Glossary term
Control Environment
Subject: Risk Management, Controls and Risk Treatment
The control environment is the set of standards, structures, behaviour and attitudes that shape how seriously an organisation takes internal control, from board oversight to the tone set by senior management.
Explanation
In the COSO internal control framework the control environment is the foundation on which the other four components rest. It covers the commitment to integrity and ethical values, independence and oversight by the board, the organisation chart with clear reporting lines and authority, the way the organisation attracts and develops competent people, and how it holds individuals to account for their control duties. Pay and targets matter as well, since incentives that reward results at any cost undermine it. It is hard to measure directly, so assessors look at evidence such as how breaches are treated, whether managers override controls, and what staff say in culture surveys. Staff copy what leaders tolerate, so a soft environment quietly cancels well-drafted procedures.
Example
A company has detailed approval procedures, but the sales director regularly asks finance to book deals early to hit quarterly targets, and nobody is disciplined. Staff learn that targets outrank rules. The assessor's report says the procedures are sound but that senior leaders have taught staff to ignore them.
Not to be confused with
- Control Activities
- Activities are the specific checks within processes. The environment is the wider culture and structure that decides whether those checks are respected.