Mechanisms, rules, procedures and checks
Internal controls refers to the mechanisms, rules, procedures and checks adopted and implemented by an entity to promote accountability, ensure integrity of financial and accounting information, prevent fraud and ensure regulatory compliance. They also help improve operational efficiency by identifying problems and correcting lapses before they are discovered by an external audit exercise.
Internal controls are typically comprised of control activities such as authorization, documentation, reconciliation, security, and the separation of duties. They are broadly divided into preventative and detective activities.
Components of Internal Controls
A company’s internal controls system should include the following components:
- Control environment: A control environment establishes for all employees the importance of integrity and a commitment to revealing and rooting out improprieties, including fraud. A board of directors and management create this environment and lead by example. Management must put into place the internal systems and personnel to facilitate the goals of internal controls.
- Risk Assessment: A company must regularly assess and identify the potential for, or existence of, risk or loss. Based on the findings of such assessments, added focus and levels of control might be implemented to ensure the containment of risk or to watch for risk in related areas.
- Monitor: A company must monitor its system of internal controls for ongoing viability. By doing so, it can ensure, whether through system updates, adding employees, or necessary employee training, the continued ability of internal controls to function as needed.
- Information/Communication: Solid information and consistent communication are important on two fronts. First, clarity of purpose and roles can set the stage for successful internal controls. Second, facilitating the understanding of and commitment to steps to take can help employees do their job most effectively.
- Control Activities: These pertain to the processes, policies, and other courses of action that maintain the integrity of internal controls and regulatory compliance. They involve preventative and detective activities.
Limitations of Internal Controls
Regardless of the policies and procedures established by an organization, internal controls can only provide reasonable assurance that a company’s financial information is correct.
The effectiveness of internal controls can be limited by human judgment. For example, a business may give high-level personnel the ability to override internal controls for operational efficiency reasons.
What’s more, internal controls can be circumvented through collusion, where employees whose work activities are normally separated by internal controls, work together in secret to conceal fraud or other misconduct.
