What Are Internal Controls? Types and Importance

Search Fintrev

Search our guides, reviews and glossary.

Internal controls are the processes, rules and procedures a company uses to keep its financial records accurate, protect its assets, prevent and detect fraud and error, and comply with applicable laws and its own policies. They sit between a business event (a sale, a purchase, a payment) and the number that ends up in the financial statements, determining who can authorize a transaction, who records it, who holds the asset, and how someone later confirms that the records match reality.

What Internal Controls Cover

Internal controls are not limited to the accounting department. They also govern operations: whether budgets are followed, purchases go through approved channels, inventory is physically secured, and reports reach decision-makers on time. A company with weak controls may still produce financial statements, but neither management nor investors can rely on them with much confidence.

Three goals run through most control systems:

1. Reliable reporting. The balance sheet and income statement should reflect transactions that actually happened, recorded in the right amount and period.
2. Asset protection. Cash, inventory, equipment and data should be safe from theft, misuse and loss.
3. Compliance and efficiency. Activities should follow laws, regulations and internal policies, and processes should catch problems early instead of at year-end.

How Internal Controls Work

Each control system reflects the company’s size, industry and risks, but most are built from the same parts. The widely used COSO framework (from the Committee of Sponsoring Organizations of the Treadway Commission, first issued in 1992 and updated in 2013) groups them into five components, and practitioners usually add a few specific practices.

The Five Core Components

• Control environment. The board and senior management set the tone: integrity matters, problems get reported, and fraud is pursued, with the right people and reporting lines in place so controls can operate. A strong procedure manual means little if executives openly ignore it.
• Risk assessment. The company regularly identifies where losses or misstatements could occur, such as a high volume of cash transactions, complex revenue contracts or a new system migration, and puts more or tighter controls on higher-risk areas.
• Control activities. The specific preventative and detective policies and actions that carry out the controls: approvals, documentation, reconciliations, access restrictions and reviews.
• Information and communication. People need to know their role, the procedures and how to escalate an issue, and systems must capture accurate data and deliver it to the people who act on it.
• Monitoring. Controls degrade as staff turn over, systems change and the business grows. Ongoing reviews, internal audits and follow-up on findings keep the system working.

Practices Most Systems Include

• Compliance with laws and regulations. Procedures are adjusted as rules and standards change.
• Separation of duties. Authorization, custody of the asset and record-keeping are split among different people so that no single person can both commit and conceal an error or theft.
• Physical controls. Locked storage, badge systems and surveillance protect cash, inventory and equipment, among a company’s most tangible assets.

Preventative vs. Detective Controls

Control activities are generally divided by when they act.

Preventative controls try to stop errors and fraud from happening at all. They rely on documentation and authorization. Examples include:

• Separation of authorization, recording and custody
• Required approval of invoices before payment
• Verification of expense claims against receipts and policy
• Restricted physical and system access to cash, inventory, equipment and accounting software
• Approval limits that send larger transactions to a more senior reviewer

Detective controls assume some problems will get through and are designed to find them afterward. The central detective activity is reconciliation: comparing two data sets that should agree, such as the bank statement and the cash ledger, or the inventory count and the inventory records, and investigating any material difference. Other detective controls include physical inventory counts, internal and external audits, and reviews of exception reports.

Many frameworks also describe corrective controls, the steps taken once a problem is found: fixing the entry, recovering the loss, disciplining the person responsible, and changing the process so the problem does not recur.

The two types work as layers. Preventative controls tend to be cheaper per error avoided, because stopping a bad payment is easier than recovering it. But no preventative control is perfect, so detective controls limit how long an error or fraud goes unnoticed.

Internal Controls and Corporate Governance

Internal controls became a central U.S. governance issue after the early-2000s accounting scandals, including those at Enron and WorldCom. Congress responded with the Sarbanes-Oxley Act of 2002 (SOX), intended to protect investors from fraudulent accounting and improve the reliability of corporate disclosures.

SOX changed who answers for the numbers. Several provisions matter most for internal controls:

• Management certification. Chief executives and chief financial officers of public companies must certify their periodic financial reports. Section 906 attaches criminal penalties to knowingly or willfully false certifications.
• Section 404. Management must assess and report on the effectiveness of the company’s internal control over financial reporting, and for larger public companies, the external auditor must also attest to that assessment.
• Audit trail. Managers are responsible for maintaining records that show how reported figures were produced.

This connects controls directly to the audit. The external auditor’s opinion on the financial statements rests on testing the processes and controls used to produce them. Where controls are strong, auditors can rely on them more; where they are weak, auditors must do more direct testing, and serious deficiencies (called material weaknesses) are disclosed.

Although SOX applies to public companies, private companies, nonprofits and government bodies use similar control structures because lenders, donors, regulators and owners expect reliable records.

Example of Internal Controls

Hypothetical example. A mid-sized distributor buys stock from about 200 vendors and pays them by bank transfer. Here is how its purchasing and payment cycle could be controlled.

Preventative steps:

1. A department manager approves a purchase order before anything is ordered. Orders above a set dollar limit also need the controller’s sign-off.
2. When goods arrive, the warehouse records what was received. The warehouse staff cannot approve invoices or initiate payments.
3. Accounts payable pays an invoice only after a three-way match: the purchase order, the receiving record and the vendor invoice must agree on item, quantity and price.
4. Only the vendor management team can add a new vendor or change bank details, and changes require a callback to a known contact at the vendor.
5. The person who prepares the payment batch cannot release it. A second person approves the transfer in the banking system.

Detective steps:

1. Each month, a staff accountant who has no payment authority reconciles the bank statement to the cash ledger.
2. A quarterly inventory count is compared with the inventory records. Shrinkage affects cost of goods sold, so unexplained differences are investigated.
3. A report lists duplicate invoice numbers and payments to vendors added within the past 30 days, and the controller reviews it.

Now suppose an employee in accounts payable tries to create a fake vendor and pay it. Step 4 blocks the vendor setup, and step 5 means a second person would see the payment. If a fake vendor somehow got through, the new-vendor report and the bank reconciliation give two more chances to catch it.

Limitations of Internal Controls

Internal controls provide reasonable assurance, not absolute assurance, that financial information is accurate. Several weaknesses are built into any system:

• Human judgment. A reviewer who approves invoices without reading them provides no real control.
• Management override. Senior personnel often have authority to bypass controls for speed or flexibility, and that same authority can be used to manipulate results.
• Collusion. Separation of duties assumes the people in different roles act independently. Employees working together can conceal fraud that each control would catch individually.
• Cost. Every control takes time, staff or technology. A small business may not have enough employees to fully separate duties and must rely more heavily on owner review and detective controls.
• Change. A control may stop working after a reorganization, acquisition or software change if no one updates it.

Terms Often Confused With Internal Controls

Internal control vs. internal audit. Internal controls are the procedures that operate day to day. Internal audit is an independent function that evaluates whether those controls, along with governance and risk management processes, are designed well and working. Internal auditors test controls; they generally should not run them, because that would undermine their independence.

Internal control system vs. internal control policy. A policy is a written statement of rules, such as “all payments over a certain amount require two approvals.” The internal control system is the whole structure: the policies plus the people, processes, technology, risk assessment and monitoring that make them operate. A company can have a thorough policy manual and still have an ineffective system if no one follows or checks it.

Internal controls vs. external audit. The external audit is performed by an independent accounting firm that issues an opinion on the financial statements (and, for certain public companies, on internal control over financial reporting). The audit relies on and tests the company’s controls, but it does not replace them.

Internal controls vs. risk management. Risk management identifies and decides how to respond to the risks a company faces, including strategic and market risks. Internal controls are one response, aimed mostly at operational, reporting and compliance risks.

FAQs

The Bottom Line

Managers, auditors, investors and lenders all depend on internal controls to trust a company's numbers, and U.S. public company executives carry legal responsibility for them under Sarbanes-Oxley. A sound system layers preventative steps such as separated duties and approvals with detective steps such as reconciliations. Because override and collusion can defeat any design, ongoing monitoring and review keep controls effective.