Internal Controls
This domain tests control design and operation: the control environment, risk assessment, control activities, information and communication, and monitoring.
Control types
- Preventive: approvals, segregation of duties, access restrictions, KYC gates.
- Detective: reconciliations, exception reports, reviews, surveillance alerts.
- Manual versus automated: automation is consistent but needs change controls; manual controls need evidence and review.
Segregation of duties matters: the person who initiates a payment should not approve or reconcile it. Authorization limits should be documented and enforced.
Worked example
A payment is initiated by an operations officer, approved by the same officer because the approver was on leave, and reconciled by a third person. The compliance review identifies a segregation-of-duties failure. Reasoning: the reconciliation detected the issue, but the preventive control failed; both the exception and the delegation process need fixing.
Traps that cost marks
- Accepting a control description without evidence of operation.
- Relying on a single manual reviewer with no backup.
- Ignoring IT access controls and change management.
- Treating reconciliation as a substitute for approval.
Controls should be proportionate, documented, tested, and linked to the risk they address.