What Are Internal Controls?
Internal controls encompass everything from requiring two signatures on large payments to automated system checks that flag duplicate invoices. The dominant framework in the US is COSO, which organizes controls into five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.
In practice, the finance world focuses on internal control over financial reporting, or ICFR, the subset of controls designed to ensure the numbers in the financial statements are reliable. When these controls fail, companies can misstate earnings for years before anyone notices, which is exactly what happened in the scandals that preceded the Sarbanes-Oxley Act.
How Internal Controls Work
Controls are commonly split into preventive controls, which stop problems before they occur, and detective controls, which catch them afterward. Segregation of duties is the classic preventive example: the person who approves payments should not also record them or reconcile the bank account, so no single employee can both commit and conceal a fraud. Detective controls include reconciliations, management review of variances, and physical inventory counts.
Auditors evaluate deficiencies on a severity scale. A significant deficiency is serious enough to merit attention from the audit committee, while a material weakness means there is a reasonable possibility a material misstatement would not be prevented or detected in time. Material weaknesses must be disclosed publicly, and the market usually reacts badly.
Why Internal Controls Matter
Under SOX Section 404, management of US public companies must assess ICFR annually, and larger companies must also obtain an auditor's attestation over those controls. Executives certify the disclosures personally under Section 302, putting their own liability behind the numbers, which transformed internal controls from a back-office topic into a board-level concern.
The subject also surfaces throughout deal work. IPO candidates must remediate control gaps before going public, acquirers probe control quality during due diligence, and a material weakness disclosure can delay filings or derail a transaction entirely. Understanding how controls underpin trustworthy financials is part of thinking like an investor rather than just reading statements at face value.
