Internal Controls
Preventing errors and fraud with practical safeguards
Controls are the actual safeguards that prevent people from violating principles. Without controls, GAAP is just words on paper. With controls, GAAP becomes reality.
Why This Matters
You've learned GAAP principles that SHOULD prevent fraud. But should ≠ will.
A company implements revenue recognition principles. Then a manager records sales that haven't happened yet.
A company maintains the matching principle. Then someone reclassifies operating expenses as capital assets.
Internal controls are why financial statements are trustworthy instead of merely aspirational.
What Are Internal Controls?
Internal controls are the procedures and systems a company implements to:
The goal: Reliable financial statements and operational efficiency.
The COSO Framework: Five Components
The standard framework for internal controls is COSO (Committee of Sponsoring Organizations). It has five interdependent components:
Control Environment
The tone and culture that makes controls matter.
Risk Assessment
Identifying what could go wrong and how likely it is.
Control Activities
The actual procedures that prevent/detect errors and fraud.
Information & Communication
Capturing and sharing information needed for controls to work.
Monitoring
Checking that controls are actually working.
Control Types: Prevention vs. Detection
🛡️ Prevention Controls
Try to stop errors/fraud BEFORE they happen.
Example: Authorization control
Policy: Payments over $10,000 need manager approval
Effect: Manager catches potential fraud before payment
Result: Fraud prevented (doesn't happen)
Advantages:
- ✓ Better than detection (stops problem before it starts)
- ✓ Less costly to fix
- ✓ No damage occurs
🔍 Detection Controls
Try to catch errors/fraud AFTER they happen.
Example: Bank reconciliation
Action: Compare cash ledger to bank statement
Finding: Reconcile discrepancies
Result: Fraud detected after it occurs
When used:
- • When prevention isn't 100% possible
- • As backup to prevention controls
- • For monitoring overall health
Segregation of Duties: The Core Control
The most important control principle: No one person should handle all parts of a transaction.
The Four Duties (Split Among People)
RULE: All four duties held by different people
❌ Fraud WITHOUT Segregation
Same person who:
- ✓ Approves purchases
- ✓ Records purchases
- ✓ Takes custody of goods
- ✓ Reconciles records
Fraud: Person receives goods, records fake purchase price, pockets difference
Result: Fraud happens, no detection
✓ Fraud WITH Segregation
- Person A: Approves purchases
- Person B: Records purchases
- Person C: Takes custody of goods
- Person D: Reconciles records
Fraud attempt: Person B tries to record fake purchase
- But Person A didn't approve it
- But Person C never received it
- But Person D sees discrepancy
Result: Fraud prevented/detected immediately
Common Fraud Schemes & Controls
Cash Theft
Fake Invoices (Accounts Payable)
Lapping (Accounts Receivable)
Inventory Theft
Red Flags: Detecting Control Weaknesses
🚩 Transactions Without Documentation
- •Invoice paid, but no receipt
- •Journal entry recorded, but no supporting evidence
🚩 Unusual Transactions
- •Related-party purchases at inflated prices
- •Transactions outside normal business
- •Payments to unfamiliar vendors
🚩 Discrepancies Not Investigated
- •Bank reconciliation differences ignored
- •Inventory counts don't match records
- •Journal entries without explanation
🚩 Missing Segregation
- •One person handles all steps
- •No one reviewing transactions
- •Approvals from people with conflicts of interest
🚩 Lack of Documentation
- •No supporting invoices or receipts
- •No evidence of approval
- •No explanation of adjustments
Real-World Control Failure: Petty Cash Example
Company Policy
Petty cash for small purchases under $100 | $500 max in box | Weekly reconciliation | All receipts required
✓ What Should Happen
- 1. Employee buys office supplies for $50
- 2. Receives receipt
- 3. Takes from petty cash box
- 4. Records in log
- 5. Weekly: Receipts total = Cash removed ✓
- 6. Manager signs off
❌ What Actually Happened (Control Failure)
- 1. Employee takes $50 for personal coffee
- 2. No receipt, no record
- 3. Weekly reconciliation:
- Receipts total: $300 | Cash in box: $150 | Difference: $50
- 4. Manager: "Where's the $50?"
- 5. Employee: "Oops, forgot to include receipt"
- 6. Manager signs off anyway (no investigation)
Result: Undetected theft continues
Better Control:
- • Reconciliation difference = Investigation required
- • No exceptions
- • Can't sign off until difference explained
- • Repeated discrepancies = Discipline
Sarbanes-Oxley: The Legal Requirement
Sarbanes-Oxley (SOX)
Post-Enron reform law to prevent fraud
Public companies must have internal controls
Management must assess control effectiveness
Auditors must verify controls work
Board audit committee must oversee
Violations can result in criminal penalties
The Cost-Benefit of Controls
Controls aren't free. They require personnel, systems, time, and auditing. So when are controls justified?
When Benefit > Cost ✓
Benefit: Prevent $100,000 fraud
Cost: $10,000 annually
Verdict: Control is justified
When Benefit < Cost ✗
Benefit: Prevent $500 fraud
Cost: $10,000 annually
Verdict: Control is overkill
This is materiality in action.
Key Takeaway
Internal controls are the practical safeguards that prevent errors and fraud. Based on the five COSO components (control environment, risk assessment, control activities, information & communication, monitoring), they include prevention controls that stop problems before they occur and detection controls that catch problems after. Segregation of duties is the core principle—no one person should handle all parts of a transaction. Understanding common fraud schemes and how controls prevent them is essential to building reliable financial statements.
Test Your Understanding
1. Which COSO component is the "tone at the top"?
2. Segregation of duties is best illustrated by:
3. A prevention control works by:
4. In a petty cash system, the most important control is:
5. True or False: A company with strong GAAP principles but weak internal controls will have reliable financial statements.