When the Securities and Exchange Commission first published guidance on how to comply with the infamous Section 404 of the Sarbanes-Oxley Act, which requires companies to assess and disclose the strength of their internal control over financial reporting, the agency pointed to the Committee of Sponsoring Organizations’ 1992-era Internal Control-Integrated Framework as an example of a “suitable” control assessment framework. At the time, the agency did also state that other control frameworks met its suitability criteria, but the strong endorsement of the SEC (and the Public Company Accounting Oversight Board) has resulted in the now-dated COSO framework becoming, for all intents and purposes, the only official control criteria public companies use to assess the effectiveness of their accounting controls.