Descriptive function of auditing in the assessment of internal control and the COSO model.

Abstract

Auditing, as a systematic process for evaluating the effectiveness of internal controls under frameworks such as COSO, faces a growing demand for reports that transcend formal verification and incorporate qualitative analyses of the control environment. To demonstrate the need for and effectiveness of incorporating descriptive functions and qualitative approaches in internal control auditing under the COSO framework, this descriptive-analytical documentary study examined audit reports and emblematic cases through categorization based on the 5 components and 17 principles, triangulating qualitative methodologies with normative analysis. The results show that, although COSO requires integrity between structure and context, audit practice prioritizes binary checklists, omitting factors such as organizational culture or hierarchical pressures. For example, at Volkswagen, technical controls existed, but monitoring ignored discrepancies between laboratory tests and actual operations; At Wells Fargo, codes of ethics failed to prevent systemic fraud due to toxic business goals that were not qualitatively audited. It is concluded that auditing should adopt descriptive tools to capture gaps between formal design and actual implementation, transforming reports into strategic diagnoses that identify not only what failed, but also how and why. This requires balancing the COSO framework with professional judgment and ethnographic techniques, ensuring that the assessment of internal control is as dynamic and complex as the organizations it audits.