The Five Components of Internal Control

A control system is stronger when its parts reinforce one another. Counting approvals tells you little about whether the business objective is protected.

Start with the objective

Take an illustrative purchasing objective: pay the correct supplier for goods actually received, at agreed terms. Ask what could interrupt that objective before choosing a control. A changed bank account, an incomplete receipt record or an unsupported override creates a different question from an ordinary invoice mismatch.

The COSO Internal Control—Integrated Framework organizes internal control around five components and 17 principles. Its scope includes operations, reporting and compliance. The components are connected; an effective system requires them to function together. The COSO-hosted implementation guide explains the framework, although its industry examples concern healthcare. The purchasing illustration here is our own learning example.

Control environment: make accountability credible

Think about who may create a supplier, who can authorize a payment and who reviews an exception. Are their responsibilities understood? Does someone challenge senior-level overrides? Is competence sufficient for the work assigned?

In our example, a signature has limited value if the approver accepts every request without examining its support. The question is how authority is exercised, rather than whether a box has been completed.

Risk assessment: update the question

Identify situations that can prevent the purchasing objective from being achieved. Consider incentives, opportunities for abuse and changes in the process. A new supplier portal or outsourced service can alter the risk even when the policy remains unchanged.

An auditor might compare the current process with the description used to design last year's tests. A newly introduced route for changing supplier bank details deserves attention if the original work covered only invoice approval.

Control activities: connect action to risk

Design the specific action that addresses the exposure. Examples could include checking a bank-detail change through a trusted channel, matching relevant purchase and receipt information, or reviewing exceptions before payment.

Identify the performer, trigger, evidence and escalation path. Evaluate whether the action actually operates with the precision needed for its purpose. These examples are possible responses, not a universal purchasing checklist.

Information and communication: make the action possible

A reviewer needs information that supports the decision. In the example, an exception report should identify the affected transaction and reach the person able to investigate it. A report that hides cancelled receipts or omits recent changes may undermine an otherwise sensible review.

Trace the information to its origin and examine relevant changes. Ask how the person handling an exception knows what happened and how the decision is communicated back to the process.

Monitoring: notice deterioration

A control that worked at implementation can weaken later. Staff changes, rushed reviews and incomplete reports can change what the control achieves. Monitoring should help identify these weaknesses and get them addressed.

For the purchasing illustration, management could examine recurring overrides, unresolved exceptions or overdue investigations. The useful question is whether that information leads to an informed response and a subsequent check of the corrective action.

Evaluate the connections

Imagine a payment review supported by an incomplete report. The review exists, but the information gap may prevent it from addressing the risk. Imagine an exception detected correctly but never assigned for follow-up. Detection alone has not resolved the issue.

Assess the connections as well as each activity: objective, risk, decision, information, escalation and follow-through. Do not map the five components mechanically to five departments or treat this learning map as a complete assessment of all 17 principles.

Internal control provides reasonable assurance. Judgment, error, override and collusion remain relevant limitations.

The practical test is whether the whole system helps the business achieve the objective.