What it means
A control is any deliberate step designed to prevent something going wrong or to detect it if it does. Preventive controls stop a problem before it happens, such as blocking a purchase order above a set value without approval, while detective controls find problems afterwards, such as a monthly bank reconciliation.
Most well-run businesses use a mixture of both, because prevention alone is never complete. Controls matter because the alternative is trusting that everyone will always do the right thing while tired, busy or under pressure.
Weak controls lead to duplicate payments, unrecorded revenue, stock that quietly disappears and accounts that cannot be relied on for decisions. For listed companies and regulated firms, adequate controls are also a legal obligation with personal consequences for directors.
The best-known building block is segregation of duties, which means no single person should control a whole transaction from start to finish. The person who sets up a new supplier should not also approve invoices and release payments, because that combination allows an invented supplier to be paid without anyone noticing.
Where a small team makes full separation impossible, a compensating control such as a director reviewing the payment run each week is used instead. Controls are applied across the whole business, not just in finance.
Access permissions in software, physical stock counts, credit checks before extending payment terms, and approval limits for discounts are all controls, as are the reviews that sit above them. Auditors test a sample of these controls and rely on them to decide how much detailed transaction testing they need to perform.
The two nuances that matter most are cost and behaviour. A control should cost less than the loss it prevents, so it is not sensible to require three approvals for a $50 purchase, and over-controlled processes tend to be quietly circumvented by people trying to get their work done.
Controls also fail through management override, which is why the tone set by senior leaders is treated as a control in its own right.
In practice
Real-world examples.
Example
A charity requires that any payment above $5,000 is authorised by two trustees and that the person who enters supplier bank details cannot also approve them. When a fraudulent email requests a change of bank account for a regular supplier, the second approver telephones the supplier and stops a $38,000 loss.
Example
A restaurant chain reconciles till takings to bank deposits daily at every site. A branch showing a repeated $200 shortfall on Tuesday evenings is investigated within a fortnight rather than at the year-end audit.
Example
A software company restricts the ability to issue credit notes to two finance staff and produces a weekly report of every credit note over $1,000. The report reveals a salesperson issuing credits to disguise cancelled contracts and protect commission.
Think of it
“Internal controls are like the locks, cameras, and inventory counts at a store. They're systems designed to prevent theft and catch mistakes.
Case study
Seen in the real world.
The following is an illustrative and entirely fictional story. Wrenfield Interiors, an invented contract furniture supplier with 60 staff, grew quickly and left its purchasing process largely unchanged from when it had 12 employees. One office manager could add suppliers, approve invoices up to $10,000 and release the weekly payment run without a second pair of eyes.
Over two years, a series of payments totalling roughly $210,000 went to a supplier that existed only on paper. Nobody was acting dishonestly at first; the account began as a genuine one-off contractor, and the absence of any review simply meant that later payments were never questioned. The pattern surfaced only when a new financial controller ran a report of suppliers with no purchase orders attached.
Wrenfield's response in this fictional account was practical rather than elaborate. Supplier creation was moved to a second person, all payment runs above $2,000 required director release, and a quarterly review of new and dormant suppliers was added to the finance calendar. The controls added about three hours of work a month, which the managing director described as the cheapest insurance the company had ever bought.
Watch out
Common mistakes.
- Believing internal controls are only relevant to large or listed companies. Small businesses are typically more exposed, because fewer people means more concentrated access and less natural oversight.
- Confusing having a policy with having a control. A written rule that nobody checks is not a control, and auditors will treat it as absent unless there is evidence it operates.
- Adding controls without weighing their cost. Layers of approval on low-value transactions slow the business down and encourage staff to find workarounds that undermine the whole framework.
Questions
People also ask.
Who is responsible for internal controls?
Management and the board own them, while internal audit evaluates them and external auditors test the ones they intend to rely on, so responsibility is not something that can be delegated to the finance team alone.
Can internal controls guarantee that fraud will not happen?
No, they reduce the likelihood and shorten the time to detection, but collusion between two people and deliberate override by senior management can defeat almost any control framework.
What is a compensating control?
It is an alternative check used when the ideal control is impractical, such as a manager reviewing every transaction personally in a team too small to separate duties properly.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%