Internal Controls and Control Environment
Internal Controls and Control Environment
This domain tests the design and operation of controls, not just their existence. Expect questions on COSO’s five internal-control components, preventive versus detective controls, segregation of duties, authorisation, reconciliation, and the tone at the top that makes controls work.
Core rules
- COSO Internal Control - Integrated Framework (2013) has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. These are supported by 17 principles.
- Control environment is the foundation: integrity, board oversight, organisational structure, competence, accountability and HR policies.
- Preventive controls stop an error or fraud before it happens (approval, access restriction). Detective controls find it afterwards (reconciliation, exception report). A good mix is normal; detective controls alone leave loss exposure.
- Segregation of duties separates custody, authorisation, recording and reconciliation. Where staff numbers are small, compensating controls such as independent review and rotation are needed.
Worked example
A petty-cash float is held by one administrative officer who also posts the ledger entries and prepares the reconciliation. The risk is misappropriation concealed by false entries. The control redesign separates custody (cashier), recording (finance officer), and reconciliation (independent supervisor), adds a surprise count and sets a low float limit. The manager documents who performs each control and how evidence is retained. Reasoning: the control gap is a combination of incompatible duties, not a lack of a policy. A policy alone would not detect the loss.
Traps
- Saying a control exists when you mean it is designed; operation must be tested.
- Relying on a monthly reconciliation to prevent a loss that occurs daily.
- Ignoring management override of controls.
- Treating the control environment as an HR matter rather than a governance responsibility.