 1,000 employees. | Adopted by the Commission as a delegated act on 3 July 2026, alongside the simplified ESRS. | The ceiling we use when building a supplier's reusable answer library for EU customers. |
| California SB 253, Climate Corporate Data Accountability Act | Annual Scope 1 and 2, and later Scope 3, emissions reporting for US entities doing business in California with more than $1 billion in annual revenue. | CARB regulation in effect. First Scope 1 and 2 reports due 10 November 2026, without assurance; limited assurance from 2027; Scope 3 from 2027. | We help suppliers to covered companies answer the Scope 3 data requests that follow. |
| California SB 261, climate-related financial risk reports | Biennial climate-related financial risk reports for companies doing business in California with more than $500 million in annual revenue. | Enforcement enjoined by the Ninth Circuit pending appeal since 18 November 2025; argued 9 January 2026; CARB is not enforcing the first deadline while the injunction stands. | We watch the appeal and do not recommend building SB 261 reports until the court rules. |
Find out which rules reach you
In a first conversation we can sort which of these frameworks apply to your sector, size, funding and customers, and which you can set aside.