Internal control principles

Internal control is the process an entity's board, management and staff put in place to give reasonable assurance that it achieves its objectives in three areas: operations (effective and efficient), reporting (reliable) and compliance (with laws and regulations). It is reasonable — not absolute — assurance, for the same reasons an audit can't be absolute.

The COSO Internal Control — Integrated Framework, refreshed in 2013, is the most widely used description. It has five components, supported by 17 principles:

1. Control environment — integrity and ethical values, board oversight, structure and authority, commitment to competence, accountability. The "tone at the top" on which everything else rests.
2. Risk assessment — setting objectives, identifying and analysing risks to them (including fraud risk), and assessing significant changes.
3. Control activities — the policies and procedures that respond to risks, including general controls over technology.
4. Information and communication — capturing relevant, quality information and communicating it internally and externally.
5. Monitoring activities — ongoing and separate evaluations, and communicating deficiencies to those who can fix them.

ISA 315 (Revised 2019) describes the entity's system of internal control with closely matching components: the control environment, the entity's risk assessment process, the entity's process to monitor the system of internal control, the information system and communication, and control activities.

Control activities come in recognisable types: authorisation and approval (a manager approves purchase orders above a limit), reconciliations (bank, supplier statements, sub-ledger to general ledger), verifications and matching (the three-way match of order, goods received note and invoice), physical and logical controls (locked stores, passwords, system access rights), and segregation of duties. Each is either preventive (stops a misstatement entering the records) or detective (finds and corrects one after it happens), and either manual or automated.

Automated controls are consistent, but only as reliable as the system around them. IT general controls — access security, program change management, and IT operations — keep application controls working as designed. If anyone can change the matching rules without approval, the automated match can't be relied on.

Every system has limitations: human error and misjudgement, collusion between people meant to check each other, management override, controls designed for routine transactions failing on unusual ones, and the cost of a control outweighing its benefit.