Operations, Internal Controls and Assurance
Controls that actually control
Internal control is the system of policies, processes and behaviours designed to provide reasonable assurance over effectiveness and efficiency of operations, reliability of reporting and compliance. Candidates must know the COSO-style components: control environment, risk assessment, control activities, information and communication, and monitoring. Understand the three lines model and the distinction between internal control (management's system), internal audit (independent assurance on that system) and external audit (opinion on financial statements).
Know the classic control activities: authorisation, segregation of duties, reconciliation, physical safeguards, access controls and exception reporting. Understand the control environment as the foundation - the board and senior management set the tone. Distinguish preventive from detective controls, and know that assurance is the confidence that controls are working, gathered through testing, observation and evidence.
Traps to watch
Questions often ask who owns internal control - the answer is management, not the auditor. Another trap is confusing internal audit independence with external audit independence; internal audit reports to the audit committee for independence but is employed by the organisation. Watch for options that treat a single control failure as proof the whole system is broken, or that assume more controls always mean better control.
Worked example
A payments process has one person who both approves and records transactions. Rule of thumb: no single person should control a transaction end to end. The fix is segregation of duties, or compensating oversight (second signatory, bank reconciliation by another person, audit committee review) where full segregation is impractical.