COSO Principle 5 — Accountability for Internal Control
Description
The entity holds individuals accountable for their security responsibilities through performance management, reward structures, and consequence frameworks.
⚠️ Risk Impact
Accountability without consequences degrades to suggestions. Suggestions during a 2am incident are ignored. Auditors specifically test whether accountability is meaningful or theatrical.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
Tie security responsibilities to performance reviews: KPIs for engineering managers should include 'security findings closure rate' and 'training completion in team'. Document a graduated consequence framework: coaching → formal warning → access revocation → termination, used and recorded.
💀 Real-World Attack Scenario
A team consistently failed to remediate critical findings within SLA. The CISO escalated quarterly for 18 months. Nothing changed because the team's performance reviews didn't reflect security KPIs — they rewarded shipping velocity exclusively. A material breach traced to one of the unfixed findings. The post-mortem cited 'accountability without consequence' as the root cause; subsequent SOC 2 audit issued a qualified opinion on CC1.5.
💰 Cost of Non-Compliance
Accountability gap as breach root cause: 31% of major incidents in 2024 (IBM X-Force). SOC 2 qualified opinion on CC1.5: reduces enterprise win rate 18%, increases cyber insurance premiums 12-18%.
📋 Audit Questions
- 1.How are security KPIs included in engineering performance reviews?
- 2.Show me the consequence framework for repeated security policy violations.
- 3.When was the last formal consequence (warning, access revocation, termination) applied for security failures?
- 4.How is the CISO's authority to revoke access documented and respected?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔KPIs for security exist on paper but don't influence comp decisions — engineers learn quickly that velocity beats security every quarter
- ⛔Consequence framework documented but never used — appears in the policy library but no enforcement record exists
- ⛔CISO has 'authority' but lacks practical mechanism to enforce (no integration with HRIS, no escalation lane to the CEO)
📈 Business Value
Lived accountability frameworks separate organizations that maintain control quality from those whose controls degrade silently. They turn security from a checkbox into a measured organizational outcome — material for both audit defensibility and incident risk reduction.
⏱️ Effort Estimate
8-12 hours to wire security KPIs into performance management + 4 hours quarterly review
EchelonGraph tracks per-team finding-closure SLA and surfaces accountability data into HR review cycles
🔗 Cross-Framework References
Automate SOC 2 CC1.5 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →