Kezia Farnham

Senior Manager

Understanding internal controls: Definition, types and examples

Internal controls are a process that helps ensure a company’s system is secure, reliable and compliant with relevant regulations. Though controls like requiring a username and password or putting purchasing limits on company credit cards may seem simple, the stakes are high.

One-third of all fraud committed in 2020 resulted from weaknesses in internal controls. The SEC also takes internal controls seriously, having monitored and charged organizations that don’t resolve internal control failures.

This article will help you strengthen your system and remain in compliance by explaining:

• What internal controls are
• Why internal controls are important
• The three types of internal controls
• Examples of internal controls in an organization
• Additional resources on implementing and maintaining controls

What are internal controls?

Internal controls are essential for businesses to ensure that their systems are secure. Controls have different components and are usually rooted in an organization’s systems. Employees may engage with a control structure daily — like inputting credentials to unlock a point of sale — without realizing they are following an intentional security protocol.

But whether employees know it or not, these controls prevent breaches, fight back against fraud and ensure that only authorized users can access sensitive systems and information.

What is the purpose of internal controls?

The primary purpose of internal controls is to secure a business’s information and assets. An internal controls system minimizes risk and promotes compliance as a business pursues its objectives.

They’re also a critical form of documentation to assure the board and other key stakeholders that:

• The company’s information is reliable and credible
• The organization complies with relevant laws and regulations
• The company’s assets are secure from fraud or breach
• The company put resources to good use
• Operations and programs are functioning as intended

Why are internal controls important?

Internal controls are important because they protect an organization’s systems, data and assets. As significant as security is, the importance of strong internal controls is even further reaching than that.

An effective framework for internal controls can help organizations:

1. Implement processes: When internal controls are in place, employees know the processes and procedures they should follow. This strengthens the company because employees understand their expectations and can securely engage with systems and data.
2. Reduce fraud: A key tenet of internal controls is segregating duties, meaning the person undertaking an action isn’t also the person approving it. For example, an employee purchasing new laptops for the sales department shouldn’t be the same employee who approves the purchase order. This ensures that all actions are meaningful and necessary and reduces fraud.
3. Improve financial reporting: Financial statements can be difficult to produce if the organization’s transactions aren’t regularly available. Having controls around how and when employees should report transactions paves the way for more accurate financial statements, enabling leadership to make more informed decisions involving the company’s finances.
4. Identify errors: Mistakes happen. It’s all too easy to transpose digits or enter a figure on the wrong line. The purpose of internal controls like automation is to help organizations catch and fix those errors before they cause costly reputational damage.

3 types of internal controls

There are many different internal controls, but they typically fall into three different categories. All organizations should aim to have controls that align with these internal control types:

1. Preventative controls: This control group encompasses any internal control that prevents risky actions from occurring, such as application controls.
2. Corrective controls: These are the controls that come into play after the system detects an issue or error.
3. Detective controls: Also called mitigating controls, these are the actions and processes that sound the alert if an error occurs. These controls are an important way to stop breaches before they lead to more costly damage.

Examples of internal controls

Every organization may need slightly different internal controls to ensure their systems and data are secure. However, some internal controls are fairly common, no matter the organization and industry.

Some common examples of internal controls are:

Transaction authorization: A preventative control

Most organizations have employees who will make purchases on the organization’s behalf. A common preventative control for this situation is to have a process for authorizing that transaction.

For example, a technology company has recently hired three new website developers. The website development manager needs to purchase a laptop and monitor for each developer. To do that, they’ll have to follow several controls. The process might look like this:

1. The manager submits a purchase order to the accounting department
2. The accounting department approves the purchase order
3. The manager uses the purchase order to buy the approved equipment
4. The manager gives a receipt to the accounting department

Reconciliation: A detective control

In the above scenario, the organization likely has multiple departments making various monthly purchases.

At the end of the month, an accountant or accounting department should reconcile all those transactions — an important internal control to detect transactions that are either fraudulent or do not comply with business policies or industry regulations.

A reconciliation internal control might require the accounting team to:

• Issue approvals for certain transactions
• Collect receipts or expense reports for all spending or both
• Check transactions against those receipts
• Report to senior leadership if any transactions don’t match receipts

Learn more about internal controls

Internal controls are a process that can rapidly evolve along with the business and risk landscape. The more types of risks there are, the more internal controls a business will need.

That’s why risk management isn’t just about implementing effective controls but about staying abreast of the organization’s security needs and the internal controls that can satisfy them.

Learn more about internal controls, including their potential weaknesses and components, and how documenting and automating your internal controls can create a more threat-resistant IT infrastructure.