Internal Controls

Every organization relies on people and systems to handle money, data and decisions correctly. Internal controls are the safeguards that make this reliable. They range from simple practices, such as requiring two signatures on large payments, to automated checks inside finance systems that block duplicate invoices. Some controls prevent errors and fraud before they happen, while others detect problems afterward so they can be corrected. Together, they give managers, boards, auditors and investors confidence that the organization's numbers are accurate and that it is following the rules it is subject to. Good controls also make day-to-day work more predictable, since everyone knows which checks apply to which tasks.

Internal controls became a board-level topic in the United States after the Sarbanes-Oxley Act of 2002 required public company managers to assess and report on their internal control over financial reporting. Most organizations use the COSO Internal Control Integrated Framework, first published in 1992 and updated in 2013, as their reference. For risk, compliance and finance teams, internal controls are the practical means by which risks identified in assessments are actually reduced.

Definition of Internal Controls

Internal control is a process, carried out by an organization's board, management and other personnel, designed to provide reasonable assurance that objectives relating to operations, reporting and compliance will be achieved. This definition comes from the COSO framework.

Controls are designed in response to a risk assessment, are often documented in a risk control matrix and are central to SOX compliance.

The Five Components of Internal Control

The control environment sets the tone of the organization, including integrity, ethical values, board oversight and the structure of authority and responsibility.

Risk assessment identifies and analyzes the risks to achieving objectives, including the risk of fraud. It also considers how changes in the business, such as new systems or acquisitions, affect those risks.

Control activities are the specific actions that address those risks, such as approvals, reconciliations, reviews and system access restrictions. They are performed at all levels of the organization and at different stages of business processes.

Information and communication make sure relevant, quality information flows to the people who need it to carry out their responsibilities.

Monitoring activities check whether controls are present and working, through ongoing evaluations, separate reviews or both. The 2013 COSO framework supports these five components with 17 principles.

Types of Internal Controls

Preventive controls stop errors or fraud before they occur, such as approval limits and segregation of duties.

Detective controls find problems after they occur, such as account reconciliations and exception reports. They are especially useful where preventing every error would be too costly or slow.

Corrective controls fix problems once they are found, such as procedures for reversing an incorrect payment.

Controls can also be manual or automated. Automated controls are more consistent but need well-managed IT systems behind them, which is the role of IT general controls.

Importance of Internal Controls in Risk and Compliance

Internal controls protect assets. They reduce the chance of theft, fraud, misuse and costly errors. Even simple controls, such as locking inventory and limiting who can approve payments, prevent many losses.

They produce reliable information. Accurate financial statements and operational reports depend on controls over how transactions are recorded, approved and reported.

They also support compliance. Many laws and regulations, including securities, banking, data protection and anti-bribery rules, expect organizations to maintain effective controls and to show evidence that they work.

Internal Controls and Financial Management

Controls over the general ledger, payments, payroll and revenue recognition are the foundation of accurate financial statements.

Weak controls can lead to restatements, fines, higher audit fees and loss of investor confidence, all of which carry real costs.

Controls also have a cost, in staff time and systems, so organizations aim for controls that are proportionate to the risks they address.

Automating high-volume controls can reduce the cost of control while improving consistency and evidence.

Common Challenges

Controls accumulate over time, and organizations may keep outdated or duplicated controls that add effort without reducing risk. Each audit finding tends to add a new control, but few are ever retired.

Documentation can drift from reality when processes change but control descriptions do not.

Controls that depend on one person, or that are easy to override by management, may fail when they are most needed. The COSO framework notes that management override is a key limitation of any system of internal control.