What Is The Internal Control Process?
The internal control process is the repeatable way a business identifies a risk, designs a response, assigns an owner, performs the control, keeps evidence, monitors results, and fixes weaknesses. It turns a broad goal such as “protect company cash” into specific work that can be performed and checked.
A control is not complete because a policy says what should happen. It becomes dependable when the right person performs a defined activity at the right time, leaves evidence, and knows what to do when the result is wrong. The seven-step process and worksheet below help you build that operating discipline.
What Is the Internal Control Process?
An internal control process is a management cycle for reducing risk to an acceptable level while helping the organization meet its objectives. It begins with a clear objective and risk. It ends with monitoring, correction, and a decision about whether the control still works as intended.
The process applies to more than accounting. A company may use controls to protect assets, produce reliable reports, comply with requirements, keep systems available, approve purchases, manage access, or deliver consistent operations. The design should fit the objective, the size of the risk, and the people available.
The U.S. Government Accountability Office describes internal control as a process used by management to help an entity achieve its objectives and organizes its standards into five components: control environment, risk assessment, control activities, information and communication, and monitoring. Those components describe the system around a control. The steps in this article show how to move one risk through that system from identification to improvement.
How Do the Five Components Support the Process?
The five components of internal control are connected. Treating them as a checklist of separate topics can leave gaps between policy, daily work, and oversight.
- Control environment: leadership establishes expectations, authority, accountability, and ethical behavior.
- Risk assessment: the business defines objectives and identifies events that could prevent success.
- Control activities: people perform approvals, reconciliations, access restrictions, reviews, and other responses to risk.
- Information and communication: owners receive the data, instructions, and escalation paths needed to operate the control.
- Monitoring: managers and reviewers determine whether controls are present, performed, and effective over time.
These components also explain why a single approval is not an internal control system. The approval depends on a suitable environment, a defined risk, useful information, evidence of performance, and follow-up. You can compare preventive, detective, and corrective activities in this guide to the types of internal controls.
What Are the Seven Internal Control Process Steps?
Step 1: Define the Objective and Scope
State what the process must achieve before discussing controls. “Pay only valid, authorized obligations” is more useful than “improve accounts payable.” Identify the process boundary, locations, accounts, systems, transaction types, and period covered. A specific objective gives the team a basis for judging risk and control performance.
Step 2: Identify and Assess the Risk
Describe what could prevent the objective, why it could happen, and the likely consequence. Rank the risk using a consistent method such as likelihood and impact. Include ordinary errors, deliberate misuse, system failure, missing information, and changes in volume or staffing when they are relevant.
Write the risk as a cause-and-effect statement. For example: “An invoice could be paid without proof that goods were received, causing an invalid or duplicate cash disbursement.” That statement is narrow enough to design and test a response.
Step 3: Design the Control Activity
Choose an activity that addresses the stated risk at the right point in the process. Define the input, decision rule, performer, timing, exception, and output. A vague instruction to “review invoices” is weaker than a requirement for an accounts payable specialist to match the approved purchase order, receiving record, and supplier invoice before scheduling payment.
Consider whether the response should prevent an error, detect it soon after occurrence, or correct its effect. One risk may need more than one activity. The goal is not the largest possible control set. It is a proportionate design that reduces the risk without making the process unusable.
Step 4: Assign the Owner and Reviewer
Name the role accountable for the control and the role that performs it if those are different. Also identify who approves exceptions and who monitors performance. Ownership should be visible in a procedure, responsibility matrix, or job expectations, not assumed from an employee’s title.
Separate incompatible duties when practical. The U.S. Department of Labor says adequate and effective internal financial controls require separation of functions and responsibilities among people involved in the financial process. In a small team, where full separation is not possible, use a documented compensating review by an owner, controller, or manager who is independent of the transaction.
Step 5: Operate the Control and Retain Evidence
Perform the activity at its defined frequency and keep evidence that another person can understand. Evidence might include an approval record, matched document set, reconciliation, signed checklist, system log, review note, or exception report. Record who performed the control, when it occurred, what was reviewed, the result, and any exception.
For public-company financial reporting, SEC rules require management’s report to state responsibility for establishing and maintaining adequate internal control and assess effectiveness at fiscal year end. The SEC also explains that an assessment must be supported by evidential matter, including documentation of design and testing. A private small business may not have that reporting obligation, but the underlying lesson is useful: an undocumented control is difficult to verify.
Step 6: Monitor and Test the Control
Monitoring asks two different questions. First, was the control performed on time and with the required evidence? Second, did it reduce the intended risk? A completion rate can answer the first question but not the second. Use reconciliations, exception trends, sample testing, supervisory review, complaints, losses, or internal audit results to examine performance.
Set the monitoring frequency according to risk and change. A high-volume cash control may need daily operation and monthly oversight. A lower-risk annual access certification may need a different schedule. Independent internal audit testing can provide additional assurance, but it does not transfer control ownership away from management and process owners.
Step 7: Remediate and Improve
Define what triggers action before an exception occurs. A trigger could be a missed control, an unsupported transaction, a repeated mismatch, a threshold breach, a new system, or a material process change. Assign a remediation owner and due date, correct the immediate issue, determine the cause, and decide whether the control design or procedure must change.
Close the loop by testing the correction. Updating a policy is not enough if the activity, evidence, or monitoring remains unchanged. This end-to-end approach complements the practical sequence for implementing financial controls.
Who Owns Internal Controls?
Management owns the internal control system because management sets objectives, accepts or reduces risk, assigns authority, and provides resources. A process owner is accountable for controls within a workflow. A control performer completes the activity. A reviewer or monitor evaluates evidence and exceptions. Internal audit, when present, provides independent assurance and advice rather than operating the control it later evaluates.
In a small business, one person may hold several roles, but incompatible activities should not collapse into one unchecked transaction. Document compensating reviews when staffing limits segregation. The distinction between ownership, performance, and assurance is central to management’s responsibility for internal controls.
Internal Control Process Worksheet
Use one row for each important risk. Copy this worksheet into a spreadsheet or procedure document. Keep the wording specific enough that a new employee and an independent reviewer would reach the same understanding.
| Worksheet field | What to document |
|---|---|
| Objective and risk | What must succeed? What could prevent it? |
| Control activity | What action reduces the risk? Include the decision rule. |
| Owner and performer | Name the accountable owner and the person or role performing the control. |
| Frequency | Per transaction, daily, monthly, quarterly, or event-driven. |
| Evidence produced | Approval, report, reconciliation, log, checklist, or document set. |
| Monitoring and remediation trigger | Who reviews the evidence? What result requires investigation or correction? |
Worked Example: Cash Disbursement
| Worksheet field | Cash-disbursement example |
|---|---|
| Objective and risk | Pay only valid, authorized obligations. Risk: an invalid or duplicate invoice is paid. |
| Control activity | Before scheduling payment, match the supplier invoice to an approved purchase order and receiving record. Investigate mismatches and block duplicate invoice numbers. |
| Owner and performer | The controller owns the control. An accounts payable specialist performs the match. An authorized manager approves documented exceptions. |
| Frequency | Every invoice before payment. |
| Evidence produced | A matched invoice packet or electronic approval record showing the documents, performer, date, result, and exception disposition. |
| Monitoring and remediation trigger | The controller reviews a monthly sample and duplicate-payment report. Any missing document, override without approval, repeated supplier mismatch, or duplicate payment triggers investigation, recovery when possible, root-cause review, and control redesign if needed. |
The worked example connects the risk to a control, owner, frequency, evidence, and response. That connection is what makes a worksheet operational. It also gives a reviewer a clear test: select a payment, find the evidence, confirm the match, and inspect how exceptions were resolved.
What Makes an Internal Control Procedure Effective?
- It addresses a stated risk. The team can explain why the activity exists and what failure it is intended to prevent or detect.
- It has one accountable owner. Supporting roles may share the work, but accountability is not left to a department in general.
- It is precise. The procedure identifies inputs, steps, criteria, frequency, evidence, exceptions, and escalation.
- It fits the business. The cost and effort are proportionate to the risk, transaction volume, systems, and available staff.
- It can be monitored. A reviewer can determine whether the control happened and whether it worked.
- It improves after failure or change. Exceptions, new systems, staff changes, and process changes feed back into risk assessment and design.
Start with the risks that could cause the greatest operational, financial, reporting, or compliance harm. Document a small set of well-owned controls, operate them consistently, and expand only when the evidence shows another response is needed.
Frequently Asked Questions
What Are the Five Components of Internal Control?
The five components are the control environment, risk assessment, control activities, information and communication, and monitoring. They work together as a system rather than as five isolated checklists.
What Are the Seven Internal Control Procedures?
There is no single universal list of seven procedures. Common control activities include authorization, segregation of duties, reconciliations, access restrictions, documentation, management review, and exception follow-up. Choose activities that respond to a defined risk.
Who Is Responsible for Internal Controls?
Management owns the internal control system. Process owners are accountable for controls in their workflows, designated employees perform the activities, and reviewers or internal auditors evaluate performance and evidence.
How Often Should Internal Controls Be Monitored?
Set monitoring frequency according to risk, transaction volume, and change. High-risk or high-volume controls may need frequent oversight, while lower-risk controls may be reviewed less often. Reassess after a failure or material process change.
What Is the Difference Between a Control Process and a Control Activity?
A control activity is one action, such as an approval or reconciliation. The control process is the full cycle that connects the objective and risk to design, ownership, operation, evidence, monitoring, and remediation.
Use editable accounting control procedures, responsibilities, and forms to turn the worksheet into documented operating practice.
View the accounting manual
