Internal controls are the systems, regulations, and procedures put in place by a firm or organization to assure the accuracy of financial and accounting data, encourage accountability, and prevent fraud. These controls can assist enhance operational efficiency by enhancing financial reporting accuracy and timeliness.
The Committee of Sponsoring Organization of the Treadway Commission (COSO) model broadly defines internal control as a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operational effectiveness and efficiency, financial reporting reliability and compliance to applicable laws and regulations.
Although no two internal control systems are the same, many key principles about financial integrity and accounting standards have become standard management practices. There is also no such thing as a perfect internal control system because all businesses operate in changing contexts. As some hazards fade away, new dangers emerge, some of which will be difficult or impossible to forecast.
These controls can be divided into two categories: Preventive and Detective.
1. Preventive Controls: These are controls put in place to prevent errors or fraud from occurring in the first place. Separation of duties, documentation, and authorization procedures are examples of such controls.
2. Detective Controls: These are back-up methods for detecting occurrences that the first line of defense has mishandled. These controls also show that preventive controls are working as they should. Reconciliation is the most essential activity here.
Following the discovery of a problem by detective controls, corrective controls can be introduced. Disciplinary action is an example of such control.
As a result, the goal of any control system should be to provide reasonable assurance that the company can achieve its goals. Internal control objectives include, but are not limited to, the following:
• Asset protection
• Prevention and detection of fraud and other illegal activities
• Accuracy and completeness of financial records
• Timely creation of financial accounts
• Efficient business operations
A business that lacks internal controls runs inefficiently, unreliably, and in violation of applicable rules and regulations. This frequently leads to an inability to track performance against budgets and forecasts.
Poor internal controls refer to the following:
1. Missing reports and documents: The figures in a company’s financial and accounting reports must be backed up by original papers, which are typically invoices, purchase orders, and receipts.
It becomes difficult to verify the accuracy of the data in the report if the original documentation cannot be located.
2. Lack of audits: Any company that cares about keeping accurate books will hire a third-party auditor to review the work of its staff on a regular basis. If a corporation does not conduct audits, a dishonest employee may be able to get away with fraud for a long period before being found.
3. Lack of separation of duties: When it comes to accounting, one person should not be responsible for everything. A single person should not be able to authorize, record, or oversee a financial transaction or the asset that results from it. This can lead to a situation where the employee’s job is unchecked.
4. Absence of oversight: This allows employees to handle themselves. A rogue trader in an investment bank may be able to run roughshod over the company’s finances due to a lack of control.
5. Inaccurate financial statements: When a company discovers mistakes in its financial statements, it may indicate a problem with its internal control system. If financial reporting is inaccurate, a corporation should investigate the accounting practices used.
6. Lack of documented procedures: Every process and activity that an organization engages in should be accompanied by written procedures. Employees may not know the necessary procedures if there are no written procedures in place, and they may complete activities incorrectly.
7. Complaints from customers: A higher-than-normal volume of client complaints is another sign of a faulty internal control system. Customers should be satisfied with products and services; thus, businesses should build a system to achieve this. If many complaints are received, management should investigate the issue and recognize that internal controls may be lacking.
How to Identify Inadequate Internal Controls
• Conduct an internal audit
• Conduct a risk assessment
• Review departmental reports
• Train and educate employees
• Consider consumer and stakeholder feedback