Internal Control

Internal controls are built into everyday processes. They include approvals, such as requiring a manager to authorise payments above a certain amount; separation of duties, so no single person controls an entire transaction; reconciliations, such as matching bank statements to the accounts; physical controls, such as locked storage; and IT controls, such as passwords and access rights.

For example, a company might require two people to approve any payment over 10,000 and reconcile its bank accounts every month. These controls make it harder for errors or fraud to go unnoticed.

Good internal control reduces the risk of mistakes, theft and misleading financial statements. It also helps managers run the business efficiently.

In some countries, listed companies must formally assess and report on the effectiveness of their internal controls over financial reporting, and auditors must test them. In the United States, this requirement comes from the Sarbanes-Oxley Act.

No system of internal control is perfect. Controls can be overridden by senior management, bypassed through collusion or fail because of human error, so they provide reasonable rather than absolute assurance.