Internal Control and Control Evaluation

Introduction and Context

Internal control is the system of policies, procedures, responsibilities, information flows, and oversight activities established to help an organisation achieve its objectives. In accounting and auditing, internal control is especially important because it supports reliable financial reporting, protects assets, promotes compliance with laws and policies, and reduces the likelihood that errors or fraud will remain undetected.

Internal control is not the same as internal audit. Internal control is designed and operated by management and employees throughout the organisation. Internal audit is an independent or objective assurance and consulting function that evaluates governance, risk management, and control processes. External auditors evaluate relevant controls primarily to assess risks and determine the nature, timing, and extent of audit procedures.

A sound control system cannot guarantee that all errors or fraud will be prevented. Controls provide reasonable, not absolute, assurance because of human error, management override, collusion, changes in circumstances, and the cost of implementing controls. Effective control evaluation therefore requires professional judgement and an understanding of how controls operate in the organisation’s actual environment.

Learning Objectives

After studying this chapter, you should be able to:

1. Explain the purpose and limitations of internal control.
2. Describe the five interconnected components of an effective control framework.
3. Identify risks and match them with appropriate control activities.
4. Document business processes using narratives, flowcharts, and control matrices.
5. Design and perform tests of controls.
6. Evaluate control deficiencies and communicate them appropriately.
7. Recognise the effects of information technology, data analytics, and artificial intelligence on control systems.

1. The Purpose and Nature of Internal Control

Internal control is a process effected by an organisation’s governing body, management, and other personnel. It is intended to provide reasonable assurance regarding three broad categories of objectives:

• Operations: effectiveness and efficiency of activities, including protection and economical use of resources.
• Reporting: reliability, timeliness, and transparency of financial and non-financial information.
• Compliance: adherence to applicable laws, regulations, contracts, and internal policies.

These objectives overlap. For example, a purchasing control may improve operational efficiency, prevent unauthorised expenditure, produce accurate accounting records, and support compliance with procurement rules.

Controls may be classified in several ways. Preventive controls attempt to stop an undesirable event before it occurs, such as approval limits or password authentication. Detective controls identify an event after it occurs, such as bank reconciliations or exception reports. Corrective controls remedy identified problems, such as restoring data from a backup or correcting an erroneous journal entry. Controls may also be manual, automated, or IT-dependent manual. An IT-dependent manual control uses information produced by an information system but requires human review, such as a manager’s review of an automated aged receivables report.

A control objective states what the control should achieve. A control activity describes how the objective is pursued. For example:

2. The Five Components of Internal Control

A widely used framework, including the framework associated with the Committee of Sponsoring Organizations of the Treadway Commission (COSO), describes five interconnected components: the control environment, risk assessment, control activities, information and communication, and monitoring activities. The components operate as a system rather than as isolated departments.

2.1 Control Environment

The control environment is the foundation of internal control. It reflects the organisation’s values, leadership behaviour, governance arrangements, and expectations concerning integrity and accountability. Important features include:

• integrity and ethical values;
• commitment to competence;
• oversight by the board or audit committee;
• management’s philosophy and operating style;
• organisational structure and assignment of authority;
• human-resource policies; and
• accountability for performance and control responsibilities.

The board and senior management establish the “tone at the top,” but supervisors and employees also create a “tone in the middle” through daily decisions. A formal code of ethics has limited value if managers reward employees for meeting targets by bypassing controls. Conversely, consistent enforcement of policies supports a culture in which employees report concerns and treat controls as part of responsible business practice.

Auditors evaluate the control environment by inspecting governance documents, interviewing personnel, observing management behaviour, reviewing disciplinary actions, and considering whether responsibilities are clearly assigned. A weak environment may increase the risk that otherwise well-designed controls will not operate consistently.

2.2 Risk Assessment

Risk assessment is the process of identifying and analysing events that could prevent the organisation from achieving its objectives. Risk assessment normally considers the likelihood of an event and its possible effect. It should cover both external risks, such as regulatory change or cyberattack, and internal risks, such as staff turnover, system failure, or unauthorised transactions.

A practical risk assessment process consists of the following steps:

1. Define the objective or process.
2. Identify possible risks.
3. Assess inherent risk before considering controls.
4. Identify existing controls.
5. Assess residual risk after considering controls.
6. Decide whether further action is necessary.
7. Assign responsibility and review the assessment periodically.

Inherent risk is the susceptibility of an assertion or activity to error or fraud before related controls are considered. Residual risk is the risk remaining after controls operate. Risk assessments are not purely mathematical exercises; ratings should be supported by evidence and consistent criteria.

For financial reporting, auditors commonly consider assertions such as occurrence, completeness, accuracy, cut-off, classification, existence, rights and obligations, and valuation. For example, in payroll, occurrence asks whether recorded employees and payments are genuine, while completeness asks whether all employee costs and related liabilities have been recorded.

2.3 Control Activities

Control activities are actions established through policies and procedures to address identified risks. Common control activities include:

• Authorisation: appropriate personnel approve transactions before commitment.
• Verification: calculations, prices, quantities, and supporting documents are checked.
• Reconciliations: two independent records are compared and differences investigated.
• Physical controls: assets and records are protected through locks, restricted access, and counts.
• Segregation of duties: different people perform authorisation, custody, recording, and reconciliation where practicable.
• Reviews of performance: actual results are compared with budgets, prior periods, or expectations.
• Exception reporting: unusual or rejected transactions are identified and followed up.
• Number controls: pre-numbered documents or system-generated identifiers help identify missing transactions.

Segregation of duties is a central principle. For example, the person who maintains the supplier master file should not independently approve supplier payments. In a small organisation, complete segregation may be impractical. Compensating controls may include owner review, independent bank statements, surprise cash counts, and monthly review of detailed transaction reports.

Controls should be proportionate to risk. Excessive approvals may delay operations without reducing significant risk, while insufficient controls may expose the organisation to loss. A useful question is not simply “Is there a control?” but “Does this control address the relevant risk, and does it operate effectively?”

2.4 Information and Communication

An organisation needs relevant, reliable, and timely information to operate controls. Information systems include accounting software, enterprise systems, spreadsheets, databases, manual records, and communication channels. Information must flow both vertically and horizontally. Employees need to understand their responsibilities, while management needs information about exceptions, performance, and emerging risks.

A transaction-processing system generally involves input, processing, storage, output, and communication. Controls should address:

• authorised access and user identification;
• appropriate segregation of system privileges;
• input validation and completeness checks;
• processing controls and error logs;
• interface reconciliations between systems;
• backup, recovery, and business continuity;
• change management; and
• protection of confidential information.

General IT controls support the reliable operation of applications. Examples include controls over access, program changes, backup, and computer operations. Application controls operate within a specific system, such as a system rejecting an invoice without a valid purchase order. If general IT controls are weak, reliance on automated application controls may also be reduced.

Communication includes formal reports, policies, training, meetings, whistleblowing channels, and informal discussions. A control deficiency may persist when staff know about a problem but lack a safe mechanism for reporting it.

2.5 Monitoring Activities

Monitoring determines whether controls continue to operate as intended. It may be conducted through ongoing activities, separate evaluations, or both. Ongoing monitoring is built into normal operations, such as a supervisor reviewing daily exception reports. Separate evaluations may be performed by internal audit, compliance staff, or other independent reviewers.

Effective monitoring identifies deficiencies, determines their causes, assigns corrective responsibility, and follows up whether corrective action has been completed. Monitoring should be risk-based. High-risk controls require more frequent and independent review than low-risk controls.

3. Process Documentation

Auditors document processes to understand how transactions move through an organisation, identify control points, and communicate findings. Three common methods are narratives, flowcharts, and control matrices.

A narrative describes the people, documents, systems, approvals, and procedures in words. It is useful for unusual or complex processes but may become difficult to follow when many decisions and exceptions exist.

A flowchart represents a process visually using standard symbols. It can show sequence, documents, decisions, system processing, and responsibility. Flowcharts are particularly useful for identifying duplicated steps, missing approvals, or incompatible duties.

A control matrix links objectives, risks, controls, evidence, and testing procedures. A simplified example is shown below.

Documentation should be sufficiently clear that an experienced auditor who has no previous connection with the engagement can understand the work performed, evidence obtained, and conclusion reached.

4. Evaluating Control Design and Implementation

Control evaluation begins by distinguishing design effectiveness from operating effectiveness. A control is design-effective when, if properly applied, it could prevent or detect and correct a relevant misstatement or other undesirable event. A control is implemented when it exists and has been put into use. A control may be well designed but not implemented, or implemented but poorly designed.

The evaluation process usually includes:

1. Understand the objective and related risk.
2. Identify the control that addresses the risk.
3. Determine who performs it, when, and how often.
4. Inspect relevant documents and system configurations.
5. Walk through at least one transaction from initiation to recording and reporting.
6. Identify what happens when an exception occurs.
7. Assess whether the control is suitably designed and implemented.
8. Decide whether testing of operating effectiveness is appropriate.

A walkthrough is not normally sufficient by itself to demonstrate that a control operated throughout a period. It is used to confirm understanding and identify possible control gaps. The auditor should ask open questions, observe activities, inspect evidence, and trace the transaction in both directions where relevant.

5. Testing Controls

A test of controls obtains evidence about whether a control operated effectively during a specified period. The nature of testing depends on the control. Common procedures include:

• Inspection: examining approvals, reconciliations, logs, or review evidence.
• Observation: watching a control being performed, such as a stock count.
• Inquiry: asking responsible personnel how a control operates. Inquiry alone is generally weak evidence.
• Reperformance: independently carrying out the control, such as repeating a reconciliation.
• Computer-assisted procedures: analysing system logs, exception reports, or populations of transactions.

For each test, the auditor should specify the population, sampling period, selection method, attributes to be examined, and treatment of deviations. An attribute is a feature expected to be present, such as evidence of approval. A deviation is a failure of the control to operate as prescribed.

The auditor should consider the frequency of the control. A daily control, monthly control, and annual control require different approaches. Evidence should also be evaluated for reliability. Evidence generated and retained by an independent system may be more persuasive than an unsupported verbal statement, although system-generated evidence is not automatically reliable.

If a control is tested and deviations are identified, the auditor considers the frequency and significance of the deviations, whether they are isolated or systematic, and whether compensating controls exist. A deviation does not always mean that a financial statement is misstated, but it may increase assessed risk and require more substantive audit work.

Worked Example: Monthly Bank Reconciliation Control

A company requires an accountant to prepare a monthly bank reconciliation and a finance manager to review and sign it. The audit period contains 12 monthly reconciliations. The auditor selects 4 months using a documented selection method.

For each selected month, the auditor inspects the reconciliation, agrees the book balance to the ledger, agrees the bank balance to the bank statement, and examines reconciling items. The auditor also inspects evidence that the manager reviewed the reconciliation and investigated unusual items.

Suppose one of the four reconciliations lacks evidence of review. The auditor should not automatically conclude that all 12 months failed. The auditor should investigate why the evidence is missing, determine whether the manager actually performed the review, examine subsequent reconciliations, and consider whether the missing evidence represents a control deviation. The conclusion should address both the control’s operating effectiveness and the risk that unreconciled differences remained undetected.

6. Control Deficiencies and Communication

A control deficiency exists when a control is absent, poorly designed, not implemented, or not operating effectively. Deficiencies are commonly assessed according to the likelihood and magnitude of a potential misstatement, loss, or non-compliance. A significant deficiency is important enough to merit attention by those charged with governance, while a material weakness is a more severe deficiency or combination of deficiencies creating a reasonable possibility that a material misstatement will not be prevented or detected promptly. Exact definitions and reporting duties depend on the applicable auditing and regulatory framework.

When communicating a deficiency, the auditor should describe:

• the condition identified;
• the relevant criterion or expected control;
• the underlying cause, where known;
• the possible or actual effect;
• the risk and significance;
• the recommendation; and
• management’s response and planned corrective action.

A useful communication is factual and non-accusatory. It distinguishes evidence from speculation and avoids overstating the conclusion. For example, rather than writing “management failed to control purchasing,” an auditor might write: “In 3 of 20 sampled purchase transactions, evidence of approval before commitment was not available. This increases the risk of unauthorised expenditure. Management should configure the system to prevent release of purchase orders without approval and review the existing population for exceptions.”

Deficiencies should be reported to the appropriate level of management and, when significant, to those charged with governance. The auditor should also consider whether the deficiency affects the audit strategy, management representations, fraud risk assessment, or reporting responsibilities.

7. Applied Case: Riverside Office Supplies

Background

Riverside Office Supplies is an illustrative small wholesaler. It sells goods to local businesses and processes approximately 1,200 sales invoices each month. The company recently introduced cloud accounting software. The owner performs many management functions, while one bookkeeper records sales, receives customer payments, and prepares bank reconciliations.

Problem

During an audit, the auditor observes that the bookkeeper can create customers, issue credit notes, record receipts, and reconcile the bank account. Credit notes are often approved verbally. The sales system automatically calculates invoice totals, but the product price file can be changed by the bookkeeper without independent review. Two customer accounts contain unusual credit balances.

Analysis

The principal risks are:

• fictitious or unauthorised credit notes could reduce revenue;
• customer receipts could be misappropriated and concealed through accounting entries;
• unauthorised price changes could cause inaccurate revenue and receivables;
• unusual credit balances may indicate errors, unapplied receipts, or improper adjustments.

The control environment is weakened by excessive concentration of duties. The automated invoice calculation may be reliable, but reliance on it is limited if access to the price file is unrestricted and system change logs are not reviewed.

Approach and Solution

The auditor recommends that Riverside:

1. restrict price-file changes to an authorised manager;
2. require documented approval for all credit notes above a defined threshold;
3. separate receipt processing from bank reconciliation where possible;
4. arrange an independent monthly review of the bank reconciliation;
5. review user access quarterly and remove unnecessary privileges;
6. investigate the two credit balances and document their resolution; and
7. produce a monthly report of price changes, credit notes, and unusual customer balances.

The auditor tests a sample of credit notes, inspects the new approval trail, reviews access rights, and reperforms selected bank reconciliations. The auditor also performs substantive procedures over revenue and receivables because controls were not operating effectively for part of the period.

Outcome and Learning Points

After implementation, the owner receives exception reports and an independent adviser reviews reconciliations monthly. The redesigned controls reduce the opportunity for concealment and improve accountability, although the owner remains responsible for ensuring that reviews are genuine and documented.

The case demonstrates that control evaluation requires more than checking whether software exists. The auditor must understand access rights, human responsibilities, exception handling, evidence of review, and the relationship between automated and manual controls.

8. Technology, Data Analytics, and AI

Technology can strengthen internal control through automated approvals, audit trails, continuous monitoring, and analysis of complete transaction populations. Data analytics may identify duplicate payments, transactions outside normal hours, round-dollar amounts, unusual supplier bank-account changes, or credit notes issued after collection.

However, technology creates additional risks. Weak passwords, excessive access privileges, poor interface controls, unauthorised program changes, unreliable master data, and cyberattacks can undermine automated controls. Artificial intelligence may assist with anomaly detection and document classification, but its outputs require governance. Organisations should establish rules for data quality, model access, change control, explainability, human review, and retention of evidence. An AI-generated risk flag is an indicator for investigation, not automatically proof of fraud or error.

Auditors should understand the reliability of data used in analytics. They may reconcile extracted data to the accounting ledger, test completeness of the population, inspect system-generated parameters, and validate the logic used to identify exceptions. Privacy and confidentiality requirements must also be observed.

9. Limitations, Ethics, and Good Practice

Internal control has inherent limitations. People may misunderstand instructions, become careless, face pressure, collude, or deliberately override procedures. Controls may become obsolete when products, staff, systems, or regulations change. Cost-benefit considerations also mean that organisations cannot eliminate every risk.

Ethical control evaluation requires integrity, objectivity, confidentiality, professional competence, and due care. Auditors should not design controls and then independently provide assurance over their own work without addressing the resulting self-review threat. They should protect sensitive information, avoid conflicts of interest, and report significant concerns through appropriate channels.

Good practice includes:

• linking every important control to a clearly defined risk;
• assigning an accountable owner and backup responsibility;
• maintaining evidence of performance and review;
• restricting system access according to job requirements;
• reviewing controls after significant change;
• investigating exceptions rather than merely clearing them;
• using independent monitoring for high-risk areas; and
• following up agreed corrective actions.

Chapter Summary

Internal control is an organisation-wide process designed to provide reasonable assurance over operations, reporting, and compliance. Its main components are the control environment, risk assessment, control activities, information and communication, and monitoring. Control activities include authorisation, verification, reconciliation, physical protection, segregation of duties, performance review, and exception reporting.

Control evaluation requires the auditor to understand processes, identify risks, assess control design and implementation, perform walkthroughs, test operating effectiveness, and evaluate deviations. Narratives, flowcharts, and control matrices provide useful documentation. Deficiencies should be communicated clearly by describing the condition, criterion, cause, effect, risk, recommendation, and management response.

Technology can improve control efficiency and provide powerful analytical evidence, but it also creates access, data quality, cyber-security, and change-management risks. Effective controls remain subject to human and organisational limitations, so monitoring, ethical leadership, and continual improvement are essential.

Key Terms

Application control: A control embedded in a specific information system or transaction-processing application.

Control activity: A policy or procedure designed to address a risk.

Control deficiency: An absence, design weakness, implementation problem, or operating failure in a control.

Control environment: The governance, ethical, structural, and accountability foundation of internal control.

Control objective: The result that a control is intended to achieve.

Control matrix: A document linking objectives, risks, controls, evidence, and tests.

Corrective control: A control that remedies an identified error or undesirable event.

Detective control: A control that identifies an event after it has occurred.

Design effectiveness: The ability of a control, if properly operated, to address a relevant risk.

Exception report: A report identifying transactions or conditions outside defined parameters.

Inherent risk: Risk existing before the effect of related controls is considered.

IT-dependent manual control: A human review or action based on information produced by an information system.

Monitoring: Activities used to assess whether controls continue to operate effectively.

Preventive control: A control intended to stop an undesirable event before it occurs.

Residual risk: Risk remaining after controls are applied.

Segregation of duties: Division of incompatible responsibilities among different people.

Test of controls: An audit procedure designed to evaluate whether a control operated effectively.

Walkthrough: Tracing a transaction through a process to confirm understanding and identify control points.

Review Questions

Short Answer Questions

1. What are the three broad categories of objectives supported by internal control?
2. Distinguish between preventive, detective, and corrective controls.
3. Why is segregation of duties important?
4. What is the purpose of a walkthrough?
5. State two procedures that may be used in a test of controls.

Long Answer Questions

1. Explain the five components of internal control and show how they operate as an interconnected system.
2. Describe how an auditor evaluates the design and implementation of a control.
3. Explain the role of information systems and general IT controls in financial reporting.
4. Discuss the causes and limitations of internal control deficiencies.
5. Explain the information that should be included in a communication of a significant control deficiency.

Analytical / Application Questions

1. A small business owner authorises purchases, receives goods, records invoices, and approves payments. Identify the principal risks and recommend practical compensating controls.
2. An auditor finds that 4 of 25 sampled monthly reconciliations have no evidence of independent review. Explain the further work needed before concluding on the control’s operating effectiveness.
3. A company uses AI to identify unusual supplier payments. Analyse the governance, data quality, access, and human-review controls needed before auditors rely on the resulting exception report.

Multiple Choice Questions with Answers

Question 1

Which component of internal control provides the foundation for the other components?

A. Control environment

B. Control activity

C. Monitoring activity

D. Exception reporting

Correct Answer: A. Control environment

Question 2

Which of the following is a preventive control?

A. A bank reconciliation

B. A post-payment exception report

C. A purchase order approval before commitment

D. A correction of an erroneous journal entry

Correct Answer: C. A purchase order approval before commitment

Question 3

What is the principal purpose of a walkthrough?

A. To prove that a control operated throughout the year

B. To confirm understanding of a process and identify control points

C. To replace all substantive audit procedures

D. To calculate the organisation’s tax liability

Correct Answer: B. To confirm understanding of a process and identify control points

Question 4

Which procedure generally provides the strongest evidence that a reconciliation was correctly performed?

A. Inquiry alone

B. Reading the organisation’s policy manual

C. Reperformance of the reconciliation

D. Asking the preparer whether it was accurate

Correct Answer: C. Reperformance of the reconciliation

Question 5

A control is design-effective when it:

A. Has been documented by the external auditor

B. Could address the relevant risk if properly operated

C. Has operated without any deviation for ten years

D. Is fully automated

Correct Answer: B. Could address the relevant risk if properly operated

Question 6

Which control best addresses the risk that an employee creates a fictitious supplier and pays that supplier?

A. Independent approval of supplier master-file changes

B. A monthly sales budget review

C. A physical count of office furniture

D. A review of customer credit balances

Correct Answer: A. Independent approval of supplier master-file changes

Question 7

Why may reliance on an automated application control be reduced when general IT controls are weak?

A. Automated controls never produce audit evidence

B. Weak access or change controls may undermine the system’s processing reliability

C. Manual controls are always more effective

D. Application controls only apply to paper documents

Correct Answer: B. Weak access or change controls may undermine the system’s processing reliability

Question 8

Which information is most appropriate in a deficiency communication?

A. Only the name of the employee responsible

B. The condition, risk or effect, recommendation, and management response

C. An unsupported statement that fraud definitely occurred

D. A general statement that controls should improve

Correct Answer: B. The condition, risk or effect, recommendation, and management response

Question 9

A control that identifies an error after it has occurred is classified as:

A. Preventive

B. Detective

C. Directive

D. Compensating only

Correct Answer: B. Detective

Question 10

Which statement best describes the assurance provided by internal control?

A. Absolute assurance that fraud cannot occur

B. Reasonable assurance, subject to inherent limitations

C. Assurance limited only to tax compliance

D. No assurance unless every control is automated

Correct Answer: B. Reasonable assurance, subject to inherent limitations