What are Internal Controls?

Internal controls encompass the plan of organization and all of the coordinate methods
adopted within a business to safeguard its assets, check the accuracy and reliability of
its accounting data, promote operational efficiency and encourage adherence to
prescribed managerial policies. This definition recognizes that a system of internal
control extends beyond those matters which relate directly to the functions of the
accounting and financial departments.
Simply put, internal controls are anything we do to help us achieve our objectives. They
are the policies, procedures, practices and organizational structures implemented in
order to:

 Protect the University’s assets (including the University’s reputation);

 Ensure records are accurate;
 Promote operational efficiency; and
 Encourage adherence to policies and procedures.

Are there Different Types of Internal

Controls?
Yes, generally speaking there are two types: preventive and detective controls. Both
types of controls are essential to an effective internal control system. From a quality
standpoint, preventive controls are essential because they are proactive and emphasize
quality. However, detective controls play a critical role by providing evidence that the
preventive controls are functioning as intended.

Preventive Controls are designed to discourage errors or irregularities from occurring.

They are proactive controls that help to ensure departmental objectives are being met.
Examples of preventive controls are:

 Segregation of Duties: Duties are segregated among different people to

reduce the risk of error or inappropriate action. Normally, responsibilities for
authorizing transactions (approval), recording transactions (accounting) and
handling the related asset (custody) are divided.
 Approvals, Authorizations, and Verifications: Management authorizes employees
to perform certain activities and to execute certain transactions within limited
parameters. In addition, management specifies those activities or transactions
that need supervisory approval before they are performed or executed by
employees. A supervisor’s approval (manual or electronic) implies that he or she
has verified and validated that the activity or transaction conforms to established
policies and procedures.
 Security of Assets (Preventive and Detective): Access to equipment, inventories,
securities, cash and other assets is restricted; assets are periodically counted
and compared to amounts shown on control records.
Detective Controls are designed to find errors or irregularities after they have
occurred. Examples of detective controls are:

 Reviews of Performance: Management compares information about current

performance to budgets, forecasts, prior periods, or other benchmarks to
measure the extent to which goals and objectives are being achieved and to
identify unexpected results or unusual conditions that require follow-up.
 Reconciliations: An employee relates different sets of data to one another,
identifies and investigates differences, and takes corrective action, when
necessary.
 Physical Inventories
 Audits

Who is Responsible for Internal Controls?

Management is responsible for establishing and maintaining the control environment.
Auditors play a role in a system of internal controls by performing evaluations and
making recommendations for improved controls. Furthermore, every employee plays a
role in either strengthening or weakening the Institution’s internal control system.
Therefore, all employees need to be aware of the concept and purpose of internal
controls.

Internal Controls – Myths & Facts

Because there are many misconceptions about internal controls, knowledge sharing is
vitally important to an effective control system. Part of the educational process is to
dispel the myths about internal controls. Here are a few myths and the corresponding
facts

Myth Fact

Internal controls Internal controls are based on a strong control environment and solid busine
result from a strong practices that, in most cases, will be supported by policies; however, lack of
set of policies and policies does not preclude good business practices.
procedures (i.e., “If
a policy doesn’t
exist, we don’t
have to do it”).

Internal controls? Management and departmental personnel are the owners of internal controls
That’s why we
have internal
auditors.
Internal controls Internal controls are integral to every aspect of business.
are all about
finance and
accounting. We do
what the Office of
Financial Affairs or
the Department of
Finance tells us to
do.

Internal controls Internal controls make the right thing happen the first time.
are essentially
negative, like a list
of “thou shalt nots.”

Internal controls Internal controls should be built into, not onto, business processes.
are a necessary
evil. They take time
away from our core
activities and
responsibilities.

If controls are Internal controls provide reasonable, but not absolute, assurance that the
strong enough, we organization’s objectives will be achieved.
can be sure that
errors and
irregularities will
always be
detected.