The topic of internal control has long been an issue for business. Management may view internal control as a set of forms, checklists, and templates that auditors require. However, internal control is much more.

Since the passage of the Sarbanes-Oxley Act (SOX), internal control (especially over financial reporting) has become a major focus for all organizations, regardless of their status as public, private, not-for-profit, sole proprietorship, partnership, or corporation. It is essential that managers understand and establish sound, effective, and proper internal controls for operations, compliance, and financial processes within the organization. Internal control can truly provide ultimate organizational value.

Internal controls are defined as the mechanisms, rules, and procedures implemented by a company to ensure the integrity of financial and accounting information, promote accountability, and prevent fraud. Internal controls are a means by which an organization’s resources are directed, monitored, and measured. This includes operational and compliance activities. It plays an important role in preventing and detecting fraud and protecting the organization’s resources.

Internal control is affected by an organization’s structure, work and authority flows, people, and information systems, and is designed to help the organization accomplish specific goals or objectives. For instance, a small organization with limited resources may not be able to segregate duties with the same rigor that a larger organization can. However, that does not give small organizations an excuse to ignore the importance of that control. They must find other ways to mitigate potential issues. In any event, internal control is part of an organization’s overall responsibility and required due diligence to ensure its operations are effective. Management is the “keeper” and “inventor” of internal controls and must take ownership.