Internal Controls

What Are Internal Controls?

Internal controls are the processes, policies, and checks a company uses to keep its operations orderly and its records accurate. Management designs them and employees carry them out, usually with oversight from the board of directors. Their main goals are to safeguard assets, prevent and detect errors or fraud, make sure financial statements are reliable, and help the company follow applicable laws and rules.

Internal controls cover much more than accounting. A retailer might use them to limit who can change inventory counts, while a software company might use them to control who can approve code changes. Many organizations rely on the widely used framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), which describes controls as built around components such as the control environment, risk assessment, control activities, information and communication, and monitoring.

Common Types of Controls

• Segregation of duties: no single person controls every step of a transaction, such as both recording and approving a payment.
• Authorization: transactions must be approved by someone with the right level of authority.
• Reconciliations: account balances are compared with independent records, such as bank statements, to catch differences.
• Access restrictions: systems and physical assets are limited to people who need them.
• Independent review: an internal audit function or supervisor checks work after the fact.

Controls are often described as preventive (stopping problems before they happen), detective (finding problems after they occur), or corrective (fixing what was found).

Why Internal Controls Matter to Investors

For investors, internal controls offer a way to judge how much confidence to place in reported numbers. In the United States, the Sarbanes-Oxley Act of 2002 requires public companies to have management assess the effectiveness of their internal control over financial reporting, and larger companies must also have their auditor evaluate it. A company that discloses a material weakness has identified a serious gap that could lead to a material misstatement of its financials. Such disclosures can signal higher risk, though they do not by themselves mean fraud has occurred.

Controls have limits. Human error, poor judgment, collusion among employees, and changing conditions can all defeat them, so even well-designed systems provide reasonable assurance rather than a guarantee. Reading a company's annual report and its auditor's comments can help investors understand how it manages these risks.