Internal Controls: The Definitive Guide for Risk and Compliance Professionals

Financial reporting, legal compliance, and growth initiatives within an organization all require accurate, timely information. Internal controls are the mechanisms for providing such data. They can also optimize the efficiency of operations and the effectiveness of risk management strategies.

Internal Controls Definition

Internal controls are the protocols, procedures, and activities that protect organizations from financial, operational, strategic, and reputational risk.

Internal Controls Examples

What types of internal control activities might you find in an enterprise’s system of internal controls?

Below are some examples of the different types of internal controls organizations employ to support the achievement of objectives like accurate financial reporting and the security of physical, on-premises assets:

Segregation of Duties

Perhaps you’ve heard the saying, “absolute power corrupts absolutely.” This old adage is part of the reasoning behind not putting one person in charge of ordering, distributing, and verifying physical inventory in a warehouse or both approving new vendors and issuing payments to those vendors. This is the segregation of duties internal control.

Reconciliations

A reconciliation is the comparison of different systems’ or parties’ records of the same transaction. For instance, you may reconcile bank statements with internal company records to make sure they match up and verify accuracy.

Physical Controls

Locks, safes, key card entry, and security systems are all examples of physical controls an organization might utilize to secure its premises and assets.

Internal Reviews

Is the company on target with its goals and objectives? Do budget statements match up with expense reports and financial statements? Management might ask these types of questions during an internal review to ensure that strategies and priorities are aligned.

Organizational Policies

These are the procedures and policies that guide the practices and people within an enterprise. Think standard operating procedures, training manuals, and dress code (prior to Zoom meetings).

Information Controls

Information security controls exist to check the authorization, accuracy, and completeness of transactions and data entered into the system. Access to files, data, and programs is also managed with information controls.

COSO provides an internal control framework that is a flexible framework for designing, implementing, and evaluating effective internal controls.

The COSO Internal Control Framework was first developed in 1992 by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and underwent a significant overhaul in 2013. The current version of the framework consists of five components designed to guide organizations working in a complex global environment.

5 Internal Control Components of the COSO Framework

The five components of internal control in the COSO framework:

1. The Control Environment is the foundation of an organization’s internal control system. The control environment sets the tone for expectations and defines the importance of internal controls related to the company culture at large.
2. A Risk Assessment includes the measures taken to identify and prevent risk, both internally and externally, as well as the strategies to mitigate those risks.
3. Control Activities are the policies, procedures, and mechanisms implemented to make up the organization’s risk management process and strategy.
4. Information and Communication encompass the internally generated reports presented and delivered to both auditors and stakeholders during the monitoring phase. Insightful reporting and data inform the strategy behind the creation of control activities.
5. Monitoring assures that proper control activities are being implemented and used during day-to-day operations. Monitoring should be ongoing and regularly reviewed by management and the board of directors to verify the effectiveness of control activities and identify opportunities for improvement.

There are three types of internal controls: preventative, detective, and corrective:

1. Preventive controls are implemented before any specific adverse event happens, and their objective is to prevent errors and fraud from happening in the first place. For example, multi-factor authentication restricts user access to confidential data.
2. Detective controls are activated to identify errors that have occurred before they cause significant problems. The idea is to detect issues before financials are reported, or product has shipped. Examples include end-of-the-month reconciliations, physical inventory counts, audits, and any type of quality check.
3. Corrective controls are implemented after detective controls to rectify the problem and (ideally) prevent it from happening again. Example: implementing a new policy for prompt destruction of unnecessary data to prevent attackers from stealing it.

Using internal controls in auditing is a common practice to help ensure a company meets its objectives and goals. The seven internal control procedures below can support seamless audits, improve the reliability of financial reporting, and result in better business outcomes.

1. Access Controls for Accounting

   Utilize accounting controls to restrict access to your accounting system and financial information: password guidelines, lockouts, and access logs. These controls will prevent unauthorized access and misuse.

2. Standardization of Documents

   Create standardized documentation to govern financial transactions and encourage consistency in record keeping. This simple practice will make it easier to identify discrepancies in an audit and streamline work.

3. Internal Audits of Assets

   Have your internal auditors perform physical audits of assets tracked in your accounting system, such as inventory or cash, to ensure there are no discrepancies in account balances.

4. Separation of Duties

   Segregate duties related to bookkeeping, handling financial assets, reporting, and auditing to ensure individual integrity.

5. Accounting Systems Reconciliation

   Implement financial controls, i.e., reconciliations, to verify that accounting balances match balances in accounts held by other entities, such as financial institutions, lenders, and vendors.

6. Weekly Trial Balances

   Use trial balances to provide insight into the state of your accounting system and uncover discrepancies as soon as possible.

7. Approvals from Authorities

   Enlist a manager to supervise certain transactions and perform verifications to add a layer of accountability and prevent employees with malicious intent from making fraudulent transactions.

Businesses need to consider inherent risk, control risk, and residual risk when implementing internal controls as part of an enterprise risk management program.

Inherent risk

Inherent risk is the risk of an omission or material misstatement in a company’s financial reporting due to a cause outside of financial controls. For example, estimating the value of some exotic financial instrument during an acquisition is inherently risky because it relies on the judgment of executives and auditors.

Control risk

Control risk is the risk of material misstatement or omission because there wasn’t a relevant internal control in place to protect against the risk, or the internal control existed but failed to work.

For example, suppose company policy is that two executives must sign checks above $25,000. There is a control risk that accounting employees might overlook a check for $30,000 with only one signature and process the payment anyway.

Residual risk

Residual risk is the amount of risk that still exists after the implementation of internal controls, which management is willing to accept. In the previous example, there is a residual risk that a payment may still be fraudulent, even after two signatures. If the company isn’t willing to accept this risk, they need to implement a more rigorous internal control.

Simply implementing a system of internal controls and fraud prevention is not enough to protect against risk. Every business transaction an organization executes has a level of risk (low, medium, or high) that must be assessed and mitigated through internal controls.

As stated before, sometimes internal control weaknesses occur when systems are implemented that don’t adequately address all of the risks associated with a businesses’ transactions.

What Are 4 Types of Internal Controls Weaknesses?

Specifically, there are four primary internal control weaknesses that can compromise your data:

1. Technical internal control weakness due to hardware and software
2. Operational internal control weakness typically resulting from human error
3. Administrative internal control weakness dependent on policies and procedures
4. Architectural control weaknesses occur when IT systems are implemented and not adequately monitored

Malicious actors can exploit internal control weaknesses to evade what might appear to be strong security tactics. With so much complexity and innovation in modern business, constant monitoring is necessary to identify internal control weaknesses and neutralize existing or emerging threats.

COSO is the most widely used framework for internal controls, but others exist. For example, some organizations might decide to use the ISO 31000 standard or the COBIT framework (which focuses more on IT controls). Organizations should evaluate features and aspects from various frameworks to determine which one best suits them.

The Sarbanes-Oxley Act (SOX), also known as the Corporate Responsibility Act, was enacted by the U.S. Congress in 2002 in response to multiple significant corporate fraud incidents that had struck the U.S. capital markets.

It mandated extensive reforms to existing securities law and imposed much harsher penalties on executives and businesses that committed accounting fraud against investors.

How Does SOX Affect Internal Controls?

SOX imposed new compliance standards on corporate boards of directors and greater accountability for accurate and reliable financial reporting. It had a profound effect on how businesses develop, implement, and maintain effective internal control over financial reporting (ICFR), as well as on the audits of financial statements that all publicly traded businesses are required to publish.

What Are the Main Functions of SOX?

SOX has 11 main sections (“titles”) in total, but the most critical requirements for internal control exist within Sections 302 and 404. While both relate to internal controls, SOX 302 and SOX 404 differ in several ways.

In a nutshell, SOX 302 defines accountability requirements and a quarterly process for certification for financial statements. On the other hand, SOX 404 mandates explicitly that all publicly-traded companies must have documented internal controls, proof of day-to-day implementation, and ongoing monitoring to ensure effectiveness.

What Are Internal Controls over Financial Reporting?

Internal controls over financial reporting (ICFR) are the controls that specifically aid in the processing of financial transactions. SOX reporting helps reduce the number of errors in financial statements and can prevent or detect fraud within a company’s financial transactions.

To help ensure effective financial reporting, SOX requires large publicly traded firms to have an external audit of their ICFR every year; this is Section 404(b) of the law. Moreover, all publicly traded firms, regardless of size, must declare every year whether management believes ICFR is or isn’t effective; this requirement is in Section 404(a).

Internal controls are critical because they help the organization meet various obligations in operations, reporting, and regulatory compliance.

Obligations might come, for example, from regulators imposing standards for financial reporting and disclosures or rules for data protection. Requirements could come from the organization’s own board of directors as new operational directives and business objectives are developed. Some controls enable reporting and monitor changes.

How can internal control management software help my business?

Leveraging internal control management software can help to ensure that an organization’s internal control framework is robust, that controls are applied consistently, and that documentation of controls is transparent.

Additionally, software of this kind will help improve efficiency by increasing the effectiveness of operations and mitigating risk that could result in devastating consequences – financial or reputational.

What is Reciprocity’s Solution?

Reciprocity^® understands the challenge of managing the interrelated components of internal control such as risk assessments, documenting control procedures, ongoing testing, and reporting.

Instead of using spreadsheets to manage your compliance requirements, adopt the Reciprocity ROAR Platform to streamline evidence and audit management for all of your compliance frameworks. This frees up risk and compliance managers to focus on the big picture.

The Reciprocity ROAR Platform also automates the creation of insightful reporting and easy-to-read dashboards that can supply your management team and board of directors with the visibility they need to supervise the control environment properly.

With Reciprocity, your organization is always audit-ready. Its single source of truth allows you to quickly and easily gather any documentation auditors require. Procedures are revision-controlled and easy to find in the document repository. Workflow management offers easy tracking, automated reminders, and audit trails.

Reciprocity Solutions

The Reciprocity ROAR platform can help your organization:

• Provide the required documentation for an audit
• Map controls to various regulations and standards
• Comply with privacy regulations
• Manage third-party risk
• Quickly identify and respond to security incidents
• Automate routine compliance checks
• Safeguard your business through disaster recovery and business continuity planning

Hassle-free internal controls implementation and compliance is the Reciprocity way! For a free consultation and demo the Reciprocity ROAR Platform, contact us today.

Or download our Internal Controls Best Practices eBook.