After reading, you can tell the main types of control apart, write one that can be tested, and check that it works.
Definition
COSO describes internal control as a process carried out by the board, management and staff, covering operations, reporting and compliance. Its framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.
In day-to-day use, controls are sorted by when they act. Preventive controls stop an error before it happens, detective controls reveal it afterwards, and corrective controls repair it.
Why it matters
A policy says what should happen, and a control is what makes it happen. That is also why auditors test controls.
COSO speaks of reasonable assurance for good reason. People can collude, and a manager can override a control, so no design removes the risk entirely.
How it works
Start from a risk or a requirement. Define the control in plain terms: what is done, by whom, how often, and what record it leaves.
Match its strength to the risk. Where the stakes are high, pair a preventive control with a detective one, so that a failure of the first gets caught.
Then test it, first its design and then its operation over a period, and deal with any deviation you find.
A worked case
A company worries about paying a false supplier invoice. As a preventive control, any payment above €5,000 needs a second approver who did not enter the invoice. As a detective one, finance reviews every change of supplier bank details each month.
The evidence is the approval trail in the payment system and the signed monthly review. A test of 25 payments finds one without a second approver, and it goes on record as a deviation.
Good practices
- Write each control so that a stranger could test it from the description alone.
- Separate the person who requests from the person who approves.
- Automate where the system allows it. A control built into the software does not forget at month end.
- Name one owner, and review the control whenever the process around it changes.
Common mistakes
- Confusing a policy statement with a control, since nothing in the statement proves that anyone acted.
- Relying on detective controls alone for serious risks. By the time they fire, the money may have gone.
- Testing that a control exists without testing that it works. The form may be filled in without anyone having read what it covers.
Questions
- What is a key control?
- One whose failure would leave a significant risk uncovered. Testing effort concentrates on these.
- What is the difference between design and operating effectiveness?
- Design asks whether the control would address the risk if performed. Operating effectiveness asks whether it was actually performed as intended over the period.
- What are the 17 COSO principles?
- The 2013 COSO framework breaks its five components into 17 principles describing what effective internal control requires.
- Do ISO 27001 controls count as internal controls?
- Yes, for information security. Annex A and ISO/IEC 27002 list controls and guidance in that field.
- How many controls does a company need?
- There is no right number: enough to bring the risks within what management accepts.
- How large should a test sample be?
- It depends on how often the control runs and how much risk it covers. Auditors often sample more for key controls, and the choice should be written down.