Internal Control



An effective internal control system can prevent and detect errors and irregularities, and is an integral part of a company's operations and its accounting systems. Internal controls are processes and procedures put in place to protect assets, promote effective operations, and ensure accurate accounting and record keeping. The Sarbanes-Oxley Act (SOX) is an important piece of legislation focusing on internal controls and was created in response to financial statement frauds, which resulted in the collapse of companies such as Enron and WorldCom in the early 2000s. The passage of SOX in 2002 had a major impact on companies, affecting the design and implementation of internal controls. All companies that trade on U.S. stock exchanges must comply with the requirements of this legislation as they design and implement their internal controls.

At A Glance

  • An important piece of legislation focusing on internal controls is the Sarbanes-Oxley Act (SOX), making operations controlled and consistent with corporate objectives, which may help prevent accounting fraud.
  • Internal controls, required by SOX, have a significant impact on the quality of data provided by an organization's financial records. Managers, lenders, investors, and regulators all rely on financial statements, so ensuring the statements' accuracy through internal controls is important.
  • An internal control system comprises policies and procedures to protect assets, promote efficient operations, and ensure reliable accounting and record keeping, and is based on controls for operations, reporting, and compliance.
  • An integrated framework for internal controls and risk assessment consists of five control elements: (1) the control environment, (2) risk assessment, (3) control activities, (4) information and communication, and (5) monitoring.
  • Properly designed control activities prioritize safeguarding accounting data and reliability. Weak controls can adversely impact an organization.
  • Control activities or control procedures are based on the internal control principles.
  • A company can communicate internal control and ethical practices through various channels, including its websites, intranet site, e-mail, policies, procedures, and employee handbook.
  • Well-designed internal control systems may have limitations because of unintentional and/or intentional actions. In addition, not every control activity is justified or feasible from a cost-benefit perspective.