Kezia Farnham

Senior Manager

The 6-step process for evaluating internal controls

For any business, risk management is the foundation for effective and sustainable finances and operations. Yet risk management is only as strong as internal controls: the processes and procedures that safeguard company information and assets. Internal control evaluations reinforce that foundation.

When internal controls are effective, they mitigate financial, operational and regulatory compliance risks. When weak, they can create gaps through which fraud and other harmful activity can take hold. Internal controls evaluation — also called internal controls assessment — is the best way to catch weaknesses before they become credible threats.

This article will help you turn internal controls evaluations into a tool for strategic risk management by explaining:

• What an evaluation of internal controls is, and why it’s important
• Who is responsible for assessing internal controls
• Factors to consider during an internal controls assessment
• The six steps to evaluate your internal controls system

What is an evaluation of internal controls?

An internal controls evaluation reviews an internal controls system to detect deficiencies proactively. These deficiencies can arise for numerous reasons, like employees misunderstanding controls or controls falling out of step with recent regulations. In any case, they can prevent internal controls from effectively reducing risk.

Evaluating internal controls involves reviewing the controls’ different components to determine whether the controls are operating effectively and, if not, recommend a path to improvement.

Who assesses internal controls?

Who assesses internal controls depends on the purpose of the assessments. External parties may complete an internal controls evaluation to prepare for a more formal audit. In contrast, internal parties may complete more regular evaluations as part of the organization’s risk management protocol.

Internal audit

The internal audit team oversees an organization’s risk management program and internal controls. As such, internal auditors should regularly assess the internal controls system to ensure all controls function as intended. These checks are vital, yet informal, ways to assess your audit readiness and overall risk exposure.

External audit

Unlike internal audit, external audit is typically more formal. Before they conduct a more thorough audit, an external auditor will complete an internal controls evaluation to determine which areas the audit should prioritize. How they evaluate your internal controls will depend on what they’re auditing for, like a SOX or NIST audit.

Why is internal controls evaluation important?

Internal controls evaluation is a critical part of an effective internal controls system. While internal controls prevent fraud and reduce the risk of regulatory infractions, regular assessments validate the success of those controls.

It’s an opportunity for boards, their audit committee and leadership teams to get visibility into their internal controls system and gain the information they need to make better decisions about risk. It can also pave the way for smoother audits since audit teams can use assessments to proactively shore up internal control processes.

What are some factors to consider when assessing internal controls?

Part of assessing internal controls is narrowing your focus on the most important factors. Depending on the reason for the review, you may not need to assess every control in every system. Consider instead:

• Limitations: Internal controls have inherent limitations, including human error and inconsistent controls. Assess common limitations regularly and look for opportunities to mitigate them.
• Weaknesses: Internal controls can weaken in many different areas. Focus your evaluations on those areas, whether hardware, operations, access or more.
• Operational problems: The operation of internal controls can go awry if the control doesn’t function as intended or even if employees don’t know how to execute the control properly.
• Design problems: The internal control may also warrant review if it is not in place or if the control is in place but is ineffective.

The 6 steps to evaluate your internal control system

Evaluating internal controls has only become more challenging in recent years. The amount of controls has surged to keep up with heightened regulations and increasing cybersecurity risk. This also challenges audit teams to evaluate their controls adequately.

Here’s how to get started:

1. Assess your culture of compliance: Internal controls are most effective when they operate in a receptive environment. Assess the attitude your employees and your entire organization have toward controls and compliance, then analyze how that attitude may contribute to the success or failure of your internal controls.
2. Analyze risk exposure: Different organizations face different risks. Understand first which risks you face, then prioritize them based on which would be most costly if it came to pass. Use your risk landscape to identify which controls to assess when.
3. Review controls: Evaluate your controls and the structures that support them. This includes processes like two-factor authentication or requiring employees to log out of computers not in use, as well as control documentation and training.
4. Evaluate internal communications: Audit teams should communicate clearly about internal controls to boards who need assurance and employees who need to enact them. Review the communication system to ensure reports are accurate and easily understandable for all audiences.
5. Inspect monitoring systems: Organizations should take an always-on approach to internal control evaluation. Assess how often you monitor control activities and how effective that monitoring is.
6. Report on your evaluation: Internal control assessments can have many different audiences. Boards and executives, in particular, will want to know whether any deficiencies require fixing. Develop clear and transparent reporting structures to offer your organization the assurance they need.

Internal controls evaluation best practices

As you enact the above process, consider these best practices to make your evaluation a true strategic advantage:

• Focus on the most relevant controls: It may not be possible to review every control each time you complete an evaluation. Start with those that, if they fail, could pose serious risks to your organization. This ensures your evaluation will turn up the most valuable insights, rather than reviewing repetitive, easily verified controls.
• Go beyond the existence of controls: Having controls is important, but it’s equally important to evaluate whether those controls are effective. Think of your evaluations less as a checklist and more as an opportunity for uncovering strategic improvements.
• Account for human error: Employees will make mistakes. When they do, it can be easy to confuse their misstep for weak internal control. Make sure you consider why the control is failing. It’s possible additional training will solve that weakness, rather than redesigning the control itself.
• Ensure data accuracy: Your internal controls evaluation is only as robust as your data. Assess the accuracy of your information to ensure it reliably reflects your controls and your organization’s usage of them.
• Don’t stop at significant risks: Audit teams can easily develop tunnel vision around risks they deem critical. While you should evaluate the controls that pertain to these risks, don’t sacrifice smaller risks while doing so. Make sure you’re holistically assessing the internal controls system so you get a more complete picture of your risk and control landscape.

Take an always-on approach to internal controls evaluation

Between tightening and increasing business regulations, running an audit department is more challenging than ever. Completing regular internal controls evaluations can feel like another item on a long list of responsibilities, especially if the audit team is already struggling to keep up.

Modernizing your audit infrastructure is one of the best ways to give your audit team the support they need. Move away from tired spreadsheets and manual processes and instead embrace an optimized audit infrastructure that not only fosters better internal controls evaluations, but an improved internal controls system.

Download the modern audit checklist from Diligent to learn more.