Internal Control Framework

A business wants accurate accounts, secure payments and reliable operations, and individual approvals and reconciliations help, but a framework shows how these measures fit together and who checks that they still work. COSO's Internal Control - Integrated Framework is a widely used model, and the US Government Accountability Office's Green Book also organises standards into five components, though it is aimed at federal government entities.

Start with objectives, because a control for accurate financial reporting may differ from one for safe operations or legal compliance. The control environment concerns tone, ethics, accountability and competence; a manager who bypasses approvals while telling staff to follow them weakens the whole system.

Risk assessment identifies what could prevent objectives, and a growing company may face payment fraud, inventory theft, cyber incidents and reporting errors, each with different likelihood and impact. Control activities are the concrete steps, such as approval limits, segregation of duties, access restrictions, reconciliations and physical counts, which are examples rather than a universal checklist.

Information and communication ensure people receive reliable data and know their roles, so a control fails if a supervisor never sees exception reports or staff do not know where to report a concern. Monitoring checks whether controls operate and remain suitable, since internal reviews, exception trends and audit findings can reveal a process that worked last year but fails at current scale.

Map controls to risks: a purchase approval prevents some unauthorised spending, while a bank reconciliation can detect transactions that slipped through, so preventive and detective controls complement each other. Specify an owner, a frequency, evidence of completion and escalation for exceptions, because a procedure without them is easy to neglect.

Separate duties where practical, so the same person does not create a supplier, approve its invoice and release payment without independent oversight; a small business may need compensating owner review. Check access rights too, as former staff accounts, excessive permissions and shared credentials can defeat otherwise sound approval rules.

Document enough to repeat, with policies, thresholds, evidence locations and exception procedures written clearly, because a binder no one follows is not an effective control system. Test operation, not merely design: a form may have an approval box, but sample transactions may show signatures applied after payment.

An illustrative control coverage ratio is identified material risks with assigned tested controls divided by identified material risks, so if eight of ten have a tested control, coverage is 80%, although the ratio does not measure effectiveness on its own. Prioritise material risks, since a small cash purchase and a major wire transfer should not require identical effort and too many low-value steps can cause workarounds.

Address change by reassessing after new software, acquisitions, remote work and regulation, and record deficiencies and fixes in an issue log naming the problem, owner, due date and verification of remediation. Collusion, management override, mistakes and changing circumstances can defeat controls, so a framework provides reasonable, not absolute, assurance, and for owners its value comes from daily operation and independent review.