Internal Control and Enterprise Risk Management

Introduction

Accounting information systems (AIS) process transactions, maintain accounting records, support reporting, and provide information for managerial and external decision-making. Their value depends not only on accurate software and reliable databases, but also on the controls and governance processes surrounding them. Weak controls can permit errors, fraud, data loss, regulatory violations, and misleading financial statements. Effective control, by contrast, provides reasonable—not absolute—assurance that an organisation will achieve its objectives.

This chapter applies the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control—Integrated Framework and COSO Enterprise Risk Management (ERM)—Integrating with Strategy and Performance framework. The discussion connects these frameworks with AIS design, fraud risk management, control testing, and practical risk responses.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain the purpose and limitations of internal control.
2. Describe the five components of the COSO Internal Control framework.
3. Explain the relationship between risk, objectives, controls, and assurance.
4. Apply the COSO ERM framework to identify and respond to risk.
5. Distinguish preventive, detective, and corrective controls.
6. Design controls for common AIS and financial-reporting risks.
7. Assess control design and operating effectiveness.
8. Identify fraud risks and recommend appropriate responses.
9. Evaluate governance, ethical, technological, and regulatory implications of control decisions.

1. Internal Control in an Accounting Information System

Internal control is a process, effected by an entity’s board, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance. This definition emphasizes several important ideas.

First, control is a process rather than a single policy or device. A password, approval signature, or reconciliation is only one element of a wider process. Second, control is carried out by people. Technology can enforce rules, but people design, operate, review, and override systems. Third, control provides reasonable assurance. No control system can eliminate all risk because of human error, collusion, management override, changing circumstances, and cost constraints.

Internal control objectives generally fall into three categories:

A sound control objective should be specific enough to guide design. For example, “protect assets” is broad, whereas “only authorised employees may approve electronic supplier payments” is operational and testable.

Information quality and control

AIS controls support information quality through the attributes below:

• Validity: recorded transactions actually occurred and are authorised.
• Completeness: all valid transactions are captured.
• Accuracy: amounts, classifications, dates, and calculations are correct.
• Timeliness: information is recorded and reported when needed.
• Accessibility: authorised users can obtain information efficiently.
• Confidentiality: information is protected from unauthorised disclosure.
• Integrity: data remains complete and unaltered except through authorised processes.

A control can improve one attribute while creating a cost or usability burden elsewhere. For instance, highly restrictive access may increase security but reduce operational efficiency. Control design therefore requires a risk-based balance rather than unlimited restriction.

2. The COSO Internal Control Framework

The COSO framework consists of five interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring activities. The components apply across the organisation, including manual processes, applications, infrastructure, outsourced services, and management reporting.

2.1 Control environment

The control environment establishes the organisation’s culture and expectations. It is sometimes described as the “tone at the top,” although the behaviour of middle managers and supervisors is equally important. Major principles include:

• commitment to integrity and ethical values;
• board independence and effective oversight;
• clear authority, responsibility, and accountability;
• recruitment and retention of competent personnel; and
• enforcement of accountability for control responsibilities.

In an AIS, a strong environment is demonstrated when managers follow approval rules themselves, investigate unusual transactions, protect whistle-blowers, and avoid rewarding employees solely for short-term results. A written code of ethics is useful, but it is ineffective if senior personnel disregard it.

2.2 Risk assessment

Risk assessment is the process of identifying and analysing risks that could prevent objectives from being achieved. It includes consideration of changes in regulation, technology, personnel, suppliers, business models, and fraud methods.

A useful risk statement identifies the event, its cause, and its effect. For example:

Because supplier master-file changes are not independently reviewed, an employee could create a fictitious supplier and divert payments, causing financial loss and misstated expenses.

Risk analysis commonly considers likelihood and impact. Organisations may use qualitative ratings such as low, medium, and high, or numerical scales. A simple inherent-risk score may be represented as:

Likelihood and impact are ordinal ratings, such as 1 to 5, rather than monetary units. The multiplication is a prioritisation convention, not a precise probability calculation. It should not be interpreted as an expected loss unless likelihood is expressed as a probability and impact is expressed in monetary or other measurable units.

Where probability and loss can be estimated, an expected-loss model may be used:

where p is the probability of the event during the specified period and L is the loss if the event occurs. The model assumes that the probability and loss estimate are meaningful and that the event definition and time period are clear. It may be unsuitable for rare events, interdependent risks, or impacts that are difficult to quantify, such as reputational damage.

2.3 Control activities

Control activities are actions established through policies and procedures to reduce risks. They may be manual, automated, or hybrid. Examples include approvals, authorisations, verifications, reconciliations, segregation of duties, physical safeguards, exception reports, and system configuration controls.

Control activities should be linked explicitly to risks. A control that does not address a defined risk may add cost without providing useful assurance.

2.4 Information and communication

Relevant, reliable information must be identified, captured, processed, and communicated in a timely form. Communication operates vertically, horizontally, and externally. Employees should know their responsibilities, managers should receive meaningful exception information, and significant control failures should reach those with authority to act.

AIS design affects communication through dashboards, workflow alerts, audit trails, role-based reporting, and escalation procedures. A report containing thousands of exceptions may be technically complete but practically ineffective if users cannot identify the important items.

2.5 Monitoring activities

Monitoring determines whether controls continue to operate as intended. It includes ongoing monitoring built into routine operations and separate evaluations such as internal audit reviews. Deficiencies should be communicated to responsible managers and, when significant, to senior management or the board.

Monitoring differs from merely performing a control. For example, a monthly bank reconciliation is a control activity. An internal audit review that tests whether reconciliations are prepared, reviewed, and followed up is a monitoring activity.

3. Enterprise Risk Management under COSO

Internal control focuses substantially on objectives and controls within the organisation. ERM provides a broader, integrated approach that connects risk with strategy and performance. COSO ERM is organised around five interrelated components:

1. Governance and culture
2. Strategy and objective-setting
3. Performance
4. Review and revision
5. Information, communication, and reporting

ERM recognises that risk is not solely a threat. Some uncertainty creates opportunities, such as adopting a new digital platform, entering a market, or offering electronic payment services. The organisation must understand both downside exposure and the possibility of value creation.

Governance and culture

The governing body oversees risk, defines responsibilities, and establishes expectations about ethical conduct. Culture influences whether employees report problems early or conceal them. Incentive systems, performance targets, disciplinary practices, and management responses to bad news are important cultural indicators.

Strategy and objective-setting

Risk should be considered when selecting and implementing strategy. Objectives must be sufficiently clear to support risk identification. A company pursuing rapid growth, for example, may accept more credit and cyber risk than a company pursuing stability, but it still needs defined boundaries.

A risk appetite states the types and amount of risk an organisation is willing to accept in pursuit of objectives. Risk tolerance translates appetite into acceptable variation for particular objectives or measures.

Performance

Performance activities identify, assess, prioritise, and respond to risks. Responses typically include:

• Avoid: discontinue the activity creating unacceptable exposure.
• Reduce: implement controls to lower likelihood or impact.
• Share: transfer or distribute exposure, for example through insurance or contractual arrangements.
• Accept: retain the risk within approved tolerance.
• Pursue: increase exposure to capture an opportunity, subject to governance.

Residual risk is the risk remaining after controls or other responses. It should be compared with risk tolerance, not simply described as “low” without explanation.

Review and revision

Risk profiles change. New software, acquisitions, staff turnover, cyber threats, economic conditions, and regulatory changes may make existing controls ineffective. ERM therefore requires periodic review and adjustment.

Information, communication, and reporting

Risk information should reach the people responsible for decisions. Reports should explain the risk, owner, response, current exposure, trend, and required action. Reporting should not conceal uncertainty by presenting estimates as facts.

4. Designing Effective Controls

Preventive, detective, and corrective controls

The categories are not mutually exclusive. A user-access review may detect inappropriate access, while removal of access is corrective. A well-designed process often combines all three types.

Segregation of duties

Segregation of duties divides incompatible responsibilities among different people. The classic functions are:

1. authorising transactions;
2. recording transactions;
3. maintaining custody of assets; and
4. reconciling or reviewing results.

For example, the employee who creates a supplier should not independently approve invoices and release payments. In small organisations, complete segregation may be impossible. Compensating controls can include owner review, independent bank-statement delivery, transaction thresholds, and detailed exception reporting.

General IT controls and application controls

General IT controls support the reliable operation of systems. They include user administration, change management, backup and recovery, incident management, physical security, and system-development controls.

Application controls operate within particular applications. Examples include completeness checks on sequential invoices, validity checks on account codes, duplicate-invoice detection, three-way matching, automated approval limits, and interface reconciliations.

A strong application control may still be unreliable if general IT controls are weak. For example, an automated approval rule cannot be trusted if unauthorised users can alter the application code or configuration.

Control design principles

Effective control design should address the following questions:

1. What objective is being protected?
2. What specific risk threatens that objective?
3. What is the control owner responsible for doing?
4. When and how often does the control operate?
5. What evidence demonstrates performance?
6. What happens when an exception is identified?
7. Can the control be bypassed, overridden, or defeated through collusion?
8. Is the cost proportionate to the risk?

A control should be precise enough to detect a meaningful problem. “Manager reviews report” is weak documentation. “The finance manager reviews all payments above the approved threshold against supporting invoices and documents resolution of exceptions before the weekly payment file is released” is more testable.

5. Fraud Risk Management

Fraud is an intentional act involving deception to obtain an unauthorised or illegal benefit. The fraud triangle identifies three common conditions:

• Pressure or incentive: financial difficulties, targets, or personal needs;
• Opportunity: weak controls, excessive access, or inadequate oversight; and
• Rationalisation: justification such as “I am only borrowing the money.”

A fourth perspective, sometimes called the fraud diamond, adds capability: the perpetrator must possess the knowledge, authority, or confidence to exploit the opportunity.

Common AIS fraud schemes include fictitious suppliers, unauthorised payroll changes, duplicate payments, revenue manipulation, false expense claims, inventory theft, phishing, and alteration of accounting data. Fraud risk assessment should consider both internal and external perpetrators.

Fraud responses include:

• strong ethical leadership and confidential reporting channels;
• background checks appropriate to the role and law;
• segregation of duties and least-privilege access;
• independent review of master-file changes;
• data analytics for duplicate, unusual, or round-dollar transactions;
• mandatory leave and job rotation where appropriate;
• prompt investigation and evidence preservation; and
• consistent disciplinary and legal responses.

Controls should not assume that fraud will be obvious. A transaction may be correctly formatted, approved, and posted while still being fraudulent if the approver colludes with the preparer. Analytical review, independent confirmation, surprise procedures, and whistle-blower information can therefore complement routine controls.

6. Assessing Control Effectiveness

Control assessment has two distinct dimensions:

• Design effectiveness: whether the control, if operated as described, addresses the relevant risk.
• Operating effectiveness: whether the control actually operated consistently, by a competent person, at the required time, and with appropriate evidence.

A control may be well designed but not operating. Conversely, a diligent employee may detect problems through an informal practice even though the formal control design is inadequate.

Walkthroughs and testing

A walkthrough follows a transaction from initiation through recording, reporting, and retention of evidence. It helps the reviewer understand process flow, identify control points, and verify whether documentation reflects actual practice.

Tests of controls may include:

• inspection of approvals, logs, and reconciliations;
• observation of a control being performed;
• inquiry, supported by other evidence;
• reperformance of a reconciliation or calculation; and
• examination of system configurations and access records.

Inquiry alone usually provides weaker evidence than inspection or reperformance because personnel may misunderstand or misrepresent their activities.

Deficiencies and assurance

A deficiency exists when a control is missing, poorly designed, or not operating effectively. Deficiencies should be evaluated individually and in combination. The evaluation considers likelihood, magnitude, duration, compensating controls, and whether the deficiency affects operations, compliance, or financial reporting.

The objective is not to prove that no error has occurred. It is to determine whether the system provides reasonable assurance and whether identified deficiencies require remediation or escalation.

7. Worked Application: Supplier Payments

Assume a company processes 4,000 supplier invoices each month. The procurement system automatically matches purchase orders, goods-received records, and invoices. However, supplier bank details are maintained in a separate spreadsheet by the accounts-payable supervisor. Payment files are uploaded by the same supervisor, and the finance manager reviews only the total payment amount.

Risk identification

The principal risk is that an unauthorised or fraudulent change to supplier bank details could divert payments. Contributing conditions include spreadsheet-based master data, excessive access, lack of independent review, and approval based only on an aggregate total.

Control analysis

The existing three-way match reduces the risk of paying for goods not ordered or received, but it does not address diversion through changed bank details. The total-value review may detect an unusually large payment but may not detect a normal-sized payment sent to a fraudulent account.

Proposed response

A stronger control design would:

1. restrict supplier-master maintenance to authorised personnel;
2. require independent approval for new suppliers and bank-detail changes;
3. validate changes through a trusted callback or independent confirmation;
4. prevent the person who changes bank details from releasing the related payment;
5. generate a daily report of changes for review;
6. use system-controlled audit logs that cannot be altered by ordinary users; and
7. perform periodic supplier-bank reconciliations and data analytics.

The control objective is not merely “review suppliers.” It is “ensure that supplier identity and payment details are valid, authorised, independently reviewed, and protected from unauthorised change.”

Testing approach

A reviewer could select a sample of bank-detail changes, inspect evidence of independent confirmation, compare access rights with job responsibilities, reperform the segregation-of-duties analysis, and examine payment files for transactions released by unauthorised users. The reviewer should also inspect whether exceptions were resolved before payment.

Professional conclusion

The proposed controls reduce likelihood but do not eliminate risk. Collusion, compromised credentials, social engineering, and errors in independent confirmation remain possible. Management should therefore combine preventive controls with detective analytics and a documented incident-response process.

8. Illustrative Case Study: Northstar Retail Ltd.

This is a fictional illustrative case.

Background

Northstar Retail Ltd. operates 35 stores and an online sales platform. It recently introduced cloud-based enterprise resource planning software. Store managers can create customer refunds, while the central finance team records sales and performs monthly reconciliations. Management rewards stores for high sales and low reported returns.

Problem

Internal audit identified a sharp increase in refunds just below the approval threshold. Several refunds were issued to dormant customer accounts, and one employee’s credentials were used outside normal working hours. Management initially concluded that the issue was isolated because the system’s access-control report showed no failed login attempts.

Analysis

The control environment created pressure to report strong sales and low returns. The approval threshold created an opportunity to split or structure transactions. The absence of failed logins did not prove that the credentials were used by the authorised employee; stolen credentials or shared passwords could produce successful logins. Monitoring focused on access failures rather than transaction behaviour.

Relevant risks were:

• fictitious or unauthorised refunds;
• manipulation of performance measures;
• inappropriate sharing or compromise of credentials;
• incomplete investigation of unusual transactions; and
• inaccurate revenue and customer-liability reporting.

Approach and solution

Northstar revised its controls by:

• requiring multifactor authentication for refund-authorising roles;
• prohibiting shared accounts and reviewing user activity by individual;
• using analytics to identify unusual timing, dormant accounts, repeated amounts, and refunds just below thresholds;
• requiring independent review of high-risk refund patterns rather than relying only on value thresholds;
• separating store refund initiation from central refund approval;
• revising performance measures so managers were not penalised for legitimate returns;
• establishing a confidential reporting channel; and
• conducting targeted investigations with preserved system logs.

Outcome

The revised process identified several improper refunds and one policy violation. The organisation recovered part of the loss, disciplined responsible employees, and improved the design of its performance incentives. More importantly, management recognised that fraud risk assessment must consider behaviour, culture, and incentives—not only technical access failures.

Learning points

1. A control can operate exactly as configured and still be poorly designed.
2. Threshold-based approval can encourage transaction splitting.
3. Fraud analytics should examine patterns, not merely individual transactions.
4. Incentive systems are part of the control environment.
5. Successful authentication does not establish legitimate use.
6. Corrective action should address root causes as well as individual misconduct.

9. Technology, Data, and Contemporary Issues

Cloud computing, robotic process automation, application programming interfaces, mobile payments, and artificial intelligence change the control environment. They can improve consistency and monitoring, but they also introduce risks involving third-party providers, data ownership, model bias, cybersecurity, service availability, and opaque decision processes.

Important technology controls include identity and access management, multifactor authentication, encryption, secure software development, vulnerability management, backup testing, interface reconciliation, change approval, and vendor assurance. Management should understand the division of responsibility between the organisation and its service provider; outsourcing processing does not outsource accountability.

AI-enabled monitoring may identify unusual transactions more efficiently, but alerts require human assessment. Models can generate false positives, overlook new fraud patterns, or reproduce biased assumptions. Organisations should document model purpose, data sources, access rights, validation, override procedures, and responsibility for decisions.

Data protection and privacy principles should be integrated into control design. Collection should be relevant and lawful, access should be limited to legitimate purposes, retention should be controlled, and breaches should be reported according to applicable requirements. Ethical control design also requires fairness, transparency, confidentiality, and respect for employees and customers.

10. Challenges and Limitations

Internal control and ERM frameworks are valuable, but they do not guarantee success. Major limitations include:

• human error and misunderstanding;
• management override;
• collusion between employees or with outsiders;
• rapidly changing technology and threats;
• incomplete or poor-quality risk data;
• excessive reliance on checklists and compliance formality;
• control costs that exceed expected benefits; and
• conflicts between short-term performance incentives and long-term control objectives.

Frameworks are principles-based and require professional judgement. A control that is suitable for a multinational bank may be inappropriate for a small charity. Effective application therefore requires understanding organisational objectives, risk appetite, legal requirements, resources, and stakeholder expectations.

11. Best-Practice Implementation

A practical implementation programme should:

1. define organisational objectives and risk appetite;
2. map major business and AIS processes;
3. identify risks at transaction, system, entity, and strategic levels;
4. assign clear risk and control owners;
5. document preventive, detective, and corrective controls;
6. restrict access according to least privilege and segregation of duties;
7. retain reliable evidence of control performance;
8. monitor key risks and investigate exceptions;
9. test both design and operation;
10. report significant deficiencies to appropriate governance bodies; and
11. revise controls when systems, processes, threats, or objectives change.

Control documentation should be understandable to the people who operate and review the process. It should state the objective, risk, control procedure, frequency, owner, evidence, escalation route, and testing approach. This documentation supports continuity when personnel change and provides a basis for internal audit and external assurance.

Chapter Summary

Internal control is a people-oriented process that provides reasonable assurance over operations, reporting, and compliance. The COSO Internal Control framework comprises control environment, risk assessment, control activities, information and communication, and monitoring activities. These components operate together rather than as isolated checklists.

COSO ERM extends the perspective by connecting governance, culture, strategy, performance, review, and reporting. Organisations should identify threats and opportunities, establish risk appetite and tolerance, select suitable responses, and reassess changing exposures. AIS controls should be linked to defined objectives and risks.

Preventive controls seek to stop problems, detective controls identify them, and corrective controls remedy them and reduce recurrence. Segregation of duties, access management, reconciliations, application controls, general IT controls, analytics, and independent review are important control mechanisms. Fraud management requires attention to pressure, opportunity, rationalisation, capability, culture, incentives, and collusion.

Control assessment distinguishes design effectiveness from operating effectiveness. Walkthroughs, inspection, observation, inquiry, and reperformance provide evidence. Technology can strengthen monitoring and automation, but it also creates risks involving cybersecurity, third parties, privacy, data quality, and AI governance. No framework removes all risk; professional judgement, ethical leadership, continuous monitoring, and timely corrective action remain essential.

Key Terms

Application control: An automated or manual control built into a particular business application.

Control activity: A policy or procedure designed to reduce a risk.

Control environment: The governance, ethics, structure, competence, and accountability conditions that influence control.

Corrective control: A control that remedies an identified problem or prevents recurrence.

Detective control: A control that identifies an error, irregularity, or failure after it occurs.

Design effectiveness: The extent to which a control is capable of addressing its intended risk.

Enterprise risk management: An integrated process for managing risk in relation to strategy, performance, and objectives.

Expected loss: Estimated probability of an event multiplied by its estimated impact.

Fraud triangle: Pressure or incentive, opportunity, and rationalisation as conditions associated with fraud.

General IT control: A control supporting the reliable operation of information technology systems.

Inherent risk: Risk exposure before consideration of controls or other responses.

Monitoring activity: An evaluation of whether controls continue to operate effectively.

Preventive control: A control designed to stop an error or irregularity before it occurs.

Residual risk: Risk remaining after controls and other responses are applied.

Risk appetite: The types and amount of risk an organisation is willing to accept.

Risk tolerance: The acceptable degree of variation relating to a particular objective or measure.

Segregation of duties: Separation of incompatible responsibilities among different individuals.

Three-way match: Comparison of a purchase order, goods-received record, and supplier invoice.

Operating effectiveness: Whether a control operates consistently and as intended in practice.

Review Questions

Short Answer Questions

1. What is meant by reasonable assurance in the context of internal control?
2. Identify the five components of the COSO Internal Control framework.
3. Distinguish between preventive, detective, and corrective controls.
4. What is the purpose of segregation of duties?
5. Differentiate control design effectiveness from operating effectiveness.

Long Answer Questions

1. Explain how the COSO Internal Control components interact within an accounting information system.
2. Compare the COSO Internal Control and COSO ERM frameworks, including their different emphases.
3. Discuss how an organisation should identify, assess, and respond to fraud risk.
4. Explain the role of general IT controls and application controls in reliable financial reporting.
5. Evaluate the limitations of internal control and explain why no control system can provide absolute assurance.

Analytical / Application Questions

1. A purchasing clerk can create suppliers, approve invoices below a threshold, and view payment reports. Identify the risks, analyse the segregation-of-duties problem, and recommend preventive, detective, and corrective controls.
2. A company’s automated duplicate-invoice control has operated for two years, but recent system changes were not documented or independently tested. Assess the likely design and operating-effectiveness issues and propose an evaluation plan.
3. An organisation uses an AI tool to flag unusual employee expenses. Explain the governance, data-quality, privacy, false-positive, and human-review controls that should surround the tool.

Multiple Choice Questions with Answers

Question 1

Which COSO Internal Control component establishes ethical expectations, authority, competence, and accountability?

A. Control environment

B. Risk assessment

C. Control activities

D. Monitoring activities

Correct Answer: A. Control environment

Question 2

Which control is primarily preventive?

A. Monthly bank reconciliation

B. Independent review of an exception report

C. System validation that rejects an invalid account code

D. Restoration of data from a backup

Correct Answer: C. System validation that rejects an invalid account code

Question 3

A control is design-effective when it:

A. Has operated for at least one year

B. Is capable of addressing the risk it is intended to reduce

C. Has been approved by an external auditor

D. Eliminates all possibility of fraud

Correct Answer: B. Is capable of addressing the risk it is intended to reduce

Question 4

Which situation is the clearest segregation-of-duties conflict?

A. One employee prepares a report and another reviews it

B. One employee records a transaction and another performs the reconciliation

C. One employee creates a supplier, approves its invoices, and releases payment

D. One employee receives training from a supervisor

Correct Answer: C. One employee creates a supplier, approves its invoices, and releases payment

Question 5

Under COSO ERM, risk appetite describes:

A. Every risk that has already occurred

B. The amount and types of risk the organisation is willing to accept

C. The total annual cost of internal audit

D. Only risks caused by employees

Correct Answer: B. The amount and types of risk the organisation is willing to accept

Question 6

If an event has a probability of 0.04 and an estimated loss of $50,000, what is its expected loss?

A. $1,250

B. $2,000

C. $20,000

D. $50,004

Correct Answer: B. $2,000

Question 7

Which evidence generally provides stronger support than inquiry alone when testing a reconciliation control?

A. A verbal statement that the reconciliation was completed

B. A general policy describing reconciliations

C. Reperformance of the reconciliation using supporting records

D. An employee’s estimate of likely errors

Correct Answer: C. Reperformance of the reconciliation using supporting records

Question 8

Which condition is part of the traditional fraud triangle?

A. Opportunity

B. Profit margin

C. Market share

D. Depreciation method

Correct Answer: A. Opportunity

Question 9

A three-way match normally compares a purchase order with:

A. A bank statement and a budget

B. A goods-received record and a supplier invoice

C. A payroll register and a tax return

D. A sales order and a customer complaint

Correct Answer: B. A goods-received record and a supplier invoice

Question 10

Why does successful authentication not prove that a transaction is legitimate?

A. Authentication never records a user identity

B. Credentials may be shared, stolen, or misused by an authorised account

C. Authentication applies only to paper transactions

D. Successful authentication automatically cancels segregation of duties

Correct Answer: B. Credentials may be shared, stolen, or misused by an authorised account