What are internal controls?
Also called: internal control, controls
Last updated
Internal controls are the policies, checks and procedures an organisation builds into its processes to protect its assets, keep its records accurate, follow the law and prevent or detect errors and fraud. Examples include approvals, segregation of duties, reconciliations, access restrictions and reviews, and each one is tested regularly to confirm it works.
In more detail
Controls are often described as preventive, which stop a problem happening, such as an approval before payment, or detective, which find it afterwards, such as a monthly reconciliation. They can be manual, automated in a system, or a mix. The COSO framework, widely used for designing and assessing internal control, groups them into five components.
In the United States, the Sarbanes-Oxley Act requires public companies to assess their internal control over financial reporting each year. Every control needs an owner, a description of how it operates and evidence each time it does.
Example
A company’s control over supplier payments has four parts: a purchase order approved before ordering, a three-way match of order, delivery and invoice, a second person approving each payment run, and a monthly review of changes to supplier bank details.
Internal controls in CheckFlow
In CheckFlow a manual control can run as a checklist on its own schedule, with the steps assigned to the control owner and a reviewer, the evidence uploaded in File Upload fields and the activity feed recording each step. Testing a sample of controls can run the same way.
Related terms
Templates with a live demo
Each one opens as a live checklist you can try without signing up.
Run your next process as a checklist.
Build it once as a template, then run it with owners, due dates and a record of every step.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request