Internal control, as defined in accounting and auditing, is a process for assuring achievement of an organization’s objectives in operational effectiveness and efficiency, reliable financial reporting, and compliance with laws, regulations and policies. A broad concept, internal control involves everything that controls risks to an organization.

It is a means by which an organization’s resources are directed, monitored, and measured. It plays an important role in detecting and preventing fraud and protecting the organization’s resources, both physical (e.g., machinery and property) and intangible (e.g., reputation or intellectual property such as trademarks).

Clerk conducting physical inventory count using a handheld computer in a Tesco Lotus supermarket in Sakon Nakhon, Thailand

At the organizational level, internal control objectives relate to the reliability of financial reporting, timely feedback on the achievement of operational or strategic goals, and compliance with laws and regulations. At the specific transaction level, internal control refers to the actions taken to achieve a specific objective (e.g., how to ensure the organization’s payments to third parties are for valid services rendered.) Internal control procedures reduce process variation, leading to more predictable outcomes. Internal control is a key element of the Foreign Corrupt Practices Act(FCPA) of 1977 and the Sarbanes–Oxley Act of 2002, which required improvements in internal control in United States public corporations. Internal controls within business entities are also referred to as operational controls.

Internal control plays an important role in the prevention and detection of fraud.  Under the Sarbanes-Oxley Act, companies are required to perform a fraud risk assessment and assess related controls. This typically involves identifying scenarios in which theft or loss could occur and determining if existing control procedures effectively manage the risk to an acceptable level. The risk that senior management might override important financial controls to manipulate financial reporting is also a key area of focus in fraud risk assessment. The AICPA, IIA, and ACFE also sponsored a guide published during 2008 that includes a framework for helping organizations manage their fraud risk.

Controls can be evaluated and improved to make a business operation run more effectively and efficiently. For example, automating controls that are manual in nature can save costs and improve transaction processing. If the internal control system is thought of by executives as only a means of preventing fraud and complying with laws and regulations, an important opportunity may be missed. Internal controls can also be used to systematically improve businesses, particularly in regard to effectiveness and efficiency.

Internal control

An effective internal control structure includes a company’s plan of organization and all the procedures and actions it takes to:

• Protect its assets against theft and waste.
• Ensure compliance with company policies and federal law.
• Evaluate the performance of all personnel to promote efficient operations.
• Ensure accurate and reliable operating data and accounting reports.

As you study the basic procedures and actions of an effective internal control structure, remember that even small companies can benefit from using some internal control measures. Preventing theft and waste is only a part of internal control.

In general terms, the purpose of internal control is to ensure the efficient operations of a business, thus enabling the business to effectively reach its goals.

Companies protect their assets by (1) segregating employee duties, (2) assigning specific duties to each employee, (3) rotating employee job assignments, and (4) using mechanical devices.

Unfortunately, even though a company implements all of these features in its internal control structure, theft may still occur. If employees are dishonest, they can usually figure out a way to steal from a company, thus circumventing even the most effective internal control structure. Therefore, companies should carry adequate casualty insurance on assets. This insurance reimburses the company for loss of a nonmonetary asset such as specialized equipment. Companies should also have fidelity bonds on employees handling cash and other negotiable instruments. These bonds ensure that a company is reimbursed for losses due to theft of cash and other monetary assets. With both casualty insurance on assets and fidelity bonds on employees, a company can recover at least a portion of any loss that occurs.

Internal Control Responsibility

Internal control is the general responsibility of all members in an organization. However, the following three groups have specific responsibilities regarding the internal control structure.

• Management holds ultimate responsibility for establishing and maintaining an effective internal control structure. Through leadership and example, management demonstrates ethical behavior and integrity within the company.
• The board of directors provides guidance to management. Because board members have a working knowledge of the functions of the company, they help shield the company from managers who try to override some control procedures for dishonest purposes. Often, an efficient board that has access to the company’s internal auditors can discover such fraud.
• Auditors within the organization evaluate the effectiveness of the internal control structure and determine whether company policies and procedures are being followed. All employees are part of a communications network that enables an internal control structure to work effectively.

Computer Controls

Computerized financial records require the same internal control principles of separation of duties and control over access as a manual accounting system. The exact control steps depend on whether a company is using mainframe computers and minicomputers or microcomputers.

In a personal computer environment, the following controls can be useful:

• Require computer users to have tight control over storage of programs and data. Just as one person maintains custody over a certain set of records in a manual system, in a computer system one person maintains custody over certain information (such as the accounts receivable subsidiary ledger). Make backup copies that are retained in a different secured location.
• Require passwords (kept secret) to gain entry into data files maintained on the hard disk.
• In situations where a local area network (LAN) links the personal computers into one system, permit only certain computers and persons in the network to have access to some data files (the accounting records, for example).

Computerized accounting systems do not lessen the need for internal control. In fact, access to a computer by an unauthorized person could result in significant theft in less time than with a manual system.