Internal controls are the practical controls that enable an organisation to manage its risk and achieve its objectives. They are embedded in the day-to-day running of the business to prevent errors, detect problems, and enable corrective action. You can have the best risk framework in the world, but it will be entirely theoretical without strong internal controls. For risk, finance, audit, and compliance teams, internal controls turn policy into practice.
For example, imagine a company where an AP clerk has accidentally entered a duplicate invoice for the same supplier. Thanks to the internal controls in place, the system will flag it as a duplicate and require a manager's approval before processing payment. That way, the error is caught before any money is actually lost. It's a perfect example of how internal controls work in the real world to prevent a costly error.
Financial and operational controls
Internal controls are generally either financial or operational. Financial controls protect assets and ensure accurate reports and reliable financial transactions. Examples include approval hierarchies, reconciliations, journal entry reviews, and account validation checks.
Operational controls keep business processes running smoothly and reliably. Examples include quality checks, service level monitoring, inventory counts, incident escalation, and customer verification. The distinction is useful, though in reality many of the controls will do both. A reconciliation is a good example of a control that serves both operational and financial functions.
Manual and automated controls
Controls can be manual or automated. Manual controls rely on people to review or act. Examples include supervisor approval, physical inspection, and exception review. Automated controls are built into the system and run automatically based on rules. Examples include access restrictions, workflow approvals, and system validation rules.
Automated controls are generally more consistent and can handle higher volumes, though they still require some oversight. Manual controls can be more flexible and can incorporate judgement, but are more prone to human error and inconsistency. They're typically used for high-volume, repetitive tasks where stability is important. Manual controls are better for more complex or atypical transactions that require judgement. Most organisations use a mix of both types of control, selecting the appropriate one based on the level of risk, transaction volume, and available resources.
IT overall controls
Information Technology General Controls (ITGCs) are controls that ensure technology systems are reliable, secure, and operating as intended. These are general processes and policies such as change control, access control, and backups. They are important because many business and financial controls rely on IT systems working correctly. If ITGCs are weak, it's difficult to have confidence in the data and automated processes that depend on IT systems.
- backup and recovery.
- Job scheduling.
- System development and implementation.
- Physical and logical security.
If ITGCs are weak, the organisation cannot rely on automated processes or reports. That's why IT controls are such an important element of the overall internal control system.
Segregation of duties
Segregation of duties (SoD) is a fundamental internal control principle. It makes sure that no one person has too much control over a transaction or process from start to finish.
For instance, one person shouldn't be able to create a vendor, approve a payment and then reconcile the bank account. If duties aren't segregated, the risk of error or fraud increases significantly.
This is especially relevant in finance, procurement, payroll, and treasury. Where segregation is not possible (for example, due to a lack of staff or resources), then compensating controls should be put in place to reduce the risk. Examples of such controls include increased supervision of transactions, regular management review of the work, and periodic internal audits to identify errors or irregularities.
Access controls
Access controls determine who can use the system, who can see the data, who can approve transactions and who can make changes. They are fundamental to ensuring the confidentiality, integrity and security of information. Good practice includes role-based access, regular reviews of user rights, strong authentication, and, of course, the rapid removal of inactive accounts.
Access controls remain critical in the digital world, where one wrong access can expose sensitive data or enable unauthorised transactions.
Reconciliations and reviews
Reconciliations are detective controls that ensure two sets of records agree. They're very common in banking, accounting, operations and treasury. Reviews are similar in that they involve checking reports, exceptions, and transactions for accuracy and completeness.
These controls are designed to help you find errors, missing items and odd activity. They work best when you do them quickly and properly check exceptions.
Design and effectiveness
A control is only of any use if it's well designed and consistently applied. Good design means the control targets the right risk, has a clear objective, and is practical to use. A good control will work as intended over time.
So many controls fail not because they are absent but because they are weak, poorly defined, inconsistently applied or not monitored at all. That's why testing and review are so vital. The two basic methods of testing controls are walkthroughs (where you walk through the process step by step to see how the control actually works in practice) and sample checks (where you take a sample of transactions and look at them to see evidence that the control is in fact working). Testing establishes whether controls are working and is the only way to identify gaps.
Closing perspective
Internal controls link risk administration and operational discipline. Financial, operational, manual, automated, and IT controls all play their part in constructing a robust and reliable organisation. Good controls are designed and maintained to protect value, enable compliance, and build trust.