What are 'Internal Controls'
Internal controls are methods put in place by a company to ensure the integrity of financial and accounting information, meet operational and profitability targets, and transmit management policies throughout the organization. Internal controls work best when they are applied to multiple divisions and deal with the interactions between the various business departments. No two systems of internal controls are identical, but many core philosophies regarding financial integrity and accounting practices have become standard management practices.
BREAKING DOWN 'Internal Controls'
Internal controls should be documented to create an audit trail. Management of an entity is responsible for the establishment and maintenance of internal controls. For entities required to have an audit, the accounting firm provides an opinion of the effectiveness of the controls.
Preventative vs. Detective
Internal controls are broadly defined into one of two categories: preventative or detective. Preventative internal controls are policies and procedures that do not allow certain events to occur. Preventative internal controls are proactive and the first line of defense in a financial accounting system. Detective internal controls are the backup procedures that ensure the preventative internal controls are operating as intended. Items or events missed by the first line of defense have the potential to be caught by this second set of controls.
Internal Controls Broad Groupings
Internal controls may also be grouped according to the activity or policy they enact. For preventative controls, the most common internal control is the implementation of segregation of duties. Tasks are delegated among several people to ensure no single individual is in a position to authorize, record, and be in custody of a financial transaction and the resulting asset. Authorization of invoices and verification of expenses are internal controls. In addition, preventative internal controls include limiting physical access to equipment, inventory, cash and other assets.
Detective internal controls includes the use of performance reviews, including the use of budgets, forecasts and other benchmarks. Unexpected conditions or unusual results require follow-up. Reconciliations are used to compare data sets, and corrective action is taken upon material differences. Other detective internal controls include external audits from accounting firms and internal audits of assets such as inventory.
Limitations of Internal Controls
Regardless of the policies and procedures established by an organization, only reasonable assurance may be provided that internal controls are effective and financial information is correct. The effectiveness of internal controls is limited by human judgement. A business will often give high-level personnel the ability to override internal controls for operational efficiency reasons. Finally, internal controls can be circumvented through collusion. Employees working together may act in a manner in which internal controls cannot detect or prevent fraud from occurring.