Internal controls run through everything from invoice approvals to board reporting, and both UK and US rules expect organizations to show that their controls work. Getting them right means understanding the COSO frameworks, the types of control, who owns what and where regulators set the bar.
What are internal controls?
Internal controls are the policies, procedures and activities an organization uses to reduce risk, protect its assets, keep its records accurate and make sure it follows the rules.
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) defines internal control as "a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance."
In plain English, internal controls are the checks and balances that stop mistakes, fraud and rule-breaking, or catch them quickly when they happen. Approving an invoice before it is paid, reconciling a bank account every month and limiting who can edit a payroll record are all internal controls.
Why internal controls matter: efficient operations, reliable reporting and compliance
COSO groups the objectives that internal controls support into three categories:
- Operations: work is effective and efficient, and assets are protected from loss or misuse.
- Reporting: financial and non-financial information is accurate, timely and reliable.
- Compliance: the organization follows the laws, regulations and internal policies that apply to it.
What is the COSO framework?
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides frameworks and guidance on enterprise risk management, internal control and fraud deterrence. Its two main frameworks are the Internal Control: Integrated Framework (2013) and the Enterprise Risk Management (ERM) framework (2017), which COSO describes as complementary. COSO is not a statutory requirement, but it is recommended as best practice.
The 2017 ERM framework
The ERM framework, Enterprise Risk Management: Integrating with Strategy and Performance, has five components (governance and culture, strategy and objective-setting, performance, review and revision and information, communication and reporting) and twenty principles. Its components differ from the five internal control components below.
The five COSO components of internal control
The COSO Internal Control: Integrated Framework (updated in 2013) is a widely used model for designing and assessing internal controls. It describes five components supported by 17 principles. The components work together as one system, so a serious weakness in one can undermine the others.
| Component | What it means | Examples |
| Control environment | The standards, structures and culture that set the tone for control across the organization | Board and audit committee oversight, a code of conduct, clear reporting lines and policies for hiring and developing competent people |
| Risk assessment | Identifying and analyzing the risks that could stop the organization achieving its objectives | An annual review that ranks fraud, reporting and compliance risks by likelihood and impact and decides which need a control |
| Control activities | The actions, set out in policies and procedures, that reduce those risks | Approvals, reconciliations, verifications, segregation of duties and restricted system access |
| Information and communication | Getting relevant, reliable information to the people who need it, inside and outside the organization | Policy distribution, whistleblowing channels and regular control reporting to the board |
| Monitoring activities | Evaluating whether controls are in place and working as intended | Continuous control testing, internal audit reviews and tracking deficiencies through to remediation |
Types of internal controls
Internal controls are usually classified by when they act. They can also be manual (performed by a person), automated (performed by a system) or IT-dependent (a manual control that relies on system-generated data).
| Type | Purpose | When it acts | Specific examples |
| Preventive | Stop errors, fraud or breaches before they occur | Before a transaction or action is completed | Segregation of duties between raising and paying invoices, dual approval of payments over a set value, role-based system access, mandatory compliance training |
| Detective | Identify errors, fraud or breaches that have already occurred | After a transaction or action, on a regular cycle | Monthly bank reconciliations, exception reports on unusual journals, management review of budget variances, user access reviews |
| Corrective | Fix the issue and prevent it happening again | After an issue is found | Recovering an overpayment, restoring data from backup, retraining staff, updating a procedure or system rule after an incident |
How internal controls differ from internal audit and risk management
| Function | Purpose | Who owns it | When it acts |
| Risk management | Identifies, assesses and prioritizes the risks an organization faces | Management, supported by a risk function | Continuously, as risks and objectives change |
| Internal controls | Actions management puts in place to respond to those risks | Management and control owners at every level | Day to day, as part of normal processes |
| Internal audit | Independently tests whether controls are designed well and working, then reports to senior management and the audit committee | The internal audit function, reporting to the audit committee | Periodically, on a risk-based plan |
In the three lines model, management owns risk and controls in the first line, risk and compliance functions oversee them in the second line and internal audit provides independent assurance in the third line. For a deeper comparison, see internal audit vs external audit.
Internal control requirements for UK and US companies
Provision 29 and FCA rules in the UK
The UK Corporate Governance Code, issued by the Financial Reporting Council (FRC), applies to companies with a premium listing on a comply-or-explain basis. Provision 29 requires the board to monitor the risk management and internal control framework and review its effectiveness at least annually. For financial years beginning on or after January 1, 2026, the annual report must include a declaration of the effectiveness of the material controls as at the balance sheet date and describe any that had not operated effectively, with the action taken or proposed.
The declaration covers material controls only, and the board decides which are material. Separately, the Financial Conduct Authority (FCA) requires firms to have robust governance arrangements that include internal control mechanisms (SYSC 4.1.1R in the FCA Handbook), so financial services firms face a regulatory duty as well.
SOX 404 and SEC rules in the US
Internal control over financial reporting (ICFR) is the part of an organization's internal controls that gives reasonable assurance that financial statements are reliable and prepared in line with the applicable accounting framework. Section 404 of the US Sarbanes-Oxley Act (SOX) requires management of US-listed companies to assess and report on ICFR effectiveness each year (Section 404(a)). Accelerated filers also need their external auditor to attest to that assessment (Section 404(b)).
SEC Rule 13a-15 requires management to evaluate ICFR each fiscal year against a suitable, recognized control framework, and COSO is a commonly used one. For the auditor attestation, the Public Company Accounting Oversight Board (PCAOB) standard AS 2201 requires an audit of ICFR integrated with the audit of the financial statements.
Limitations of internal controls
Internal controls provide reasonable assurance, not absolute assurance. Even well-designed controls have limits:
- Human error: people misunderstand instructions, make judgment mistakes or skip steps under pressure.
- Collusion: two or more people working together can bypass controls that rely on segregation of duties.
- Management override: senior people can circumvent controls, which is why board and audit committee oversight matters.
- Cost versus benefit: the cost of a control should not exceed the risk it reduces.
- Change: controls designed for last year's processes, systems or regulations can quietly stop working.
How to check that internal controls are working
- Document: record each key control, its owner, its frequency and the risk it addresses.
- Test design: confirm that the control, if performed as described, would reduce the risk.
- Test operation: sample the control across the period and keep evidence that it ran.
- Log and classify deficiencies: record failures and rate their severity.
- Remediate and report: assign owners and deadlines, retest fixes and report to management and the board.
Controls only protect an organization while someone keeps testing them
A control only protects an organization when it is well designed, owned by a named person and shown to work. Provision 29 and SOX 404 put that proof in front of boards and investors, and human error, collusion and management override mean controls need regular testing. The practical step is to list the key controls you rely on, confirm who owns each one and keep the evidence that each one ran.
Frequently asked questions about internal controls
What is the difference between an internal control and a policy?
A policy states what the organization expects, while a control is the specific action that makes sure the expectation is met. A policy might say payments over a set value need approval. The control is the system block or sign-off that stops an unapproved payment, and it needs an owner and evidence that it ran.
Does the Provision 29 declaration have to be audited?
No. The board decides whether external assurance over its material controls is needed and to what degree. The external auditor reads the Provision 29 statement as other information in the annual report and is not required to test the design, implementation or operating effectiveness of the material controls.