Internal Control, Assurance and Responses to Risk
Core concepts
Internal control is a process designed to provide reasonable - not absolute - assurance over operations, reporting and compliance. The COSO Internal Control framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Control activities include authorisation, segregation of duties, reconciliation, physical and logical access, and performance reviews.
Classify controls by timing: preventive, detective and corrective; and by form: manual, automated, and IT-dependent manual. Key controls are those that, if they fail, would allow a material error to go undetected.
Testing distinguishes design effectiveness (is the control, as described, capable of addressing the risk?) from operating effectiveness (did it operate consistently throughout the period?). A walkthrough confirms understanding and design; a test of operating effectiveness requires evidence across the period, including the population's completeness. Deficiencies are graded as deficiency, significant deficiency or material weakness, considering compensating controls, likelihood and magnitude.
Assurance mapping shows how each risk is covered across the three lines, avoiding gaps and duplication. Root-cause analysis prevents repeat findings; remediation requires an owner and a date, and must itself be verified.
Traps in questions
- Concluding a control is effective because a sample had no exceptions - without confirming the sample came from a complete population.
- Confusing a walkthrough (design/understanding) with a test of operating effectiveness.
- Assuming a compensating control eliminates a deficiency rather than reducing its severity.
- Ignoring that a well-designed control can still have an operating deficiency.
Worked example
A monthly reconciliation is properly designed, with independent review and sign-off. Testing finds the reviewer signed off in all 12 months, but for 5 months there was no supporting reconciliation attached and no evidence of follow-up on a $200k unreconciled item. The control is designed effectively but not operating effectively. Given the amount and the missed follow-up, this may be a significant deficiency and must be reported with a remediation plan and re-test.
Rule of thumb: document design, test operation, prove the population - in that order.