Control Activities

In the COSO internal control framework, control activities are one of five components, alongside the control environment, risk assessment, information and communication, and monitoring. They are the day-to-day measures that put risk responses into practice. Examples include authorisations above a set value, reconciling an account to a statement, splitting duties so no one person handles a transaction from start to finish, physical safeguards for cash and stock, and reviews of performance against budget. Some sit inside business processes and some sit in technology. They can prevent a problem or detect it after the event. The mix chosen should fit the risk: a small, low-value process needs lighter controls than a large payments system. Reviewers match each identified risk to an actual activity and ask for evidence that it ran.

A hospital identifies a risk that supplies are ordered and received by the same person. It sets a control activity: orders above a set value need a second approver, and goods are checked in by a different staff member who compares them with the order. Each month the finance team reconciles stock records to a physical count and investigates differences.