Internal Controls
The Internal Controls domain tests the design and evaluation of controls that prevent or detect error, waste, and fraud. Expect questions on the COSO components, preventive versus detective controls, segregation of duties, authorization, reconciliation, information-technology controls, monitoring, and cost-benefit judgment.
Core rules
- COSO components: control environment, risk assessment, control activities, information and communication, and monitoring.
- Preventive controls stop an event (approval, segregation, access restriction); detective controls find it afterward (reconciliation, audit, exception report).
- Segregate authorization, custody, recording, and reconciliation.
- Use written authorization limits, delegation, and dual signatures above a threshold.
- Maintain an audit trail; never pre-sign checks or leave blank forms.
- IT controls: unique IDs, least privilege, change management, backups, and log review.
- Monitor through management review, internal audit, and surprise counts; correct deficiencies on a schedule.
- Cost-benefit matters, but “too expensive” is not a defense for a control the governing body or law requires.
- Document the control, the owner, the frequency, and the evidence retained.
Worked example
A three-person department cannot separate every duty. Reasoning: start with the highest risk, which is cash. Assign receipting to one person, posting to another, and reconciliation to the manager who does not handle cash. Where true separation is impossible, add independent review: the manager reviews bank statements and cancelled checks monthly, signs off, and the board reviews the report. A compensating control only works if it is performed by someone outside the transaction and documented, so a signature with no evidence of review is not a control.
Traps that cost marks
- Treating a written policy as a control without evidence it operates.
- Ignoring management override.
- Relying on a single control for a high-risk process.
- Monitoring only once a year.
- Assuming small size excuses all controls.
- Confusing “detective” with “preventive” when designing a fix.