10 Internal Control Tools Examples (And How To Apply Them)

An internal control tool is a practical device that turns a control objective into repeatable work. A matrix, checklist, approval table, reconciliation, or exception report can show what risk is being addressed, who performs the control, what evidence it produces, and who reviews the result.

The strongest internal control tools do not add paperwork for its own sake. They help a controller or finance manager close a specific gap, such as an unsupported payment, excessive system access, a missing reconciliation, or an audit finding with no assigned owner. This guide compares ten tools, provides a downloadable control matrix, and works through an accounts payable example.

What Makes an Internal Control Tool Useful?

A useful tool connects four things: an objective, a risk, an action, and evidence. The objective explains the result management wants. The risk describes what could prevent that result. The action is the control activity, and the evidence lets a reviewer confirm that the activity occurred and that exceptions were resolved.

The current GAO Green Book describes internal control through five components and 17 principles, including risk assessment, control activities, information, and monitoring. The standards govern federal agencies, so they are not a universal mandate for a private small business. They still provide a disciplined reference for designing and documenting a control system.

You can also organize tools by the types of internal controls they support. Approval thresholds and access restrictions are mainly preventive. Reconciliations and exception reports are mainly detective. A remediation log supports corrective action. Many important processes use more than one type because no single control handles every failure.

Software can help route approvals, restrict access, and retain records, but a software feature is not automatically an effective control. Management still needs to define the rule, assign an owner, set a frequency, review exceptions, and retain suitable evidence. A spreadsheet can be sufficient for a stable small team, while higher transaction volume may justify workflow or governance software.

10 Internal Control Tools and How To Apply Them

1. Risk-Control Matrix

A risk-control matrix maps each important risk to a control objective, control activity, owner, frequency, evidence, and reviewer. It is often the best starting point because it shows whether a control actually addresses the risk that management identified. It also exposes gaps, duplicate controls, and activities with no accountable owner.

Apply it by writing the risk as a specific failure event. Replace a broad phrase such as “payment risk” with “an invoice can be paid without evidence that the goods were ordered and received.” Then record the control response, the evidence produced, and the role that reviews exceptions. Treat the matrix as a living design record, not a one-time audit form.

2. Segregation of Duties Matrix

A segregation of duties matrix compares roles against incompatible responsibilities such as authorization, recordkeeping, custody of assets, and review. It helps management see where one person can control too much of a transaction. This is more precise than saying that duties should be separated without showing which duties conflict.

Apply it to one process at a time. For accounts payable, list vendor setup, purchase approval, invoice entry, payment release, bank access, and reconciliation. Mark the primary and backup role for each duty. Where staffing prevents full separation, document a compensating review, such as the owner receiving the bank statement directly and reviewing vendor changes and unusual payments.

3. Reconciliation Checklist

A reconciliation checklist standardizes the comparison of internal records with independent evidence. It can cover bank accounts, credit cards, inventory, payroll clearing accounts, accounts receivable, intercompany balances, or other important records. The checklist keeps preparation, review, aging, and follow-up from becoming separate informal habits.

Apply it by stating the records being compared, the due date, the preparer, the reviewer, and the evidence required. Add a section for reconciling items with an owner and resolution date. A completed reconciliation is not enough when old differences remain unexplained. The reviewer should focus on unusual, repeated, or aging items rather than adding a signature without analysis.

4. Approval Authority Matrix

An approval authority matrix defines who may approve a commitment and at what value or risk level. Common rows include purchases, contracts, discounts, credits, refunds, write-offs, journal entries, wire transfers, hiring, and capital spending. The matrix reduces uncertainty and makes escalation predictable.

Apply it with thresholds that reflect risk, not titles alone. A routine purchase may need one approval, while a new vendor bank account or unusual wire may need independent verification regardless of amount. Include temporary delegation rules, prohibited self-approval, evidence requirements, and a review date. Communicate the current version to employees and configure workflow rules to match it when software is used.

5. Access Control Review

An access control review compares user permissions with current job responsibilities. It can identify former employees, transferred employees, shared accounts, excessive administrator privileges, conflicting duties, and access that was granted for a project but never removed. The useful output is a decision record, not merely an exported user list.

Apply it by obtaining a complete access export from each important system. Ask the process owner to approve, modify, or remove each sensitive role. Record who reviewed the access, when the change was completed, and how exceptions were resolved. Repeat the review on a schedule and after significant role changes. Access reviews should align with the responsibilities in the segregation of duties matrix.

6. Three-Way Match

A three-way match compares the purchase order, receiving record, and vendor invoice before a payment is approved. The GAO Financial Audit Manual describes matching those three records as an accounts payable control example. The manual is an older exposure draft, so the example should be adapted to the business rather than treated as a current universal requirement.

Apply the match by defining acceptable differences for quantity, price, freight, tax, and timing. Route mismatches to a named person who is independent of invoice entry when practical. Record the approval and the reason for any override. For services that do not produce a receiving record, substitute documented confirmation from the service owner.

7. Exception Report

An exception report filters a large transaction population for activity that deserves review. Examples include duplicate invoice numbers, changes to vendor bank details, payments just below an approval threshold, manual journal entries, dormant users who logged in, negative inventory, or reconciliations completed after the deadline.

Apply it by defining a small number of meaningful rules and testing whether they produce actionable results. Assign a reviewer with enough authority and context to investigate. Record each exception, the conclusion, and any correction. If a report produces hundreds of ignored alerts, adjust the rule or the workflow. A shorter reviewed report is more useful than a comprehensive report that no one can operate.

8. Control Evidence Log

A control evidence log is an index of the records that show a control operated. It may point to approvals, reconciliations, reports, meeting notes, access reviews, count sheets, or remediation records. The log helps a reviewer find evidence without asking process owners to reconstruct months of activity during an audit.

Apply it by assigning a control identifier and recording the period, owner, evidence location, reviewer, completion date, exception status, and retention period. Keep sensitive evidence in the appropriate secured system and store only a link or reference in the index. The log should not become a second uncontrolled copy of confidential files.

9. Internal Audit Checklist

An internal audit checklist turns control objectives into consistent test steps. It can ask whether the control is designed appropriately, whether it operated for the selected period, whether evidence exists, whether the reviewer was independent, and whether exceptions were corrected.

Apply it by linking every question to the relevant risk and control identifier. Define the sample or period being tested, the expected evidence, and the criteria for a finding. A yes-or-no checklist is not enough when a reviewer cannot see how the conclusion was reached. Record observations, evidence references, severity, owner, due date, and retest result.

10. Control Self-Assessment

A control self-assessment asks process owners to evaluate their own risks, controls, evidence, changes, and known gaps. It brings operating knowledge into the review and can surface problems before a formal audit. It should complement independent testing, not replace it when objectivity is important.

Apply it with specific questions. Ask what changed, which controls failed or were skipped, what exceptions remain open, whether staffing or system access changed, and whether evidence is complete. Require an action plan for each gap and have a controller, manager, or cross-functional reviewer challenge the result.

Download the Internal Control Matrix Template

Download the internal control matrix template as a CSV file that opens in Excel, Google Sheets, or another spreadsheet tool. The file maps all ten tools to a control objective, risk, owner, reviewer, frequency, and evidence. Its entries are hypothetical examples, not prescribed assignments.

Customize the matrix to match your organization. Add the system or process, control type, reviewer, due date, retained evidence, exception owner, and test result. Link the matrix to the relevant COSO framework principle when that helps management see how the tools fit into the broader control system.

Worked Example: Accounts Payable Controls

Assume a hypothetical 40-person company has a controller, an accounts payable specialist, two department managers, and an owner. An audit finding states that the same employee can create a vendor, enter an invoice, and prepare a payment batch. Supporting documents are stored inconsistently, and no one reviews changes to vendor bank details.

The controller starts with the risk-control matrix. The risk is that an unauthorized or erroneous vendor payment can be created and released without independent verification. The objective is to pay only valid obligations to approved vendor accounts. The controller then layers several tools instead of treating the finding as one checklist item.

1. Segregation of duties matrix: the accounts payable specialist may enter invoices but cannot approve a new vendor or release a payment. A department manager confirms the business purpose, and the owner releases high-risk or high-value payments.
2. Approval authority matrix: department managers approve routine purchases within assigned limits. New vendor bank details and payments above the defined threshold require a second approval.
3. Three-way match: the invoice is compared with the approved purchase order and receiving evidence. Service invoices require confirmation from the service owner.
4. Exception report: the controller reviews vendor bank changes, duplicate invoice numbers, payment overrides, and transactions just below the approval threshold.
5. Evidence log: the payment batch links to the invoice, purchase order, receiving record, approvals, and exception resolution.

The resulting matrix names the control owner, reviewer, frequency, and evidence. The internal audit checklist can later test a sample of new vendors and payments. If the small team cannot separate every duty, the matrix records the compensating owner review instead of claiming a separation that does not exist.

Documented accounting procedures make this design repeatable. A procedure can state the required documents, roles, thresholds, exception route, and retained evidence. The Accounting Policies and Procedures Manual provides editable procedure templates that can be adapted to the control design.

How To Choose the Right Tool for a Control Gap

Start with the failure you need to prevent or detect. Do not begin by buying software or copying a long checklist. A clear risk statement makes the tool choice easier and gives management a way to judge whether the control changed the exposure.

• Use a risk-control matrix when risks, controls, and owners are not connected in one place.
• Use a duties matrix when one person may control authorization, records, assets, or review.
• Use a reconciliation checklist when balances or transactions must agree with independent evidence.
• Use an authority matrix when approvals are inconsistent or escalation is unclear.
• Use access reviews when system permissions may not match current jobs.
• Use a three-way match when payment depends on evidence of order, receipt, and invoice.
• Use exception reports when transaction volume makes line-by-line review impractical.
• Use an evidence log when records are hard to locate or demonstrate.
• Use an audit checklist when a reviewer needs consistent test steps.
• Use a self-assessment when process owners need to surface changes and gaps between formal reviews.

Next, define the lightest control that changes the risk and produces reviewable evidence. Consider frequency, transaction volume, staffing, independence, delay, and cost. Review how the tool fits with existing financial internal controls so that one new step does not conflict with the close, purchasing, payroll, or cash process.

The SEC’s Release 33-8238 addresses internal control over financial reporting for registrants and discusses records, transaction authorization, and prevention or timely detection of unauthorized asset use. It is regulatory context for public-company reporting, not a rule that automatically applies to every small business. A smaller private company should design controls around its actual risks and obligations.

Finally, test the tool after it operates. Ask whether it prevented or detected the stated failure, whether exceptions were resolved, whether the evidence is usable, and whether employees can perform the control without creating an unnecessary bottleneck. Update the matrix when responsibilities, systems, transaction volume, or risks change.

Use the matrix as the central index rather than forcing every detail into one file. The approved procedure can explain how to perform the control, the checklist can guide the work, the accounting system can retain the transaction, and the evidence log can point the reviewer to the result. This division keeps each tool usable while preserving traceability from risk to action and evidence.

When an audit finding is closed, record more than the new document’s name. State the root gap, the tool selected, the owner, the first operating date, the evidence reviewed, and the result of the first test. That record helps management distinguish a control that was designed from a control that was actually implemented and reviewed.

Frequently Asked Questions

What is an internal control tool?

An internal control tool is a matrix, checklist, report, workflow rule, review, or other practical device that helps a business perform and document a control. It should connect a risk to an owner, action, frequency, reviewer, and evidence.

Is internal controls software required?

No. A small business can operate many controls with approved procedures, spreadsheets, checklists, and records from its accounting system. Software becomes useful when volume, complexity, access administration, evidence retention, or approval routing makes manual operation unreliable.

What is the difference between a control matrix and a checklist?

A control matrix maps risks to control objectives, activities, owners, frequency, evidence, and reviewers. A checklist gives a person a repeatable set of steps for performing or testing a control. The matrix explains the design, while the checklist supports execution or evaluation.

How often should internal controls be reviewed?

Review frequency should reflect risk and change. Review controls after system, staffing, process, or regulatory changes, and set a recurring schedule for important controls. High-risk access or payment controls may need more frequent review than a stable low-risk administrative control.

What if a small team cannot fully separate duties?

Document the limitation and add a compensating review. An owner or manager might receive bank statements directly, approve vendor changes, review exception reports, or inspect selected transactions. The matrix should state the actual arrangement instead of claiming that duties are separated.