Internal Control

The idea is broader than preventing rule breaches. Controls help a business run efficiently, produce reliable information and stay within law, as well as protect assets from loss and fraud. They take many forms: approvals, reconciliations, access limits, automated system checks, reviews of performance and clear instructions. They can prevent a problem, detect it quickly, or correct it afterwards. The best-known description comes from the COSO framework, which names five linked components: the control environment, the way risks are assessed, control activities, the flow of information, and monitoring. Controls only ever give reasonable assurance, never absolute, because people make mistakes, can collude and can override them, and because cost has to be weighed against benefit. Internal control is a part of a wider risk management effort, not a separate subject. Whether goals are met and the figures can be trusted depends largely on how well these mechanisms are built and kept running.

At a distribution company, supplier payments run through a system where a clerk enters the invoice, a manager approves it, and the system matches it to a purchase order and goods receipt before releasing payment. Each step reduces a different risk, from wrong amounts to fake suppliers. A monthly review of unusual payments catches what the earlier steps miss.