Internal Control, Governance, Ethics and Assurance

Introduction and Context

Internal control, governance, ethics and assurance are interconnected foundations of reliable financial management. Internal control concerns the mechanisms through which an organisation directs activities, protects resources, produces dependable information and manages risk. Governance concerns the distribution of authority, accountability and oversight among shareholders, the board, management and other stakeholders. Ethics determines whether decisions are morally and professionally defensible, while assurance provides confidence that information, processes and controls can be relied upon.

For a Chartered Finance Manager, these subjects are strategic rather than merely administrative. Weak controls can permit fraud, misstatement, regulatory breaches and inefficient use of capital. Weak governance can allow management dominance, conflicts of interest and excessive risk-taking. Ethical failure can undermine a technically compliant reporting system. Assurance, when properly designed, does not eliminate risk, but helps decision-makers understand whether controls and information are sufficiently reliable for their purposes.

The modern control environment also includes enterprise systems, cloud accounting, data analytics, artificial intelligence and cyber-risk. These technologies may strengthen monitoring and audit trails, but they can also accelerate errors, conceal manipulation at scale and create new confidentiality and accountability problems.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purposes and components of internal control.
2. Apply segregation of duties and control activities to business processes.
3. Evaluate governance structures, risk management and assurance arrangements.
4. Identify fraud risks, earnings-management practices and weaknesses in audit trails.
5. Resolve ethical dilemmas involving integrity, objectivity, confidentiality and professional competence.
6. Distinguish reasonable assurance from absolute assurance.
7. Recommend improvements to controls using a risk-based and professionally sceptical approach.

1. The Nature and Purpose of Internal Control

Internal control is a process effected by the board, management and employees, designed to provide reasonable—not absolute—assurance regarding achievement of objectives. Those objectives commonly fall into four categories:

• strategic objectives, such as sustainable growth and protection of reputation;
• operational objectives, such as efficiency, asset protection and service quality;
• reporting objectives, including reliable financial and non-financial information; and
• compliance objectives, including observance of laws, regulations and internal policies.

A control may be preventive, detective or corrective. A password and approval limit are preventive controls. A bank reconciliation is primarily detective. Restoring a corrupted database or correcting an unauthorised payment is corrective. Controls may also be manual, automated or hybrid.

Internal control has inherent limitations. Human judgement may be poor; employees may collude; management may override controls; cost may exceed benefit; and controls may become obsolete when systems, products or risks change. Consequently, a well-controlled organisation does not claim that fraud or error is impossible. It seeks to reduce risk to an acceptable level and to detect significant failures promptly.

The COSO Framework

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies five mutually reinforcing components:

The components operate as a system. A technically strong approval workflow may still fail if senior managers routinely override it. Conversely, a strong ethical culture cannot compensate indefinitely for absent reconciliations or uncontrolled system access.

The Three Lines Model

The Three Lines Model clarifies organisational responsibilities:

1. First line: operational management owns risks and operates controls.
2. Second line: risk, compliance, legal and similar functions provide expertise, monitoring and challenge.
3. Third line: internal audit provides independent and objective assurance to the governing body.

External audit, regulators and other independent assessors are outside the three internal lines but provide additional assurance to stakeholders. The model is not a rigid hierarchy. Its value lies in clarifying accountability and preventing internal audit from becoming responsible for operating the controls it later evaluates.

2. Control Design and Segregation of Duties

Segregation of duties (SoD) separates incompatible responsibilities so that one individual cannot independently initiate, authorise, record and conceal a transaction. The classic separation is among:

• custody of assets;
• authorisation of transactions;
• recording in accounting systems; and
• reconciliation or independent review.

For example, in the purchasing cycle, a requisitioner identifies a need, procurement obtains quotations, an authorised manager approves the purchase order, receiving staff confirm delivery, accounts payable verifies the invoice, and treasury releases payment. The bank reconciliation should be prepared or reviewed by someone independent of payment preparation.

SoD is a risk-reduction principle, not an inflexible requirement that every task be performed by a different person. Small organisations may have insufficient staff. Compensating controls can include owner review, independent monthly reconciliations, transaction alerts, restricted system access and surprise inspections.

Control Mapping

A useful control-design method is to connect each risk to an objective, control, evidence and responsible owner.

A control is well designed when it addresses a relevant risk, is performed by a competent person, occurs at an appropriate frequency, produces evidence and includes follow-up for exceptions. A control may exist on paper but be ineffective in operation if evidence is incomplete or deviations are ignored.

3. Risk Management and Control Evaluation

Risk management begins with identifying events that may affect objectives. A conventional risk assessment considers likelihood and impact, although more sophisticated systems also consider velocity, persistence, interdependence and control effectiveness.

An inherent risk exists before controls are considered. Residual risk is the exposure remaining after controls operate. A simple risk-prioritisation score can be expressed as:

Likelihood and impact scores are ordinal ratings, such as 1 to 5, rather than precise financial probabilities unless the organisation has defined them statistically. The multiplication is therefore a prioritisation device, not a law of probability. For example, a likelihood rating of 4 and an impact rating of 5 produces a prioritisation score of 20. The organisation must define what each rating means and should not compare scores generated under inconsistent scales.

A financial risk assessment may also estimate expected loss:

Here probability is expressed between 0 and 1, and monetary impact is measured in the relevant currency. The formula is most useful for repeated or reasonably estimable events. It is not sufficient for rare catastrophic events, reputational damage or situations where probabilities are highly uncertain.

Control evaluation should address both design and operating effectiveness:

• Design effectiveness: Would the control prevent or detect the relevant risk if performed as intended?
• Operating effectiveness: Did the control operate consistently, by an appropriately authorised and competent person, during the relevant period?

Testing may involve inspection, observation, inquiry, reperformance and analytical procedures. Inquiry alone is generally weak evidence because employees may describe intended practice rather than actual practice.

4. Fraud Prevention, Detection and Investigation

Fraud involves intentional deception for personal or organisational advantage. The fraud triangle identifies three common conditions:

• pressure or incentive;
• opportunity; and
• rationalisation.

A fourth dimension, capability, is often added in the fraud diamond because a person must possess the authority, skills or access needed to exploit an opportunity.

Fraud-risk indicators include unexplained margin changes, unusual round-dollar transactions, rapid growth in receivables, duplicate suppliers, unusual manual journals, related-party transactions lacking transparency, excessive management override and employees resisting leave or rotation.

Effective anti-fraud arrangements include:

1. a credible tone at the top;
2. background checks and conflict-of-interest declarations;
3. protected whistleblowing channels;
4. data analytics over payments, journals and access logs;
5. mandatory leave and job rotation in sensitive roles;
6. independent investigation protocols; and
7. disciplinary and remediation processes applied consistently.

A whistleblowing system is not effective merely because a hotline exists. Employees must believe that reports are confidential, retaliation will be addressed and allegations will be investigated by appropriately independent personnel.

Fraud investigation also requires evidence preservation. Investigators should document the source, time, integrity and custody of electronic records. Premature confrontation, uncontrolled access to devices or undocumented alterations can compromise evidence and legal proceedings.

5. Audit Trails and Information Systems

An audit trail is the trace linking an original transaction or event to its authorisation, processing, accounting entry, reporting output and subsequent amendment. A strong audit trail enables an independent reviewer to answer:

• Who initiated or changed the item?
• What was changed and when?
• Which approval was obtained?
• What source documents support it?
• How did it affect the ledger and financial statements?

Important controls include unique user identities, role-based access, immutable or protected logs, time synchronisation, version history, documented master-data changes, interface reconciliations and retention policies. Shared accounts weaken accountability and should generally be prohibited except where technically unavoidable and tightly monitored.

Technology changes the nature of control. Automated controls may apply rules consistently, but they depend on accurate configuration, reliable input data, change management and access security. A system-generated report is not automatically reliable; its completeness, logic and interface with source systems must be validated.

Artificial intelligence creates additional issues. An AI tool may produce a plausible but unsupported classification, recommendation or narrative. Financial professionals should assess data provenance, model governance, explainability, access rights, bias, confidentiality and human review. Accountability cannot be transferred to an algorithm. Where an AI-assisted decision affects financial reporting, the organisation should retain sufficient documentation to reproduce and challenge the result.

6. Corporate Governance and Accountability

Corporate governance is the system by which organisations are directed and controlled. Its central concerns include accountability, transparency, stewardship, strategic oversight and protection of stakeholder interests.

A sound governance structure normally includes:

• a board with an appropriate balance of executive, non-executive and independent members;
• an audit committee with financial literacy and sufficient authority;
• clear delegation of powers and reserved matters;
• oversight of risk, internal control and financial reporting;
• transparent related-party and conflict-of-interest procedures; and
• evaluation of board and committee effectiveness.

The board should not simply approve management’s proposals. It should ask whether assumptions are reasonable, incentives are distorting behaviour, risks are understood and information is complete. The audit committee should examine significant judgements, control deficiencies, unusual transactions, auditor independence and management responses to findings.

Governance codes differ across jurisdictions, but several principles are broadly transferable: accountability, fairness, transparency, responsibility and independent challenge. Compliance with a code is not a substitute for substantive governance. A board may satisfy formal composition requirements while failing to understand the organisation’s business model or culture.

7. Ethics and Professional Judgement

Professional ethics governs conduct where rules alone do not determine the correct action. Core principles commonly include:

• Integrity: being straightforward and honest;
• Objectivity: avoiding bias, conflicts of interest and undue influence;
• Professional competence and due care: maintaining knowledge and acting diligently;
• Confidentiality: protecting information and using it only for legitimate purposes; and
• Professional behaviour: complying with laws and avoiding conduct that discredits the profession.

Ethical reasoning should begin by identifying affected stakeholders, relevant facts, duties, conflicts, consequences and available safeguards. The following sequence is useful:

1. Clarify the accounting, control or reporting issue.
2. Identify the applicable law, professional code and organisational policy.
3. Determine who may be harmed and who benefits.
4. Identify threats to integrity, objectivity, confidentiality or competence.
5. Evaluate safeguards and whether escalation is required.
6. Document the reasoning and decision.
7. Reassess if new evidence emerges.

Common threats include self-interest, self-review, advocacy, familiarity and intimidation. For example, a finance manager who designed a forecasting model may face a self-review threat when asked to provide independent assurance over that model. Safeguards may include independent review, rotation, disclosure, removal from the engagement or escalation to the audit committee.

Confidentiality does not justify concealing unlawful conduct. Disclosure may be required by law, regulation or professional duty. The professional should disclose only necessary information, use authorised channels and seek legal or professional advice when uncertain.

8. Earnings Management and Reporting Integrity

Earnings management involves using judgement in financial reporting to influence reported results, while remaining within or approaching the boundaries of accounting rules. It differs from fraudulent reporting, which involves intentional misstatement or omission that violates applicable requirements. The distinction may be legally important but does not make aggressive manipulation ethically acceptable.

Examples include:

• accelerating revenue recognition without satisfying recognition criteria;
• delaying expense recognition or impairment recognition;
• changing useful lives or residual values without persuasive evidence;
• creating excessive provisions in a strong year and releasing them later;
• structuring transactions to achieve a desired presentation; and
• selectively excluding recurring costs from performance measures.

Not every estimate change is manipulation. Estimates legitimately change when new information becomes available. The key questions are whether the assumption is supportable, consistently applied, transparently disclosed and free from pressure to achieve a target.

A finance manager confronted with earnings pressure should request evidence, challenge unsupported assumptions, document discussions, consult technical specialists and escalate unresolved disagreements. Altering records, backdating approvals or omitting material information is unacceptable even if the immediate objective is to protect employment or meet market expectations.

9. Assurance Principles

Assurance is an engagement in which a practitioner evaluates evidence against suitable criteria and expresses a conclusion intended to enhance the confidence of users other than the responsible party. The elements are:

• a three-party relationship involving practitioner, responsible party and intended users;
• a subject matter, such as financial statements or controls;
• suitable criteria, such as accounting standards or a control framework;
• sufficient appropriate evidence; and
• a written conclusion or report.

Reasonable assurance provides a high, but not absolute, level of assurance and commonly results in positive wording, such as an opinion that information presents fairly. Limited assurance provides a lower level of assurance and commonly uses negative wording, such as nothing having come to the practitioner’s attention indicating material misstatement.

Assurance risk arises because the subject matter may be misstated, evidence may be incomplete and the practitioner may reach an inappropriate conclusion. Professional scepticism requires a questioning mind and critical assessment of evidence, particularly where evidence is inconsistent or obtained from interested parties.

Internal audit generally provides independent assurance and advisory services within the organisation. External audit provides an independent opinion on financial statements under applicable auditing standards. Neither function guarantees future viability, detects every fraud or substitutes for management’s responsibility to operate controls.

10. Applied Case: Meridian Components Ltd

Background

Meridian Components Ltd, an illustrative manufacturing company, experienced rapid growth. Its chief executive promised lenders that annual operating profit would exceed a contractual threshold. Near year-end, the sales director instructed staff to invoice distributors for goods that remained in Meridian’s warehouse under informal return arrangements. The finance manager was also asked to postpone a maintenance expense until the following year.

The company’s enterprise system allowed the sales director to create customers, approve credit limits and initiate invoices. The warehouse system was not integrated with the ledger, and the monthly reconciliation was prepared by an accounts assistant who reported to the sales director. Several senior employees shared a system administrator account.

Problem

The arrangements created risks of premature revenue recognition, fictitious or unsupported receivables, expense misstatement, management override, weak audit trails and lender deception. They also created ethical threats to the finance manager’s integrity and objectivity.

Analysis

The control environment was weak because performance pressure dominated reporting integrity. SoD was inadequate: customer creation, credit approval and invoicing were concentrated in one function. The absence of an independent warehouse-to-ledger reconciliation weakened evidence of delivery and inventory existence. Shared administrator credentials prevented reliable attribution of system changes.

The proposed accounting treatment required examination of the applicable revenue-recognition criteria, including whether control had transferred and whether the return arrangement created a substantive right of return. The maintenance expense should be recognised in the period in which the obligation and service occurred, subject to the applicable reporting framework. Management’s desired result was not evidence of an accounting conclusion.

Approach and Solution

The finance manager should:

1. suspend unsupported entries pending technical review;
2. obtain contracts, dispatch records, customer confirmations and return terms;
3. document the accounting analysis and communicate it to the chief financial officer and audit committee;
4. establish independent credit approval and separate customer-master maintenance from invoicing;
5. integrate or reconcile warehouse, sales and general-ledger records;
6. replace shared accounts with named credentials and protected logs;
7. require independent review of year-end cut-off and unusual journals; and
8. escalate any attempt to conceal material information through appropriate governance, regulatory or legal channels.

Outcome

Following investigation, unsupported invoices were reversed, the expense was recorded in the correct period and the lender received corrected information. The board commissioned a control remediation programme and introduced quarterly reporting on control exceptions. The finance manager’s documented analysis protected both the organisation and professional integrity.

Learning Points

The case illustrates that ethical reporting depends on governance, evidence and control design. A technically knowledgeable finance professional must resist pressure, but the organisation must also provide independent escalation channels and ensure that incentives do not reward misstatement. Revenue recognition, system access and audit trails are interconnected rather than isolated technical issues.

11. Limitations and Contemporary Challenges

Internal control frameworks can become compliance exercises. Excessive controls may slow legitimate decisions, encourage workarounds and obscure important risks. Risk registers can create false precision when ratings are subjective. Internal audit may lose independence if it becomes responsible for designing or operating controls. External assurance may be constrained by sampling, time, management estimates and the quality of available evidence.

Contemporary risks include cyberattacks, ransomware, third-party technology providers, remote working, supply-chain disruption, privacy breaches and automated decision systems. Organisations should therefore review controls after major system changes, acquisitions, restructurings or incidents rather than relying solely on an annual cycle.

Best practice is risk-based and proportionate. It combines clear accountability, competent personnel, reliable data, independent challenge, protected reporting channels, documented evidence and timely remediation. Boards should focus not only on whether controls exist, but whether people understand, value and consistently apply them.

Chapter Summary

Internal control provides reasonable assurance over operations, reporting and compliance, but cannot eliminate uncertainty, collusion or management override. The COSO components—control environment, risk assessment, control activities, information and communication, and monitoring—must operate together. Segregation of duties reduces opportunities for error and fraud, while compensating controls are necessary where staffing is limited.

Governance establishes accountability and independent oversight. Risk management connects objectives, threats, controls and residual exposure. Fraud prevention depends on ethical culture, access restrictions, analytics, protected reporting and credible investigation. Reliable audit trails require attributable user identities, protected logs, source documentation and disciplined change management.

Ethical practice requires integrity, objectivity, confidentiality, competence and professional behaviour. Earnings management may exploit legitimate judgement but becomes unethical when assumptions are unsupported or information is deliberately concealed. Assurance enhances user confidence through evidence and suitable criteria; reasonable assurance is high but not absolute. Effective finance managers integrate control design, governance, ethical judgement and assurance into strategic decision-making.

Key Terms

Internal control: A process designed to provide reasonable assurance regarding organisational objectives.

Control environment: The culture, authority structures and accountability conditions influencing controls.

Risk assessment: Identification and evaluation of events that may prevent objectives being achieved.

Control activity: An action designed to prevent or detect a risk.

Segregation of duties: Separation of incompatible responsibilities among different people or functions.

Compensating control: An alternative control used when an ideal control cannot operate.

Residual risk: Risk remaining after controls are applied.

Management override: Deliberate circumvention of established controls by authorised managers.

Audit trail: Evidence linking a transaction from initiation through processing, reporting and amendment.

Fraud triangle: Pressure, opportunity and rationalisation as conditions associated with fraud.

Governance: The system by which an organisation is directed and controlled.

Audit committee: A board committee overseeing financial reporting, control and assurance matters.

Professional scepticism: A questioning mindset and critical evaluation of evidence.

Reasonable assurance: A high, but not absolute, level of assurance.

Limited assurance: A lower level of assurance than reasonable assurance.

Integrity: Being straightforward and honest in professional relationships.

Objectivity: Exercising judgement without bias, conflicts or undue influence.

Earnings management: Use of reporting judgement to influence reported performance.

Management letter: A communication describing control deficiencies and recommendations.

Three Lines Model: A model distinguishing operational ownership, risk oversight and independent internal audit.

Review Questions

Short Answer Questions

1. What are the five components of the COSO internal-control framework?
2. Explain the purpose of segregation of duties.
3. Distinguish inherent risk from residual risk.
4. What is the difference between reasonable and limited assurance?
5. Identify the five fundamental ethical principles relevant to finance professionals.

Long Answer Questions

1. Critically evaluate the usefulness and limitations of the COSO framework in a technology-intensive organisation.
2. Explain how governance structures and audit committees contribute to reliable financial reporting.
3. Discuss the relationship between fraud risk, management override and organisational culture.
4. Analyse the ethical and accounting implications of aggressive earnings management.
5. Explain how an organisation can design a reliable audit trail across integrated financial and operational systems.

Analytical / Application Questions

1. A procurement manager can create suppliers, approve purchase orders and release payments. Identify the risks, propose a revised division of duties and recommend compensating controls for a small organisation.
2. A chief financial officer asks you to defer a significant expense so that a debt covenant is met. Apply an ethical decision process and specify the evidence, escalation and reporting steps you would take.
3. An AI system automatically flags transactions as low risk, but its training data exclude several historical fraud cases. Evaluate the control weakness and design a governance and assurance response.

Multiple Choice Questions with Answers

Question 1

Which COSO component concerns the organisation’s tone, authority and accountability structures?

A. Control environment

B. Risk assessment

C. Monitoring activities

D. Information and communication

Correct Answer: A. Control environment

Question 2

Which combination most directly represents segregation of duties?

A. One employee initiates, approves, records and reconciles a payment

B. The same manager reviews all transactions and controls the bank account

C. Different people authorise payments, record them and perform the bank reconciliation

D. All employees use one shared administrator account

Correct Answer: C. Different people authorise payments, record them and perform the bank reconciliation

Question 3

A risk has a likelihood score of 4 and an impact score of 5. Using the chapter’s prioritisation method, what is the risk score?

A. 9

B. 20

C. 25

D. 45

Correct Answer: B. 20

Question 4

Which statement best describes residual risk?

A. Risk before any controls are considered

B. Risk eliminated completely by internal audit

C. Risk remaining after controls are applied

D. Risk that exists only in external audits

Correct Answer: C. Risk remaining after controls are applied

Question 5

Which condition is most directly associated with the fraud triangle?

A. Pressure, opportunity and rationalisation

B. Planning, budgeting and forecasting

C. Authority, liquidity and profitability

D. Independence, competence and confidentiality

Correct Answer: A. Pressure, opportunity and rationalisation

Question 6

What is a principal weakness of shared system administrator accounts?

A. They increase segregation of duties

B. They prevent management override

C. They make individual accountability and audit trails difficult

D. They guarantee data confidentiality

Correct Answer: C. They make individual accountability and audit trails difficult

Question 7

Which ethical principle requires a finance professional to avoid bias and conflicts of interest?

A. Confidentiality

B. Objectivity

C. Professional behaviour

D. Competence

Correct Answer: B. Objectivity

Question 8

Which statement about reasonable assurance is correct?

A. It guarantees that all fraud will be detected

B. It provides a high but not absolute level of assurance

C. It is weaker than limited assurance

D. It requires no evaluation of evidence

Correct Answer: B. It provides a high but not absolute level of assurance

Question 9

Which activity is generally a third-line responsibility in the Three Lines Model?

A. Operating sales controls

B. Maintaining the supplier master file

C. Providing independent internal-audit assurance

D. Approving purchase orders

Correct Answer: C. Providing independent internal-audit assurance

Question 10

A manager proposes recording revenue before delivery solely to meet a target. What is the most appropriate initial response?

A. Record it because management approved the target

B. Delete the transaction from the system without documentation

C. Assess the applicable recognition criteria and obtain supporting evidence

D. Postpone the issue until the external audit begins

Correct Answer: C. Assess the applicable recognition criteria and obtain supporting evidence