Internal controls
Also called internal control system, internal control framework
Internal controls are the policies, procedures, checks and systems a firm uses to make sure its operations run as intended, its reporting is reliable and it complies with laws and regulations. They include payment approvals, reconciliations, segregation of duties, access rights and automated system checks.
How it works
Controls are designed against specific risks. Preventive controls stop a problem happening, such as dual approval of payments or system limits. Detective controls find problems after the event, such as reconciliations and exception reports. Controls can be manual or automated, and most firms map them to risks in a risk and control matrix, often following the COSO framework of control environment, risk assessment, control activities, information and monitoring.
The first line runs the controls day to day, the second line sets standards and challenges them, and internal audit tests whether they work. Testing looks at design, whether the control would address the risk, and operating effectiveness, whether it worked in practice over a period. Failures are logged as issues with owners and deadlines, and boards report on control effectiveness to shareholders and regulators.
The rules
Sets principles for board and management oversight, control culture, risk assessment, control activities, segregation of duties, information and monitoring.
Banks and their supervisorsRequires management to report annually on the effectiveness of internal control over financial reporting, with auditor attestation for larger filers.
Companies with securities registered with the SEC and their auditorsRequires robust governance arrangements, including effective processes to manage risks and adequate internal control mechanisms with sound administrative and accounting procedures.
Credit institutions and investment firms in scope of the CRDRequires boards to declare whether their material controls, financial, operational, reporting and compliance, were effective at the balance sheet date and to describe any that were not.
Companies with a premium or equity shares listing, on a comply or explain basisCommon questions
What are the main types of internal controls?
Preventive controls stop errors or fraud before they happen, detective controls find them afterwards, and corrective controls fix the cause. Each can be manual, automated or a mix of both.
Who is responsible for internal controls?
The board is accountable for the control framework. Business management runs the controls, risk and compliance functions set standards and challenge them, and internal audit gives independent assurance.
What is a control deficiency?
A control deficiency is a control that is missing, badly designed or not operating as intended. Serious deficiencies over financial reporting are called material weaknesses and must be disclosed under SOX.
