COSO in One Page: Follow One Invoice Through the Control System

A duplicate-payment check can work at one desk while the wider payment process still fails. Internal control becomes easier to understand when we follow the business event across the people responsible for it.

An original hypothetical case

A spare-parts distributor receives a supplier invoice twice. The warehouse has recorded the delivery correctly, but the repeated invoice arrives with a slightly different reference. AP asks treasury to release payment before the supporting exception is resolved. This fictional case illustrates a failed connection, not an allegation about an actual company.

Start with the objective

The distributor wants to pay legitimate suppliers once, maintain reliable liabilities and meet the obligations applicable to its business. These concerns connect operational, reporting and compliance objectives. They are the reasons for the system, rather than additional control components.

Five lenses on the same invoice

Control environment: the finance lead defines who may resolve an exception and makes clear that urgency does not remove accountability.

Risk assessment: AP considers how repeated invoices, altered references or overrides could cause an unintended payment.

Control activities: invoice matching and duplicate checks interrupt release when information does not agree.

Information and communication: receiving records, invoice references and unresolved exceptions reach the person making the payment decision.

Monitoring activities: management evaluates whether reviews actually happened and recurring weaknesses were corrected.

The lesson is in the connections

In this case, the warehouse record alone cannot stop treasury from paying twice. A duplicate flag without an accountable reviewer may only create an unanswered queue. A reviewer without complete receiving information may approve the wrong exception. Management therefore needs to follow the handoffs between purchasing, warehouse, AP and treasury, as well as the individual checks.

A practical redesign would specify which evidence accompanies an exception, who decides it, what prevents release while it is unresolved and who follows up repeated causes. Those are design questions for this fictional distributor, not a prescribed universal configuration.

What this map does not prove

COSO's framework contains more than five labels. A complete assessment considers the relevant principles and how the components function together. This introductory example is not that assessment. Judgment errors, override or collusion can still leave exposure; control provides reasonable rather than absolute assurance. Management retains responsibility for its system.

Try it on a process

Choose one supplier-payment risk. Trace it through three departments. At each handoff, write the information needed, the accountable decision-maker and the evidence that would reveal a failed connection. Then ask whether adding another signature would address the actual cause.

Concept references: COSO Internal Control—Integrated Framework and the GAO Green Book. GAO is US federal guidance, used here for learning rather than as an Indonesian legal requirement.

Beyond the numbers. Inside the business.