When the Committee of Sponsoring Organizations (COSO) released itsInternal Control—Integrated Framework (ICFR) in 1992, the event went largely unnoticed. The importance of this framework changed dramatically with the passage of the Sarbanes-Oxley Act of 2002 (SOX). Because SOX required all covered entities to base their assessment of internal control on a recognized framework, COSO was readily embraced. Unfortunately, smaller public and nonpublic companies have found the 1992 framework complicated to apply and to understand.