Internal Control and Information Systems

Introduction and context

Internal control is the system through which an entity directs, monitors and safeguards its activities. It includes policies, procedures, organisational structures, information flows and behaviours designed to provide reasonable—not absolute—assurance that objectives will be achieved. For auditors, internal control is not merely a compliance mechanism. It is a source of audit evidence, a determinant of control risk, and an important basis for communicating weaknesses to those charged with governance.

Modern organisations depend on information systems for initiating transactions, processing data, maintaining records, producing reports and supporting decisions. Consequently, an audit of controls must consider both manual and automated activities, as well as the interaction between people, processes, applications, infrastructure and third-party providers.

The auditor’s task is not to conclude that an entity has “good controls” in the abstract. It is to understand relevant controls, identify risks of material misstatement, evaluate whether controls are suitably designed and implemented, test operating effectiveness where reliance is intended, and determine the implications of deficiencies.

Learning objectives

By the end of this chapter, readers should be able to:

• explain the purpose and components of internal control;
• distinguish entity-level, process-level, IT general and application controls;
• analyse controls across major transaction cycles;
• document systems using narratives, flowcharts and risk-control matrices;
• evaluate control design, implementation and operating effectiveness;
• identify, assess and communicate control deficiencies;
• understand the implications of outsourced and cloud-based systems; and
• formulate practical governance recommendations.

1. The nature and purpose of internal control

The widely used COSO Internal Control—Integrated Framework describes internal control through five interrelated components:

1. Control environment: integrity, ethical values, governance oversight, organisational structure, authority and accountability, and competence.
2. Risk assessment: identification and analysis of risks relevant to objectives, including fraud and change-related risks.
3. Control activities: authorisations, approvals, reconciliations, segregation of duties, physical safeguards, reviews and automated validations.
4. Information and communication: obtaining, processing and communicating relevant, reliable and timely information.
5. Monitoring activities: ongoing and separate evaluations of whether controls continue to operate effectively.

These components are mutually dependent. A technically sophisticated approval workflow may be ineffective if management overrides it routinely. Conversely, a strong ethical culture cannot compensate for a system that permits unauthorised changes to supplier bank details.

Internal control commonly supports five broad objectives:

Controls provide reasonable assurance because limitations are unavoidable. Human error, collusion, management override, poor judgement, inadequate resources and changes in circumstances may defeat even well-designed controls. The cost of a control should also be proportionate to the risk it addresses.

2. Entity-level and process-level controls

Entity-level controls

Entity-level controls operate across the organisation and influence the control environment or multiple processes. Examples include:

• board and audit committee oversight;
• a code of conduct and whistleblowing arrangements;
• enterprise risk assessment;
• internal audit;
• financial close instructions;
• policies for conflicts of interest and related parties;
• performance management and disciplinary processes; and
• controls over significant estimates and management override.

Some entity-level controls operate indirectly. For example, an effective audit committee may not prevent an individual invoice error, but it can improve the quality of financial reporting oversight and increase the likelihood that errors are detected and corrected.

Process-level controls

Process-level controls address risks within a particular business process. They may be preventive or detective, manual or automated, and key or non-key.

A preventive control stops an error or irregularity before it occurs—for example, a system rejection of an invoice without a purchase order. A detective control identifies a problem after processing—for example, a monthly bank reconciliation. A corrective control resolves an identified problem, such as reversing an unauthorised journal and investigating its cause.

A key control is one that sufficiently addresses a relevant risk such that its failure could contribute to a material misstatement or significant operational harm. Not every control in a process is a key control. Over-identifying controls can make an audit inefficient and obscure the controls that matter most.

3. Internal control models and audit risk

The risk-based audit approach connects controls with inherent risk, control risk and detection risk. In simplified form:

In this relationship, inherent risk is the susceptibility of an assertion to misstatement before controls; control risk is the risk that a misstatement will not be prevented or detected and corrected by controls; and detection risk is the risk that audit procedures will fail to detect a misstatement. The relationship is conceptual rather than a precise mechanical calculation. Lower assessed control risk may permit a different mix or extent of substantive procedures only when the auditor has obtained sufficient evidence that controls are suitably designed, implemented and operating effectively.

The auditor should distinguish three questions:

• Design: Would the control, if operating as described, prevent or detect a relevant misstatement?
• Implementation: Does the control actually exist and has it been put into use?
• Operating effectiveness: Did it operate consistently during the relevant period, by an appropriately competent person or system, with evidence of performance?

Inquiry alone is generally insufficient evidence of operating effectiveness. Inspection, observation, reperformance and tests of system-configured controls may be necessary.

4. Transaction cycles and control objectives

Revenue and receivables cycle

The principal risks include fictitious sales, unauthorised price changes, premature revenue recognition, incomplete recording of credit notes and uncollectible receivables. Relevant controls include:

• approved customer master-file changes;
• credit-limit and order-acceptance controls;
• sequential sales invoices;
• matching of orders, dispatch records and invoices;
• independent review of sales cut-off;
• approval of credit notes and write-offs; and
• aged receivables review and collection follow-up.

The auditor should consider whether dispatch evidence is generated independently of billing and whether users can override system dates or prices.

Purchases and payables cycle

Risks include fictitious suppliers, duplicate invoices, purchases without authority, unrecorded liabilities and payments to incorrect bank accounts. Controls may include approved supplier onboarding, purchase-order approval, three-way matching of purchase orders, goods received notes and invoices, duplicate-invoice checks, payment-batch approval and supplier-statement reconciliations.

A three-way match is useful but not sufficient if goods-received records are entered without verification or if procurement users can create suppliers and approve payments.

Payroll cycle

Risks include ghost employees, inaccurate pay rates, unauthorised overtime and improper termination payments. Controls include independent review of payroll master-file changes, segregation between human resources and payroll processing, approval of timesheets, exception reports and reconciliation of payroll to the general ledger and bank payment.

Inventory cycle

Important controls include restricted warehouse access, perpetual inventory records, authorised movements, cycle counts, independent investigation of count differences and review of obsolescence. Physical counts provide evidence about existence, but not necessarily ownership, valuation or completeness of liabilities.

Financial reporting and journal-entry cycle

Risks include unsupported journals, management override and inaccurate consolidation. Controls include role-based journal access, standard journal templates, independent review, automated validation of balanced entries, close checklists, intercompany reconciliations and review of unusual or late-posted journals.

5. Information systems and IT controls

An information system consists of people, procedures, data, software, hardware, networks and supporting facilities. The auditor must understand how transactions originate, how data are processed, where interfaces occur and how reports are generated.

IT general controls

IT general controls (ITGCs) apply across systems and help ensure that applications operate reliably. Major categories are:

1. Access management: user provisioning, role changes, privileged access, periodic access reviews, password controls and timely removal of leavers.
2. Change management: formal requests, testing, approval, segregation between development and production, version control and emergency-change review.
3. IT operations: job scheduling, incident management, monitoring, backups, restoration testing and batch-interface controls.
4. Program development and implementation: requirements, testing evidence, migration controls, user acceptance and post-implementation review.
5. Business continuity and disaster recovery: recovery priorities, alternate processing arrangements, recovery testing and communication procedures.

A failure in an ITGC can affect many automated application controls. For example, if developers have unrestricted production access, an apparently effective automated approval rule may be changed without authorisation.

Application controls

Application controls operate within a specific system and address particular transaction risks. Examples include:

• input validation, such as valid customer codes and permitted dates;
• completeness checks, such as sequential numbering and batch totals;
• processing controls, such as recalculation and matching;
• output controls, such as report distribution and review; and
• interface controls, such as record counts and control-total reconciliation.

Automated controls are often consistent once configured, but their reliability depends on relevant ITGCs, accurate standing data, appropriate configuration and controlled interfaces. A system-generated exception report is not effective merely because it exists; someone must review it promptly, investigate exceptions and document resolution.

Emerging technologies

Cloud platforms, application programming interfaces, robotic process automation, artificial intelligence and data analytics alter the control landscape. Risks may arise from unclear responsibility between the entity and service provider, insecure interfaces, excessive privileges, model bias, opaque automated decisions, poor data lineage and unauthorised use of generative AI.

Auditors should assess service-organisation controls, contractual rights, complementary user-entity controls, data retention, encryption, incident notification and access to assurance reports. AI-assisted processing requires attention to input quality, model governance, human review, change control and explainability. Automation does not remove accountability from management.

6. Documenting systems and controls

Good documentation allows another experienced auditor to understand the process, risks, controls, evidence and conclusions without relying on undocumented explanations.

Narratives

A narrative describes the process in sequence, identifies responsible roles, records documents and systems used, and explains key controls and exceptions. It should not merely reproduce policy language. It should describe what actually happens.

Flowcharts

A flowchart can show departments, documents, decisions, system interfaces and control points. Standard symbols should be used consistently. The auditor should ensure that the chart identifies manual-to-system handoffs and points at which data can be altered or lost.

Risk-control matrices

A risk-control matrix links assertions or objectives to risks, controls, control owners, frequency, evidence and planned tests.

Documentation should identify the population, period, sample basis, exceptions, compensating controls and final conclusion. Screenshots may support evidence but should include date, system context and sufficient information to establish what was reviewed.

7. Testing controls

The nature, timing and extent of testing depend on the assessed risks, the intended reliance and the characteristics of the control.

• Inquiry asks knowledgeable personnel how a control operates.
• Inspection examines documents, logs, approvals or configuration.
• Observation watches a control being performed, but provides evidence only at that time.
• Reperformance independently executes the control.
• Computer-assisted audit techniques analyse complete populations, identify unusual items and test configurations or interfaces.

A test should specify the population, selection method, attributes, tolerable exception level where relevant, period covered and evaluation criteria. Testing a control once does not establish operation throughout a year unless the control is one-off or other evidence supports the conclusion.

For a manual review control, the auditor may inspect evidence of review, assess the reviewer’s competence and authority, determine whether the review was performed timely, and evaluate how exceptions were investigated. For an automated control, the auditor may test configuration, inspect relevant ITGCs, use reperformance or test a representative transaction, and assess changes during the period.

If exceptions are identified, the auditor should determine whether they are isolated or systemic, whether they indicate a design problem, whether compensating controls exist, and whether the planned reliance remains appropriate. A control deviation is not automatically a financial misstatement, but it increases the risk that one may occur and remain undetected.

8. Control deficiencies and communication

A control deficiency exists when a control is absent, poorly designed or does not operate as intended. A significant deficiency is sufficiently important to merit the attention of those charged with governance. A material weakness—where the applicable reporting framework uses that term—is a deficiency or combination of deficiencies creating a reasonable possibility that a material misstatement will not be prevented, detected or corrected timely.

Assessment should consider:

• the likelihood of a misstatement or loss;
• the magnitude of potential consequences;
• the susceptibility of the related account or process to fraud;
• the volume of transactions exposed;
• whether the deficiency affects many accounts or systems;
• the effectiveness of compensating controls; and
• whether the deficiency has been corrected and for how long.

The auditor’s communication should be clear, balanced and actionable. A useful recommendation states the condition, criterion or expected practice, cause, consequence or risk, and agreed action with an accountable owner and target date. Recommendations should avoid assuming that adding more approvals is always the answer; excessive controls can create delay, conceal accountability and encourage workarounds.

9. Governance, ethics and professional judgement

Internal control is a governance responsibility. Management designs and operates controls; the board and audit committee oversee risk, reporting and remediation; internal audit provides independent assurance within its mandate; and external auditors provide an opinion or other assurance conclusion under applicable standards.

Ethical issues arise when management pressures staff to bypass controls, suppresses exceptions, manipulates performance measures or uses personal data beyond its stated purpose. Auditors must maintain professional scepticism, protect confidential information, evaluate conflicts of interest and avoid taking management responsibility. They should also consider whether a control recommendation is proportionate, feasible and consistent with privacy, employment and data-protection requirements.

10. Illustrative case: Northstar Components Ltd

Background

Northstar Components Ltd, a manufacturing entity, migrated its procurement and payment processes to a cloud enterprise-resource-planning system. Management claimed that automated three-way matching had eliminated duplicate and unauthorised payments.

Problem

During the audit, the auditor found several suppliers with recently changed bank accounts. The system contained a duplicate-invoice rule, but procurement administrators could create suppliers, alter bank details and release payment batches. A review of user access had not been completed for eighteen months. Emergency changes to the matching rule were approved retrospectively.

Analysis

The automated matching control addressed only one risk and did not address supplier impersonation or inappropriate access. The ITGCs over access and change management were weak. Since privileged users could change both standing data and transaction-processing rules, reliance on the application control was inappropriate without additional evidence.

The auditor inspected subsequent payments, compared supplier bank changes with independent confirmations, analysed duplicate invoice numbers and examined cloud-provider logs. Several payments required investigation, although not all represented confirmed losses. The deficiencies increased the risk of material misstatement and fraud.

Approach and solution

Management agreed to:

• separate supplier creation, bank-detail amendment and payment approval;
• require independent call-back confirmation for bank changes;
• perform quarterly access reviews and immediate leaver removal;
• require documented testing and approval for production changes;
• reconcile payment-batch totals to bank confirmations; and
• establish a dashboard of unresolved exceptions for the audit committee.

The auditor tested the redesigned controls after implementation and performed additional substantive procedures for the period before remediation.

Outcome and learning points

Northstar improved accountability and reduced reliance on a single automated rule. The case demonstrates that application controls cannot be evaluated in isolation from ITGCs, master data and user responsibilities. It also illustrates why control design must be assessed against the actual risk, not merely against the existence of a system feature.

Challenges and limitations

Internal control evaluations face several recurring difficulties. Processes may differ from formal policies; system documentation may be outdated; outsourced providers may restrict access to evidence; and automated controls may depend on complex configurations that auditors cannot readily interpret. Sampling may fail to reveal rare fraud, while data analytics may produce false positives. Rapid digital change can invalidate an earlier risk assessment.

The response is not to document every activity indiscriminately. Auditors should focus on risks that could affect important assertions or objectives, understand end-to-end data flows, involve appropriate IT specialists, validate evidence sources and update documentation when systems or responsibilities change.

Best-practice principles

Effective control evaluation generally follows these principles:

1. Start with objectives and risks, not with a catalogue of procedures.
2. Trace transactions from initiation through reporting and retention.
3. Identify both manual and automated dependencies.
4. Evaluate segregation of duties in the context of actual system privileges.
5. Distinguish design, implementation and operating effectiveness.
6. Test evidence rather than relying solely on representations.
7. Consider fraud, override, data quality and third-party risks.
8. Use analytics to examine complete populations where appropriate.
9. Communicate root causes and practical remediation actions.
10. Follow up whether agreed actions actually reduce the original risk.

Chapter Summary

Internal control is an integrated system of governance, risk assessment, control activities, information, communication and monitoring. Entity-level controls shape the organisational environment, while process-level controls address risks in transaction cycles. IT general controls support the reliability of applications, and application controls validate, process and report transactions. Their effectiveness depends on accurate data, appropriate access, controlled changes and competent oversight.

Auditors evaluate control design, implementation and operating effectiveness using inquiry, inspection, observation, reperformance and technology-enabled procedures. Documentation through narratives, flowcharts and risk-control matrices should connect objectives, risks, controls, evidence and conclusions. Deficiencies are assessed by likelihood, magnitude, fraud exposure, affected populations and compensating controls, then communicated with clear root causes and accountable remediation. Cloud services, automation and AI create new opportunities but also require stronger governance over access, data, models, interfaces and change.

Key Terms

Application control: A control embedded in a particular information system that addresses transaction-processing risks.

Audit trail: Evidence showing the origin, processing, amendment and disposition of a transaction or record.

Compensating control: A control that reduces the risk created by another ineffective or absent control.

Control deficiency: An absence, design weakness or operating failure in internal control.

Control environment: Governance structures, ethical values, authority, accountability and competence influencing control behaviour.

Control risk: The risk that a relevant misstatement will not be prevented, detected or corrected by internal control.

Detective control: A control designed to identify an error or irregularity after it occurs.

Entity-level control: A control operating across the organisation or influencing multiple processes.

IT general control: A control supporting the reliable operation of information systems across applications.

Key control: A control sufficiently important to address a relevant significant risk or assertion.

Management override: Deliberate circumvention of controls by authorised management personnel.

Preventive control: A control intended to stop an error or irregularity before it occurs.

Reperformance: Independent execution of a control or procedure by the auditor.

Risk-control matrix: A structured linkage between risks, controls, owners, evidence and tests.

Segregation of duties: Allocation of incompatible responsibilities among different people or roles.

Significant deficiency: A control deficiency important enough to merit governance attention.

Three-way match: Comparison of a purchase order, goods-received record and supplier invoice.

User-entity control: A control that a customer organisation is expected to operate when using a service provider.

Operating effectiveness: Whether a suitably designed control operated consistently and appropriately during the relevant period.

Review Questions

Short Answer Questions

1. What are the five components of the COSO internal control framework?
2. Distinguish preventive, detective and corrective controls.
3. Why are IT general controls relevant to automated application controls?
4. What is the difference between control design and operating effectiveness?
5. Identify three procedures an auditor may use to test controls.

Long Answer Questions

1. Explain how entity-level controls influence the reliability of financial reporting and audit risk.
2. Discuss the principal control risks in the revenue, purchases and payroll cycles.
3. Explain the relationship between access management, change management and application controls.
4. Describe how an auditor should document and test a key manual review control.
5. Evaluate the challenges that cloud computing and artificial intelligence create for internal control.

Analytical / Application Questions

1. A company’s system prevents invoices without purchase orders, but procurement staff can create suppliers and approve payment batches. Analyse the control risks and recommend improvements.
2. A monthly reconciliation is performed by an inexperienced employee, reviewed verbally by a manager and retained without sign-off. Evaluate its design and operating effectiveness, and propose audit procedures.
3. An auditor identifies three exceptions in a population of automated transactions after an unauthorised emergency system change. Explain how the auditor should assess the exceptions, ITGC implications, reliance on the automated control and governance communication.

Multiple Choice Questions with Answers

Question 1

Which component of the COSO framework includes integrity, ethical values and board oversight?

A. Risk assessment

B. Control environment

C. Monitoring activities

D. Information and communication

Correct Answer: B. Control environment

Question 2

Which is the best example of an IT general control?

A. A system check that rejects an invalid customer code

B. A three-way match of an invoice, order and receipt

C. Periodic review of privileged user access

D. A report showing overdue receivables

Correct Answer: C. Periodic review of privileged user access

Question 3

What does implementation of a control establish?

A. That the control operated effectively throughout the year

B. That the control exists and has been put into use

C. That no related misstatement has occurred

D. That substantive procedures are unnecessary

Correct Answer: B. That the control exists and has been put into use

Question 4

Which procedure provides the strongest direct evidence that an auditor can independently execute a control?

A. Inquiry

B. Observation

C. Inspection

D. Reperformance

Correct Answer: D. Reperformance

Question 5

A control that prevents payment of an invoice lacking an approved purchase order is primarily:

A. Preventive

B. Detective

C. Corrective

D. Compensating

Correct Answer: A. Preventive

Question 6

Why may an application control be unreliable when IT general controls are weak?

A. Application controls are always manual

B. Users may be unable to access the application

C. Unauthorised changes may be made to the control or its data

D. IT general controls replace application controls

Correct Answer: C. Unauthorised changes may be made to the control or its data

Question 7

Which combination is required for a conventional three-way match?

A. Invoice, bank statement and journal entry

B. Purchase order, goods-received record and invoice

C. Budget, payroll report and supplier statement

D. Sales order, dispatch note and credit note

Correct Answer: B. Purchase order, goods-received record and invoice

Question 8

Which factor is most relevant when assessing the severity of a control deficiency?

A. The length of the control description

B. The colour of the process flowchart

C. The likelihood and potential magnitude of a misstatement

D. Whether the control is performed manually

Correct Answer: C. The likelihood and potential magnitude of a misstatement

Question 9

What is a principal risk when one employee can create suppliers, amend bank details and approve payments?

A. Excessive documentation

B. Inadequate segregation of duties

C. Overreliance on physical inventory counts

D. Incomplete disaster recovery testing

Correct Answer: B. Inadequate segregation of duties

Question 10

Which statement best describes reasonable assurance?

A. It guarantees that all fraud will be detected

B. It means controls eliminate all operational risk

C. It recognises that internal control has unavoidable limitations

D. It applies only to automated controls

Correct Answer: C. It recognises that internal control has unavoidable limitations