Internal Controls
The frameworks
COSO Internal Control has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities, supported by 17 principles. COSO ERM is broader - it adds strategy and objective-setting and covers governance and culture, strategy, performance, review and revision, and information/communication/reporting. A frequent trap is treating ERM as a subset of internal control; it is the reverse.
Control categories
Controls are preventive (segregation of duties, preapproval, physical safeguards, password access), detective (reconciliations, variance analysis, surprise counts, exception reports), or corrective (backup restoration, recovery plans). Segregation of duties separates four incompatible functions: authorization, custody of assets, record keeping, and reconciliation.
IT general controls apply to the whole environment (access, change management, backup, disaster recovery); application controls apply to specific transactions (input edit checks, batch totals, reasonableness checks, output distribution).
Governance and fraud
SOX requires CEO/CFO certification of financial statements, management reporting on internal control over financial reporting (Section 404), independent audit committees, and whistleblower protection. The fraud triangle is pressure/incentive, opportunity, and rationalization. Auditors assess fraud risk and must maintain professional skepticism.
Traps and rule of thumb
Know that internal control has inherent limitations: collusion, management override, human error, and cost-benefit constraints. In small companies, segregation is impractical; questions often expect you to accept compensating controls such as owner review of bank reconciliations.
Rule of thumb: whoever can both handle an asset and record it can steal it. When reviewing a process, look for the same person authorizing, recording, and taking custody.
Worked example
The clerk who opens the mail, records customer payments, and prepares the bank deposit should not also reconcile the bank account. Move the reconciliation to an independent person (compensating detective control) and have a supervisor compare the daily deposit to the cash receipts log.