Skip to main content

8.2 Define and Explain Internal Controls and Their Purpose within an Organization

What are Internal Controls?​

Internal controls are policies, procedures, and practices designed to:

  • Safeguard assets
  • Ensure accurate and reliable financial records
  • Promote operational efficiency
  • Ensure compliance with laws and regulations
  • Prevent and detect fraud and errors

Purpose of Internal Controls​

Primary Purposes:

  1. Safeguard Assets

    • Protect cash, inventory, equipment
    • Prevent theft and misuse
    • Ensure assets are used for business purposes

  2. Ensure Accuracy

    • Reduce errors in recording transactions
    • Ensure financial statements are accurate
    • Maintain reliable accounting records

  3. Promote Efficiency

    • Streamline operations
    • Reduce waste
    • Improve productivity

  4. Ensure Compliance

    • Comply with laws and regulations
    • Meet tax obligations
    • Follow PCN requirements
    • Comply with eCDF and FAIA requirements

  5. Prevent and Detect Fraud

    • Deter fraudulent behavior
    • Detect fraud when it occurs
    • Reduce opportunities for fraud

Types of Internal Controls​

Internal controls can be categorized as:

  1. Preventive Controls: Prevent errors and fraud from occurring
  2. Detective Controls: Detect errors and fraud after they occur
  3. Corrective Controls: Correct errors and fraud that have been detected

Preventive Controls​

Purpose: Stop problems before they occur

Examples:

  • Separation of duties
  • Authorization requirements
  • Physical controls (locks, safes)
  • Access controls (passwords, keys)
  • Pre-numbered documents
  • Approval processes

Example: Requiring two signatures on checks over €1,000 prevents unauthorized payments.

Detective Controls​

Purpose: Identify problems after they occur

Examples:

  • Bank reconciliation
  • Inventory counts
  • Internal audits
  • Exception reports
  • Variance analysis
  • Review of transactions

Example: Monthly bank reconciliation detects discrepancies between records and bank statement.

Corrective Controls​

Purpose: Fix problems that have been detected

Examples:

  • Error correction procedures
  • Disciplinary actions
  • System improvements
  • Training programs
  • Policy updates

Example: When fraud is detected, corrective controls include investigation, recovery, and system improvements.

Principles of Internal Control​

Key Principles:

  1. Establish Responsibility

    • Assign specific duties to specific individuals
    • Hold individuals accountable
    • Clear job descriptions

  2. Maintain Adequate Records

    • Keep complete and accurate records
    • Use pre-numbered documents
    • Maintain audit trail

  3. Insure Assets and Bond Key Employees

    • Insurance protects against losses
    • Bonding protects against employee theft
    • Important for cash handlers

  4. Separate Recordkeeping from Custody of Assets

    • Person handling cash shouldn't record cash transactions
    • Person handling inventory shouldn't record inventory
    • Reduces opportunity for fraud

  5. Divide Responsibility for Related Transactions

    • Different people for ordering, receiving, and paying
    • Different people for recording and custody
    • Prevents collusion

  6. Apply Technological Controls

    • Passwords and access controls
    • Automated controls
    • System validations

  7. Perform Regular and Independent Reviews

    • Internal audits
    • Management reviews
    • External audits

Limitations of Internal Controls​

No system is perfect. Limitations include:

  • Cost vs. Benefit: Controls cost money; must be cost-effective
  • Human Error: People make mistakes
  • Collusion: Employees working together can override controls
  • Management Override: Management can bypass controls
  • Changing Conditions: Controls may become inadequate over time

Luxembourg Compliance Note​

In Luxembourg, businesses must:

  • Implement reasonable internal controls
  • Document control procedures
  • Review controls regularly
  • Adapt controls as business grows
  • Larger businesses may have audit requirements
  • Controls must support compliance (PCN, eCDF, FAIA)

Think It Through​

Why is it important to separate the person who handles cash from the person who records cash transactions? What could happen if the same person does both?