Internal Control, Governance and Fraud

Introduction

Internal control, corporate governance and fraud risk are closely connected dimensions of assurance. An auditor does not merely ask whether transactions are recorded correctly; the auditor evaluates whether the organization has structures and processes that promote reliable reporting, lawful conduct, operational effectiveness and protection of assets. Weak governance can permit weak controls, while weak controls can create opportunities for fraud or non-compliance.

This chapter develops a practical framework for evaluating internal control. It uses the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, explains how to document processes, distinguishes control design from operating effectiveness, and examines fraud risk, compliance and the role of the board and audit committee.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and components of internal control.
2. Apply the COSO framework to organizational processes.
3. Document processes and controls using narratives, flowcharts and control matrices.
4. Evaluate the design and operating effectiveness of controls.
5. Assess fraud risk, non-compliance risk and management override.
6. Explain the responsibilities of boards, management, internal audit and audit committees.
7. Recommend proportionate improvements to governance and control systems.

1. The Nature and Purpose of Internal Control

Internal control is a process effected by an entity’s board, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives. These objectives generally concern:

• operations, including efficiency and protection of assets;
• reporting, including financial and non-financial reporting; and
• compliance with laws, regulations and internal policies.

Internal control is not a single policy, department or document. It is a continuing system embedded in daily activities. A purchase order approval, segregation of duties, password restriction, bank reconciliation and review of an unusual journal entry are all examples of controls.

The term reasonable assurance is important. Internal control cannot provide absolute assurance because of human error, collusion, management override, cost constraints, changing conditions and limitations in information. The objective is to reduce risk to an acceptable level, not to eliminate all risk.

Control objectives and risks

A control objective states what should be achieved. A risk is an event or condition that could prevent achievement of that objective. A control is a response designed to prevent, detect or correct the risk.

Controls may be:

• Preventive: designed to stop an error or irregularity before it occurs, such as system authorization limits.
• Detective: designed to identify an event after it occurs, such as a bank reconciliation.
• Corrective: designed to remedy a detected problem, such as reversing an erroneous entry and correcting the underlying process.
• Manual: performed by people, such as a supervisory review.
• Automated: performed by an information system, such as a three-way match.
• IT-dependent manual: a human review that relies on system-generated information, such as reviewing an exception report.

A control may also be classified as a key control. A key control is one whose failure could reasonably permit a material misstatement or significant operational or compliance failure to remain undetected or unprevented.

2. The COSO Internal Control Framework

The COSO Internal Control—Integrated Framework organizes internal control into five interrelated components and seventeen principles. The five components should not be treated as a checklist in isolation. Effective control requires the components to operate together.

2.1 Control environment

The control environment is the foundation of the system. It includes:

• integrity and ethical values;
• board and audit committee oversight;
• organizational structure and assignment of authority;
• commitment to competence;
• accountability for performance; and
• human-resource policies and practices.

A written code of ethics has limited value if senior executives reward employees for achieving unrealistic targets by any means. Conversely, consistent disciplinary action, credible whistleblowing arrangements and visible leadership commitment can strengthen the environment.

Auditors examine whether responsibilities are clear, whether governance bodies are independent and active, and whether management’s actions are consistent with stated values. The control environment affects the auditor’s assessment of risk throughout the organization.

2.2 Risk assessment

Risk assessment involves identifying and analyzing risks relevant to objectives. It includes consideration of changes in markets, personnel, technology, regulations, business models and suppliers. Management should assess both ordinary business risks and the risk of fraud.

Risk assessment is not merely an annual exercise. For example, implementation of a cloud payroll system may create risks involving access rights, data migration and service-provider reliance. These risks should be assessed before and after implementation.

2.3 Control activities

Control activities are actions established through policies and procedures. Common examples include:

• authorization and approval;
• verification and review;
• reconciliations;
• physical controls over assets;
• segregation of incompatible duties;
• supervisory review;
• exception reporting; and
• controls over information-processing systems.

Segregation of duties usually separates authorization, custody, recording and reconciliation. In a small entity, full segregation may be impractical. Compensating controls, such as owner review of bank statements and detailed transaction reports, may reduce the resulting risk.

2.4 Information and communication

Relevant information must be identified, captured and communicated in a form that enables people to perform their responsibilities. Information should be timely, accurate, complete, accessible and protected from unauthorized alteration.

Communication operates vertically and horizontally. Employees must understand procedures and escalation channels, while the board must receive sufficiently reliable information about major risks, control deficiencies and suspected misconduct. External communication may involve regulators, investors, lenders or other stakeholders.

2.5 Monitoring activities

Monitoring evaluates whether controls continue to operate effectively. It may be:

• ongoing monitoring, built into routine management activities; or
• separate evaluations, such as internal audit reviews.

Deficiencies should be communicated to the person responsible for corrective action, with significant matters reported to senior management, the board or audit committee. A control deficiency is not resolved merely because it has been reported; remediation must address the cause and be followed up.

3. Corporate Governance and Oversight

Corporate governance is the system by which organizations are directed, controlled and held accountable. It concerns relationships among shareholders, the board, management, auditors and other stakeholders.

The board normally sets direction, oversees management and monitors major risks. Management designs and operates internal control. Internal audit provides independent or objective assurance and advice, subject to its organizational mandate. The external auditor provides an independent opinion or assurance conclusion within the scope of the engagement. These roles are related but not interchangeable.

The audit committee

An effective audit committee commonly:

• oversees financial reporting and significant accounting judgments;
• monitors internal control and risk management;
• reviews the internal audit plan and significant findings;
• recommends or oversees appointment and independence of the external auditor;
• reviews audit results and management responses;
• establishes or oversees confidential reporting arrangements; and
• monitors investigations of alleged misconduct.

The audit committee should have sufficient financial literacy, independence, authority, time and access to information. It should meet privately with internal and external auditors when appropriate. However, oversight does not transfer management’s responsibility for designing and operating controls.

Three lines of responsibility

A useful governance model distinguishes:

1. First line: operational management owns risks and operates controls.
2. Second line: risk, compliance, finance or quality functions support and monitor risk management.
3. Third line: internal audit provides independent assurance and advice.

The board and audit committee provide governance and oversight across these lines. External audit is not normally described as an internal line, because it serves external users and operates under a separate professional mandate.

4. Documenting Processes and Controls

Good documentation enables an auditor to understand how a process works, identify points of risk, select controls for testing and communicate findings. Documentation should describe what happens in practice, not merely reproduce an organization’s policy manual.

4.1 Narratives

A narrative describes the sequence of activities, responsible personnel, documents used, systems involved, approvals and exception handling. For example, a revenue narrative should explain how a customer order becomes a shipment, invoice, receivable and cash receipt.

A strong narrative answers:

• Who initiates the transaction?
• What evidence is created?
• Who authorizes it?
• What system records it?
• What reconciliations or reviews occur?
• How are exceptions handled?
• Which incompatible duties are separated?

4.2 Flowcharts

A flowchart represents the movement of transactions, documents and decisions. Standard symbols can show activities, decisions, documents, data stores and start or end points. Flowcharts are useful for identifying re-performance points, delays, duplicate entry and opportunities for unauthorized access.

A flowchart should include a clear scope, direction of flow, responsible departments and relevant control points. It should not become so detailed that important risks are obscured.

4.3 Control matrices

A control matrix links objectives, risks, controls, evidence and testing procedures.

Documentation should distinguish a control from an objective. “The finance manager reviews the report” is not a sufficient control description unless the documentation explains what the manager reviews, how exceptions are investigated and what evidence demonstrates completion.

5. Evaluating Control Design and Operating Effectiveness

Two separate questions must be asked:

1. Design effectiveness: If the control operates as described, is it capable of preventing or detecting the relevant risk?
2. Operating effectiveness: Did the control operate consistently, by an appropriate person, at the relevant time, using reliable information?

A beautifully designed control that was never performed is not operating effectively. A consistently performed control that does not address the risk is not well designed.

Design evaluation

The auditor should identify the assertion or objective affected, consider the cause and potential consequence of the risk, and determine whether the control addresses it. Design evaluation considers frequency, precision, competence, independence, information reliability and evidence.

For example, a monthly review of total sales may be poorly designed to detect fictitious sales if the reviewer does not compare invoices to shipping evidence or investigate unusual transactions. A control’s existence is not enough; its nature and precision must be appropriate.

Operating effectiveness testing

Typical procedures include:

• inquiry of responsible personnel;
• inspection of documents and electronic evidence;
• observation of control performance; and
• reperformance by the auditor.

Inquiry alone usually provides weaker evidence than inspection, observation or reperformance. The auditor considers the period covered, frequency of the control, competence and authority of the performer, evidence of review, exceptions identified and the effect of deviations.

A test of one instance may demonstrate that a control exists, but it rarely demonstrates consistent operation over a lengthy period when the control is performed frequently. Sample selection and sample size depend on the engagement objective, population, frequency, expected deviation and assessed risk; there is no universal sample size suitable for every audit.

Deficiencies and communication

A control deficiency exists when a control is absent, poorly designed or not operating as intended. Deficiencies may be evaluated individually and in combination. Their significance depends on the likelihood and magnitude of a possible misstatement, loss, non-compliance or other consequence.

Management should identify root causes, assign responsibility, set a deadline and monitor remediation. A temporary workaround may reduce immediate exposure but should not be mistaken for a sustainable solution.

6. Fraud Risk and Non-Compliance

Fraud is an intentional act involving deception to obtain an unjust or illegal advantage. It may involve fraudulent financial reporting or misappropriation of assets. Non-compliance is failure to comply with laws, regulations, contractual obligations or internal requirements; it may be intentional or unintentional. Fraud and non-compliance can overlap, but they are not identical.

The fraud triangle

The fraud triangle identifies three commonly associated conditions:

• Pressure or incentive: financial difficulty, performance targets, personal debt or compensation arrangements.
• Opportunity: weak controls, unrestricted access, poor oversight or complex transactions.
• Rationalization: beliefs such as “I am only borrowing it” or “the organization owes me.”

The model is a risk framework, not proof that fraud exists. More recent perspectives also emphasize capability: the knowledge, authority or confidence needed to exploit an opportunity. This is sometimes called the fraud diamond.

Fraud risk assessment

Fraud assessment should consider:

• revenue recognition and management estimates;
• management override of controls;
• related-party transactions;
• unusual journal entries;
• procurement and vendor conflicts;
• payroll and expense reimbursement;
• inventory and cash theft;
• bribery, corruption and sanctions risk;
• whistleblower allegations; and
• pressure created by financial targets.

Auditors should maintain professional skepticism. Consistent explanations do not eliminate the need for corroborating evidence, particularly where incentives are strong or evidence is produced by an interested party.

Management override

Management override is a significant risk because senior personnel may authorize transactions outside normal procedures, manipulate estimates or direct employees to bypass controls. Controls addressing override may include restricted journal-entry access, independent review of unusual entries, review of accounting estimates for bias, board oversight and confidential reporting channels.

Whistleblowing and investigation

A credible reporting mechanism should permit confidential or anonymous communication where legally appropriate, protect against retaliation and route allegations to an independent authority. Investigations should preserve evidence, define scope, maintain confidentiality and separate fact-finding from premature conclusions. Serious matters may require legal, regulatory or forensic expertise.

7. Technology, Data and Emerging Risks

Technology can strengthen control through automated validation, continuous monitoring, access logs and exception reporting. It can also create dependence on system configuration, interfaces, service providers and cybersecurity.

Important IT general controls include:

• user access administration;
• privileged-access review;
• change management;
• backup and recovery;
• incident management; and
• system development and testing.

Application controls may validate data fields, enforce approval limits, prevent duplicate payments or reconcile interfaces. Automated controls require testing of relevant IT general controls and system configuration because a control that operates consistently may still produce incorrect results if its logic or input data is wrong.

Artificial intelligence may support anomaly detection, invoice classification, continuous auditing and fraud-risk analysis. Nevertheless, AI outputs can reflect incomplete data, biased training, inappropriate thresholds or opaque reasoning. Human accountability, access governance, data quality controls and documented review remain essential. An auditor should not treat an AI-generated risk score as conclusive evidence.

8. Illustrative Case: Meridian Components Ltd.

Background

Meridian Components Ltd. is a fictional manufacturer with rapidly increasing online sales. The finance director reports strong revenue growth, while the audit committee has received complaints about delayed customer refunds and aggressive sales targets.

Problem

The order-entry supervisor can create customers, approve credit limits and release orders. The warehouse system automatically generates invoices when an order is marked “dispatched.” The supervisor also has access to the dispatch status field. Monthly receivables reviews are performed, but the review is evidenced only by an electronic signature. Several customers dispute invoices issued near year-end.

Analysis

The control environment is weakened by excessive authority concentrated in one role and pressure linked to sales targets. The process has an opportunity for fictitious or premature revenue. The key risks are:

• unauthorized customer creation;
• dispatch status manipulation;
• revenue recorded before control of goods transfers;
• inadequate review of receivables and refunds; and
• management override near the reporting date.

The existing monthly signature does not demonstrate a precise review. It does not show whether the reviewer examined shipping evidence, credit notes, subsequent cash receipts or unusual period-end transactions.

Approach and solution

The company should separate customer-master maintenance, credit approval, dispatch confirmation and invoice authorization. Access to dispatch status should be restricted to warehouse personnel, with system logs reviewed by finance. The revenue control should require matching the sales order, independent dispatch evidence and invoice before recording revenue. The receivables review should document aging analysis, significant overdue balances, subsequent receipts and disputed invoices.

The audit committee should receive a report on period-end revenue adjustments, credit notes after year-end and allegations concerning sales practices. Internal audit should test access rights, system changes and a sample of transactions across the reporting period.

Outcome

After remediation, the company identifies several premature invoices and reverses them. Revenue growth is lower but more reliable. The revised controls provide clearer evidence, reduce conflicting access and improve the audit committee’s ability to oversee reporting risk.

Learning points

The case demonstrates that a control can fail through poor design even when employees perform the documented step. It also shows why process understanding, IT access analysis, fraud-risk assessment and governance oversight must be integrated.

9. Limitations and Best Practices

Internal control systems face unavoidable limitations. Human judgment may be mistaken; employees may collude; controls may become outdated; management may override procedures; and the cost of a control may exceed its benefit. Controls can also create false confidence when documentation is complete but performance is superficial.

Best practices include:

1. Link every significant risk to a clearly stated control objective.
2. Assign control ownership and define evidence requirements.
3. Use risk-based testing rather than testing controls mechanically.
4. Review access rights after role changes and periodically thereafter.
5. Investigate exceptions rather than simply clearing them.
6. Evaluate controls in combination, including compensating controls.
7. Report significant deficiencies promptly to the appropriate governance body.
8. Test remediation for sustainability, not merely initial completion.
9. Maintain auditor independence and avoid assuming management’s responsibilities.
10. Combine human judgment with appropriate data analytics while validating data and system logic.

Chapter Summary

Internal control is a process designed to provide reasonable assurance over operations, reporting and compliance. The COSO framework organizes effective control into control environment, risk assessment, control activities, information and communication, and monitoring activities. Governance establishes accountability, while management owns controls and the audit committee oversees reporting, risk, audit and misconduct processes.

Auditors document processes through narratives, flowcharts and control matrices. They evaluate whether controls are suitably designed and whether they operated consistently during the relevant period. Fraud assessment considers pressure, opportunity, rationalization and, in many cases, the capability to exploit weaknesses. Management override, related parties, unusual journal entries and incentive-driven reporting require particular skepticism.

Technology can improve prevention and detection but introduces access, change-management, cybersecurity, data-quality and third-party risks. Effective control systems are risk-based, evidenced, monitored and continually improved, while recognizing that no system eliminates all risk.

Key Terms

Internal control: A process designed to provide reasonable assurance over operations, reporting and compliance objectives.

Reasonable assurance: A high but not absolute level of assurance because internal control has inherent limitations.

Control environment: The ethical, organizational and governance foundation of internal control.

Risk assessment: Identification and analysis of events that may prevent achievement of objectives.

Control activity: A policy or procedure established to address a risk.

Preventive control: A control intended to stop an error or irregularity before it occurs.

Detective control: A control intended to identify an error or irregularity after it occurs.

Compensating control: An alternative control that reduces a risk when a preferred control is impractical or absent.

Segregation of duties: Separation of authorization, custody, recording and reconciliation responsibilities.

Key control: A control whose failure could result in a significant undetected or unprevented problem.

Design effectiveness: The capacity of a control, if performed, to address a relevant risk.

Operating effectiveness: The extent to which a control operated as designed during the relevant period.

Control deficiency: An absence, design weakness or operating failure in a control.

Fraud: An intentional deceptive act undertaken to obtain an unjust or illegal advantage.

Fraud triangle: Pressure or incentive, opportunity and rationalization associated with fraud risk.

Management override: Deliberate circumvention of established controls by management.

Audit committee: A board committee overseeing reporting, audit, internal control and related risks.

Whistleblowing: Reporting suspected wrongdoing through designated communication channels.

Professional skepticism: An attitude involving a questioning mind and critical assessment of evidence.

Review Questions

Short Answer Questions

1. What are the three broad categories of objectives addressed by internal control?
2. Distinguish preventive controls from detective controls.
3. Name the five components of the COSO framework.
4. What is the difference between design effectiveness and operating effectiveness?
5. Identify the three elements of the fraud triangle.

Long Answer Questions

1. Explain how the control environment influences the effectiveness of all other internal control components.
2. Describe how an auditor could document a purchasing process using a narrative, flowchart and control matrix.
3. Explain the responsibilities of management, internal audit, external audit and the audit committee in relation to internal control.
4. Discuss why inquiry alone is generally insufficient evidence when testing operating effectiveness.
5. Explain how management override and technology-related risks should be addressed in an audit.

Analytical / Application Questions

1. A finance manager approves suppliers, records invoices and performs bank reconciliations. Identify the control risks and recommend proportionate compensating controls for a small entity.
2. A company’s revenue rises sharply in the final week of the year, followed by a large volume of credit notes. Analyze the possible fraud and control risks and propose audit procedures.
3. An automated payment system prevents duplicate invoice numbers, but its configuration was changed by a programmer without independent testing. Evaluate the control’s design and operating effectiveness and recommend improvements.

Multiple Choice Questions with Answers

Question 1

Which COSO component provides the foundation for the other components of internal control?

A. Control environment

B. Control activities

C. Monitoring activities

D. Information and communication

Correct Answer: A. Control environment

Question 2

Which is the best example of a detective control?

A. A system blocking payments above an approval limit

B. A monthly bank reconciliation prepared independently

C. A password requirement for system access

D. A requirement for pre-approval of purchase orders

Correct Answer: B. A monthly bank reconciliation prepared independently

Question 3

A control is design effective when it:

A. Has been documented in a policy manual

B. Is performed by a senior employee

C. Is capable of addressing the relevant risk if it operates as intended

D. Has never identified an exception

Correct Answer: C. Is capable of addressing the relevant risk if it operates as intended

Question 4

Which combination represents the traditional fraud triangle?

A. Capability, concealment and collusion

B. Pressure, opportunity and rationalization

C. Authorization, custody and recording

D. Risk, materiality and sampling

Correct Answer: B. Pressure, opportunity and rationalization

Question 5

Which responsibility normally belongs to management rather than the external auditor?

A. Providing an independent audit opinion

B. Designing and operating the entity’s internal controls

C. Reporting audit findings to external users

D. Maintaining professional skepticism

Correct Answer: B. Designing and operating the entity’s internal controls

Question 6

Why is segregation of duties used?

A. To ensure every task is performed twice

B. To separate incompatible responsibilities and reduce the opportunity for error or fraud

C. To eliminate the need for supervision

D. To transfer control responsibility to external auditors

Correct Answer: B. To separate incompatible responsibilities and reduce the opportunity for error or fraud

Question 7

Which procedure generally provides the strongest evidence that a control was actually performed?

A. Inquiry alone

B. Reading the organization’s policy

C. Reperformance of the control by the auditor

D. Asking management whether the control worked

Correct Answer: C. Reperformance of the control by the auditor

Question 8

Which matter is most directly associated with management override risk?

A. An independent bank reconciliation

B. Unusual manual journal entries posted near period-end

C. A routine inventory count conducted by warehouse staff

D. A password expiry notification

Correct Answer: B. Unusual manual journal entries posted near period-end

Question 9

What is the primary role of an audit committee?

A. To perform every control in the finance department

B. To prepare all journal entries

C. To provide board-level oversight of reporting, audit, internal control and related risks

D. To replace the organization’s management team

Correct Answer: C. To provide board-level oversight of reporting, audit, internal control and related risks

Question 10

A control is performed every month, but the reviewer signs a report without investigating exceptions. What is the most appropriate conclusion?

A. The control is automatically effective because it is documented

B. The control may be poorly designed or not operating effectively because the review lacks sufficient precision

C. The control is preventive by definition

D. The control eliminates fraud risk

Correct Answer: B. The control may be poorly designed or not operating effectively because the review lacks sufficient precision