Internal Control, Audit and Risk Management

Introduction

Internal control, audit and risk management are closely connected disciplines that support reliable reporting, efficient operations, legal compliance and responsible governance. In an internship, accounting and finance students may be asked to document a process, test approval controls, reconcile accounts, investigate unusual transactions, or update a risk register. These tasks require more than checking whether documents exist. They require professional judgement about whether controls address relevant risks and whether available evidence supports a conclusion.

Internal control is a process carried out by an organisation’s board, management and employees to provide reasonable—not absolute—assurance that objectives will be achieved. Internal audit provides independent and objective assurance and advisory services. Risk management identifies and evaluates uncertainty that may prevent the organisation from achieving its objectives.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and limitations of internal control.
2. Apply the COSO framework to document and assess controls.
3. Identify financial, operational, compliance and technology risks.
4. Perform basic audit procedures and distinguish evidence types.
5. Design a simple sampling approach and explain sampling risk.
6. Document findings and recommend proportionate improvements.
7. Evaluate ethical, governance and technology-related implications.

1. Internal Control as a Governance Process

A control is an action, policy, procedure or system configuration intended to prevent, detect or correct an unwanted event. Controls may be:

• Preventive: stop an error or fraud before it occurs, such as approval limits.
• Detective: identify an event after it occurs, such as a bank reconciliation.
• Corrective: restore the process, such as reversing an unauthorised journal entry.
• Manual: performed by people, such as reviewing a supplier invoice.
• Automated: performed by an information system, such as blocking duplicate invoice numbers.
• IT general controls: support reliable systems, including access management, change management and backup controls.
• Application controls: operate within a particular system, such as validation of a purchase order.

A control should be assessed against its objective. For example, “the finance manager signs invoices” is not automatically an effective control. The assessor must ask whether the manager is authorised, whether the review is timely, whether the reviewer examines sufficient information, and whether evidence of review is retained.

Internal control has inherent limitations. Human judgement may be wrong, employees may collude, management may override controls, costs may exceed benefits, and unusual events may not have been anticipated. Consequently, a well-controlled organisation still faces residual risk.

2. The COSO Internal Control Framework

The COSO Internal Control—Integrated Framework identifies five mutually reinforcing components:

1. Control environment: integrity, ethical values, competence, accountability, organisational structure and oversight.
2. Risk assessment: identifying and analysing risks to objectives, including fraud and change-related risks.
3. Control activities: authorisations, reconciliations, segregation of duties, reviews and physical safeguards.
4. Information and communication: obtaining and communicating relevant information internally and externally.
5. Monitoring activities: ongoing or separate evaluations of whether controls continue to operate effectively.

The components operate together as an integrated system, not as a one-way sequence. For example, a strong control environment influences risk assessment, while monitoring results may lead management to revise control activities, information flows or risk assessments. The relationships are interactive and may be iterative.

Figure: COSO components operate together through mutually reinforcing relationships rather than a linear sequence.

COSO also links components to three objective categories: operations, reporting and compliance. The framework may be applied at entity, division, operating-unit and functional levels.

3. Risk Identification and Assessment

Risk is the possibility that an event will affect the achievement of objectives. A practical risk assessment identifies the objective, event, cause, consequence, existing controls, control owner and proposed response.

Common categories include:

Many organisations use a qualitative risk score. A simple inherent-risk score is:

where R is the risk score, L is likelihood and I is impact. If each is rated from 1 to 5, scores range from 1 to 25. This is a prioritisation aid, not a probability calculation. The ratings must be defined consistently; multiplying ordinal ratings does not prove that one risk is exactly twice as likely or severe as another.

Inherent risk is assessed before considering controls. Residual risk is the exposure remaining after controls operate. A risk response may involve accepting, reducing, transferring or avoiding the risk. A control gap exists where controls are absent, poorly designed, inadequately implemented or not operating consistently.

4. Documenting Processes and Controls

A useful process narrative records the transaction flow, responsible personnel, systems, documents, approvals, reconciliations and exceptions. A flowchart can show the sequence, but a control matrix makes assessment more systematic.

A well-written control statement identifies who performs the control, what is reviewed, when it occurs, how exceptions are resolved and what evidence is retained. “Accounts staff check invoices” is weak documentation; “The accounts supervisor reviews the invoice, purchase order and goods-received note before payment release and documents exceptions in the workflow system” is more testable.

5. Basic Audit Procedures and Evidence

Audit procedures should be linked to an assertion, risk and control objective. Common procedures are:

• Inspection: examining records, contracts, approvals or system logs.
• Observation: watching a control being performed; it provides evidence about that occasion, not necessarily all periods.
• Inquiry: asking knowledgeable personnel; inquiry alone is usually weaker than corroborated evidence.
• Confirmation: obtaining information directly from an independent third party.
• Recalculation: checking mathematical accuracy.
• Reperformance: independently executing a control or procedure.
• Analytical procedures: evaluating plausible relationships, trends and unexpected fluctuations.

Evidence should be sufficient and appropriate. Sufficiency concerns quantity; appropriateness concerns relevance and reliability. Evidence obtained directly by the auditor, from independent sources, or generated by a reliable system is generally stronger than unsupported oral explanations. However, reliability depends on circumstances, including the effectiveness of related IT controls.

Audit working papers should state the objective, population, period, selection method, procedures performed, evidence inspected, exceptions, conclusion, preparer and reviewer. An exception should be recorded factually, without overstating its significance.

6. Sampling and Sampling Risk

Testing every item is sometimes appropriate, but sampling can provide a practical basis for conclusion when the population is defined and reasonably homogeneous. The population, sampling unit, period, expected error or deviation, tolerable error or deviation, selection method and evaluation approach should be documented.

Sampling risk is the possibility that a sample-based conclusion differs from the conclusion that would be reached by testing the entire population. For controls, the two important risks are:

• Risk of overreliance: concluding that a control works when the true deviation rate is too high.
• Risk of underreliance: concluding that a control does not work when it actually does.

A simple attribute-sampling illustration uses a sample of n items with d deviations. The observed deviation rate is:

If 4 deviations are found in 80 items, p̂ = 4 ÷ 80 = 0.05, or 5%. This observed rate alone does not establish the upper deviation rate because sampling risk remains.

For a rough 95% normal approximation, when the sample is sufficiently large and the estimated proportion is not near 0 or 1, the standard error is:

Using p̂ = 0.05 and n = 80, SE ≈ √(0.05 × 0.95 ÷ 80) ≈ 0.0244. A rough upper 95% bound is p̂ + 1.645 × SE ≈ 0.05 + 0.040 = 0.090, or approximately 9.0%. This approximation is illustrative, not a substitute for an appropriate exact or audit-sampling method; with only four deviations, a binomial or exact one-sided bound is generally preferable.

The conclusion must compare the estimated or upper deviation rate with the tolerable deviation rate established before testing. If the upper bound exceeds tolerable deviation, the auditor should not conclude that the control is effective without further work. Possible responses include increasing the sample, investigating exceptions, testing a compensating control or revising the assessment. A sample size is not justified merely by selecting a convenient percentage of the population.

7. Worked Application: Northbridge Retailers

Background

Northbridge Retailers, an illustrative company, processes approximately 12,000 supplier invoices annually. An intern is asked to assess whether payments are properly authorised and whether supplier-master changes are controlled.

Problem

The written policy requires a purchase order, evidence of receipt and approval by an authorised manager. However, the enterprise system permits accounts-payable staff to create suppliers and release payments. The same employee may therefore introduce a supplier and process its invoice.

Analysis

The risks include fictitious suppliers, duplicate payments, management override and incomplete audit trails. The control environment is weakened by poor segregation of duties. The risk score, using a 1–5 likelihood and impact scale, is assessed as 4 × 5 = 20, a high prioritisation score. This is a qualitative score and is not presented as a monetary expected loss.

The intern maps the process and identifies these controls:

1. Procurement approves purchase orders.
2. Receiving staff record goods received.
3. Accounts payable performs a three-way match.
4. A manager approves payment batches.
5. The finance manager reviews supplier-master changes monthly.

The intern selects a documented sample using a random method, tests the three-way match and inspects supplier-change logs. Exceptions are classified by cause rather than simply counted. One invoice lacks evidence of receipt, and two supplier changes lack independent approval. The working paper records invoice numbers, dates, evidence inspected, exception descriptions and management responses, while protecting confidential personal and banking information.

Approach and recommendations

Management should separate supplier creation from payment processing, require independent approval for bank-account changes, configure duplicate-invoice alerts, review exception reports weekly and retain workflow evidence. A compensating control—such as a daily independent review of new suppliers and payment releases—may reduce risk temporarily, but it should not be treated as equivalent to proper segregation if the reviewer lacks time, authority or adequate information.

Outcome and learning points

The case demonstrates that a control may exist in policy but fail in design or operation. Effective recommendations identify the risk addressed, the responsible owner, implementation date and measure of completion. Students should also distinguish a control deficiency from proven fraud: missing approval is evidence of a control exception, not by itself proof that fraud occurred.

8. Ethics, Governance and Technology

Internal control work involves access to payroll data, bank details, customer information and commercially sensitive records. Practitioners should maintain confidentiality, avoid conflicts of interest, preserve evidence and report suspected wrongdoing through approved channels. They should not alter working papers to make results appear better or accept management explanations without corroboration.

Governance responsibilities should be clear. Management owns controls and risk responses; the board or audit committee oversees risk and assurance; internal audit evaluates controls independently; external audit provides an opinion within its defined engagement scope. Internal audit must avoid assuming management responsibility for designing or operating controls it later assesses.

Technology creates both control opportunities and risks. Continuous monitoring can analyse unusual journal entries, duplicate invoices, unusual login times or changes to supplier bank accounts. Artificial intelligence may prioritise transactions for review, but it does not remove the need for human accountability. Models can produce false positives, miss novel fraud, embed biased training data or be manipulated. Organisations should document data sources, access rights, model changes, validation results, override decisions and retention requirements.

9. Limitations and Best Practices

No framework guarantees the absence of error or fraud. Risk ratings can be subjective; evidence may be incomplete; controls may deteriorate after staff turnover or system changes; and sampling cannot eliminate uncertainty. Audit work is also constrained by scope, time, access and the quality of records.

Best practice includes:

• start with objectives and risks rather than a checklist;
• assign a named control owner;
• distinguish design effectiveness from operating effectiveness;
• define tolerable deviations before testing;
• retain clear, reproducible evidence;
• investigate exceptions and consider their root causes;
• use independent review for high-risk judgements;
• update risk assessments after incidents, system changes or regulatory developments;
• communicate limitations and unresolved issues honestly.

Chapter Summary

Internal control is an integrated process that provides reasonable assurance over operations, reporting and compliance. The COSO framework comprises the control environment, risk assessment, control activities, information and communication, and monitoring activities. These components interact rather than operate as a one-way sequence. Risk assessment distinguishes inherent from residual risk and helps prioritise controls. Control documentation should connect objectives, risks, control activities, evidence and testing procedures. Audit evidence may be obtained through inspection, observation, inquiry, confirmation, recalculation, reperformance and analytical procedures. Sampling introduces risk, so observed deviations should be evaluated against a tolerable rate while allowing for an upper deviation rate. Effective recommendations are specific, proportionate, ethical and assigned to accountable owners. Technology and AI can strengthen monitoring but require governance, validation and human oversight.

Key Terms

Control: An action or mechanism intended to prevent, detect or correct an unwanted event.

Control environment: The ethical, structural and governance foundation of internal control.

Control objective: The desired result that a control is intended to support.

Control activity: A policy or procedure that addresses a risk.

Design effectiveness: Whether a control, if performed as intended, can address the relevant risk.

Operating effectiveness: Whether a suitably designed control operated consistently during the relevant period.

COSO: A widely used framework for internal control and enterprise risk management concepts.

Inherent risk: Risk assessed before considering controls.

Residual risk: Risk remaining after controls are considered.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Segregation of duties: Dividing authorisation, custody, recording and reconciliation responsibilities.

Audit evidence: Information used to support audit conclusions.

Reperformance: Independently executing a control or procedure to verify its result.

Population: The complete set of items from which a sample is selected.

Sampling risk: The risk that a sample conclusion differs from a conclusion based on the entire population.

Tolerable deviation rate: The maximum control-deviation rate acceptable for the planned reliance.

Exception: A departure from a specified policy, control or expected condition.

Management override: Deliberate circumvention of controls by authorised personnel.

Continuous monitoring: Ongoing analysis of control or transaction information.

Review Questions

Short Answer Questions

1. What is the difference between preventive and detective controls?
2. Name the five COSO components.
3. Why is internal control assurance described as reasonable rather than absolute?
4. Distinguish sufficiency from appropriateness of audit evidence.
5. What is sampling risk?

Long Answer Questions

1. Explain how the COSO components interact and why they should not be represented as a linear process.
2. Describe how a risk-and-control matrix can be used to plan internal control testing.
3. Compare inspection, observation, inquiry, confirmation and reperformance as evidence-gathering procedures.
4. Explain the difference between design effectiveness and operating effectiveness, using an example.
5. Discuss the ethical and governance responsibilities of management, internal audit and the audit committee.

Analytical / Application Questions

1. A company allows one employee to create suppliers, approve invoices and release payments. Identify the risks, evaluate the control design and recommend improvements.
2. In a sample of 80 invoices, four deviations are found. Calculate the observed deviation rate and explain why the auditor should consider an upper deviation rate before concluding on control effectiveness.
3. An AI monitoring tool flags many unusual transactions but provides little explanation. Analyse the governance risks and propose controls over the tool.

Multiple Choice Questions with Answers

Question 1

Which COSO component concerns integrity, ethical values, accountability and organisational structure?

A. Control environment

B. Risk assessment

C. Control activities

D. Monitoring activities

Correct Answer: A. Control environment

Question 2

A monthly bank reconciliation is primarily what type of control?

A. Preventive

B. Detective

C. Strategic

D. Corrective-only

Correct Answer: B. Detective

Question 3

If likelihood is rated 4 and impact is rated 5 on the chapter’s qualitative scale, what is the prioritisation score?

A. 9

B. 16

C. 20

D. 25

Correct Answer: C. 20

Question 4

Which procedure involves independently executing a control to verify its result?

A. Inquiry

B. Observation

C. Inspection

D. Reperformance

Correct Answer: D. Reperformance

Question 5

A sample contains 4 deviations in 80 items. What is the observed deviation rate?

A. 2.5%

B. 5%

C. 8%

D. 20%

Correct Answer: B. 5%

Question 6

Why must sampling risk be considered when evaluating a control sample?

A. A sample always contains every population item

B. The sample conclusion may differ from the conclusion for the whole population

C. Sampling eliminates the need for tolerable deviation rates

D. Sampling proves that fraud did not occur

Correct Answer: B. The sample conclusion may differ from the conclusion for the whole population

Question 7

Which situation most clearly demonstrates segregation-of-duties weakness?

A. One employee prepares a reconciliation reviewed by a supervisor

B. One employee creates suppliers and releases payments

C. A manager approves a purchase order within an authority limit

D. Receiving staff record goods received

Correct Answer: B. One employee creates suppliers and releases payments

Question 8

Residual risk is best defined as:

A. Risk before any controls are considered

B. Risk transferred to an external auditor

C. Risk remaining after controls are considered

D. Risk that has already caused a loss

Correct Answer: C. Risk remaining after controls are considered

Question 9

Which evidence is generally obtained directly from an independent third party?

A. Internal inquiry

B. External confirmation

C. Management representation only

D. An unsigned internal checklist

Correct Answer: B. External confirmation

Question 10

What is the most appropriate conclusion when a sample’s estimated upper deviation rate exceeds the tolerable deviation rate?

A. Conclude automatically that the control is effective

B. Ignore the exceptions if the sample was random

C. Perform further evaluation or revise reliance on the control

D. Treat every exception as proven fraud

Correct Answer: C. Perform further evaluation or revise reliance on the control