What Are Internal Controls? COSO and Examples

What are internal controls?

Internal controls are the everyday checks and approvals a company builds into its work so that its numbers can be trusted, its money is safe and it follows the rules that apply to it. The COSO Internal Control Integrated Framework’s executive summary defines it as a process run by the board, managers and other staff to give reasonable assurance on goals in three areas: operations, reporting and compliance. In practice that means a second person approving a payment, a bank reconciliation done every month, and a record of who changed a supplier’s bank details. For an accountant or finance manager, controls are also the evidence: the record that shows what was checked, by whom and when, so you can close the month and hand the numbers upward with confidence.

What does “reasonable assurance” mean?

It means controls cut the chance of a mistake or a loss to a level the company can live with, without promising that nothing will ever go wrong. COSO is plain that internal control gives reasonable but not absolute assurance, because people make errors, judgment can be biased, and a control can be got around. The aim is not a perfect system. It is a system where a problem is likely to be caught early, by someone other than the person who caused it, while it is still small.

COSO also says internal control is about people, not manuals. A policy that nobody follows is not a control, and a control that nobody can prove was performed is hard to rely on when an auditor or a board asks about it.

What are some examples of internal controls?

Good examples are specific: each one names the risk it answers, who performs it, how often, and what record it leaves behind. These are common controls across the main cycles of a small or mid-sized finance team.

Payables (money going out)

• Invoice checked against the agreement: each supplier invoice is compared with the agreed price, the order and what was received before it is approved.
• Approval limits: invoices above a set amount need a second approver, and the system will not release the payment without one.
• Bank details change confirmed: a change to a supplier’s bank account is confirmed by calling the supplier on a number already on file, before the next payment.
• New supplier review: someone other than the person who enters invoices adds or approves each new supplier.
• Duplicate check: invoices are screened for the same supplier, number and amount before the payment run.

Receivables (money coming in)

• Invoice checked against the customer’s agreement: each customer invoice uses the agreed price and bills every fee the contract allows.
• Credit notes approved: a credit note above a set amount needs a manager’s approval and a reason tied to a return, a dispute or a contract term.
• Discounts authorized: any price below the agreed price has a clause or an approval behind it.
• Aging review: overdue invoices are reviewed each month, and write-offs are approved by someone who does not handle cash.

The month-end close

• Bank reconciliation: the bank statement is matched to the ledger each month by someone who does not record cash, and the reconciliation is signed off.
• Journal entry review: manual journal entries above a threshold are approved by someone other than the preparer.
• Sub-ledger tie-out: payables, receivables and fixed asset balances in the ledger are agreed to the detailed records behind them.
• Suspense cleared: nothing sits in a suspense or uncategorized account past the close without an explanation.

Access to the systems

• Access review: each quarter, someone reviews who can do what in the accounting system, and removes access for people who have left.
• Segregation of duties: no one can both create a supplier and approve its payments, or both prepare and approve a journal.

What is the difference between preventive and detective controls?

A preventive control stops a problem before it happens, while a detective control finds a problem after it has happened, ideally soon enough to fix it. COSO says control activities may be preventive or detective, and manual or automated, and names approvals, checks, reconciliations and reviews of results among them. An approval limit the system enforces is preventive and automated. A monthly review of every new supplier is detective and manual.

Most teams need both. Preventive controls are cheaper when they work, because nothing has to be recovered. Detective controls catch what preventive ones miss, including the cases where someone with the right access overrides them. A small team often leans on detective controls, because it does not have enough people to put a second person in front of every step.

What is the COSO framework?

It is a widely used guide to building and judging internal control, published by the Committee of Sponsoring Organizations of the Treadway Commission. COSO first released its Internal Control Integrated Framework in 1992 and issued the updated version in May 2013. The 2013 framework kept the original definition and five components, and set out 17 principles beneath them that describe what each component needs in order to work.

COSO pictures the framework as a cube. One side holds the three kinds of objectives (operations, reporting and compliance), another the five components, and the third the parts of the organization, from the whole company down to a single process such as payables. You can apply it to the whole business or to one function, such as finance. COSO also says the framework fits companies of every size, and that a small company’s controls may be less formal and still work well.

Public companies use COSO most visibly. The SEC’s small business guide to Sarbanes-Oxley Section 404 explains that the law requires a public company’s annual report to include management’s own assessment of internal control over financial reporting, and it points to the COSO framework as useful guidance for doing it. Private companies file no such report, but the framework gives them, their auditors and their boards a shared way to describe controls.

What are the five components of COSO?

The five components are the control environment, risk assessment, control activities, information and communication, and monitoring activities. Each one covers a different side of how a company keeps control, and COSO treats them as one joined-up system, not a checklist.

1. Control environment: the standards, structure and tone from the top that everything else rests on. It covers honesty and ethics, the board’s oversight, who holds which authority, hiring and keeping capable people, and holding people to account.
2. Risk assessment: working out what could go wrong. Management sets clear objectives, identifies the risks to them, considers the potential for fraud, and watches for changes in the business that could weaken existing controls.
3. Control activities: the actions, set by policies and procedures, that deal with those risks. Approvals, reconciliations, reviews and segregation of duties all live here, along with general controls over technology.
4. Information and communication: getting the right information to the right people. Controls depend on reliable data, and people need to know what their control duties are and how to raise a problem.
5. Monitoring activities: checking that the other four are present and working. COSO describes ongoing evaluations built into everyday processes and separate evaluations done from time to time, with deficiencies reported to the people who can fix them.

What are the 17 COSO principles?

They are short statements, grouped under the five components, that say what good internal control needs. COSO says a company can achieve effective internal control by applying all of them. In plain words:

• Control environment (1 to 5): commit to integrity and ethical values; have a board that is independent of management and oversees internal control; set structures, reporting lines and authority; attract, develop and keep competent people; hold people accountable for their control duties.
• Risk assessment (6 to 9): state objectives clearly enough to see the risks to them; identify and analyze those risks; consider the potential for fraud; identify changes that could significantly affect the system.
• Control activities (10 to 12): select and develop controls that bring risks down to acceptable levels; select and develop general controls over technology; deploy controls through policies and the procedures that put them into action.
• Information and communication (13 to 15): obtain and use relevant, quality information; communicate control information and duties inside the organization; communicate with outside parties about matters that affect internal control.
• Monitoring activities (16 and 17): perform ongoing or separate evaluations to see whether the components are present and functioning; evaluate and communicate deficiencies in good time to those who can correct them, including senior management and the board.

Principle 8, the potential for fraud, is the easiest one for a busy team to skip. It asks you to think through how someone could steal, or hide an error in the books, and that usually points straight at supplier records, payments and manual journals.

When are internal controls effective?

Under COSO, internal control works when each of the five parts and its principles is present and functioning, and the five work together. “Present” means the control exists in the design. “Functioning” means it keeps operating in practice, month after month. “Operating together” means the components, taken as a whole, bring the risk down to an acceptable level.

That last part matters. A company can have a strong approval process and still fail if nobody monitors it, or if the information the approver sees is wrong. COSO says that where a major gap exists in any part or principle, or in how the parts work together, the company cannot conclude that its internal control is effective.

For a public company, the word for the most serious failure is a material weakness. The SEC’s small business guide to Section 404 describes it as one or more control deficiencies that create a reasonable possibility of a material misstatement in the annual or interim financial statements, whether or not a misstatement has actually happened.

What can internal controls not do?

They cannot guarantee that nothing goes wrong, because some failures come from the people the controls rely on. COSO lists the limits: objectives that were poorly chosen, faulty human judgment, simple errors, management overriding a control, people colluding to get around one, and events outside the company’s control.

Override and collusion are the two to plan for. A control that a manager can switch off, or that two people can defeat together, needs a check that sits outside their reach, such as a review by the owner, an alert to someone independent, or monitoring that flags the override itself. The ACFE’s 2026 Report to the Nations found that 19% of the frauds it studied happened through an override of existing internal controls.

Why do internal controls matter for a smaller company?

Because missing controls, not clever fraud, are behind most of the losses. The ACFE’s 2026 Report to the Nations found that one-third of the frauds in its study happened because the organization lacked internal controls, a further 19% through an override of existing controls, and 18% through a lack of management review, so those three weak spots alone made up 70% of the cases.

Size does not protect you. In the same ACFE report, firms with fewer than 100 staff had the highest median loss of any size group, $126,000, and the report notes that a loss that size hurts a small company far more than a large one. The report also found billing schemes, where someone gets the company to pay a false or padded invoice, in 28% of cases at those smaller firms, against 18% at larger ones.

The report also brings better news. Every one of the 18 anti-fraud controls the ACFE examined was associated with lower median losses and faster detection, and management review and proactive data monitoring were among the four with the largest effect on both. Those are two controls a small team can run without hiring anyone.

What do you do when the team is too small to split duties?

You split the few pairs of duties that give one person a path to cash, and cover the rest with a review by someone else that leaves a record. COSO expects this: where segregation of duties is not practical, management selects and develops alternative control activities. On a team of two or three, the usual alternatives are a review by the owner of every new supplier and every payment above a set amount, approvals the system enforces, and a short list of exceptions that someone independent reads each week.

The pairs to split first, and how to cover them when you cannot, are set out in segregation of duties on a small finance team. The supplier file is the most common route for money to leave unnoticed, which vendor master fraud explains, and the payment run is where a repeated invoice slips through, which finding duplicate payments and invoice fraud covers.

Worked example: the five COSO components at Ferrygate

Ferrygate Plumbing & Heating is an invented company, one of the Demo companies Ressura uses to show its checks, and every name and figure below is made up for the example. It is a plumbing and heating contractor with about forty staff and an office of five: the owner, a controller, an accounts payable clerk, a billing coordinator and a scheduler. Here is how its controller lays out its controls over payables, receivables and the close against the five components.

Control environment. The owner signs a one-page finance policy each January: payments of $5,000.00 or more need the owner’s approval, nobody approves their own work, and anyone can raise a concern with the owner directly. The controller holds the authority to post journals, and the clerk and the billing coordinator do not. That covers principles 1, 3 and 5: a stated standard, clear authority and people held to it.

Risk assessment. Once a year, and again when the business changes, the controller lists what could go wrong in each cycle. In payables, a supplier’s bank details could be changed to a thief’s account, and a supplier could bill above the agreed price. In receivables, a customer could be billed below the agreed price, or given a credit note nobody approved. At the close, a manual journal could move revenue into the wrong quarter. Writing the fraud risks down separately is principle 8.

Control activities. Each risk gets a named control, an owner and a record.

• Payables: every supplier invoice is checked against its agreement before approval; a bank details change is confirmed by a call to a number already on file, logged with who called and when; and a supplier added in the last 90 days cannot be paid without the owner’s approval.
• Receivables: a credit note of $500.00 or more needs the owner’s approval and a reason, and each customer invoice is checked against the price in the customer’s order form.
• Close: the controller prepares the bank reconciliation, and the owner reviews and initials it; a manual journal of $10,000.00 or more needs the owner’s approval before posting.

Information and communication. The controller keeps one control list: the risk, the control, who performs it, how often, and where the evidence is kept. Each person gets the lines that are theirs. The owner sees a one-page summary at every month end.

Monitoring activities. At each month end the controller tests a handful of controls against their evidence, and once a quarter the owner reviews who has access to the accounting system.

In March that monitoring turns something up. The billing coordinator issued a credit note of $1,840.00 to a senior living customer for a disputed service visit, and there is no owner approval on file. The credit itself turns out to be fair: the visit had been billed twice. But the control did not operate, because the accounting system let the coordinator post credit notes of any size without a second person.

The controller records it as a deficiency, with the amount, the date, what failed and why, and reports it to the owner within the week, which is principle 17. The fix is preventive this time: the system is set so that a credit note of $500.00 or more stays in draft until the owner approves it. At the next month end the controller checks that the new setting works by trying to post a $600.00 credit note, finds it held in draft, and records the test.

Nothing was lost, and the record now shows the whole loop: the risk named, the control that missed, the deficiency reported, the fix and the test that proves it. That record is what the auditor will ask for.

How do you document internal controls for an auditor?

You keep, for each control, a short description of its design, the evidence that it operated, and how you judged whether it worked. The SEC’s guide to Section 404 asks public companies to keep written records of the design of their controls, the way they gathered and evaluated evidence, and the basis for their assessment, and the same three records serve a private company’s auditor well.

A simple control matrix does the job. One row per control, with these columns:

• Risk: what could go wrong, in one sentence.
• Control: what is done, by whom, and how often.
• Preventive or detective: whether it stops the problem or finds it.
• Evidence: where the proof lives, such as an approval in the system, an initialed reconciliation or a call log.
• COSO principle: the principle the control supports, which helps you see gaps across the 17.
• Last tested: when someone last checked the evidence, and what they found.

Keep the evidence as you go rather than rebuilding it at year end. A reconciliation initialed in the month it was done is strong evidence; one signed in a batch eleven months later tells the auditor the review may never have happened. Testing controls all year, rather than once, is the difference between a year-end scramble and an audit where the answers are already filed.

What can check your controls for you?

Ressura checks the controls a finance team runs against your own records, and shows each result with the evidence beside it. The Access & Segregation of Duties Module checks that no one both created and approved the same supplier invoice, payment, journal entry or supplier record, that every admin account was reviewed in the last quarter, and flags anyone who has left but still has access. The Master Data Module logs and flags every change to a supplier’s bank details, with who made it and when. The General Ledger Module checks that no journal entry was prepared and approved by the same person, and that hand-posted entries above your threshold had a second reviewer.

The Order-to-Cash Module checks that every credit note ties to a return, a dispute or a contract term for that amount, and the Procure-to-Pay Module checks each supplier invoice against the price you agreed. Fraud Watch looks across every Finding they raise for patterns worth a second look, such as a supplier’s bank details changed shortly before a payment. Each Module’s page lists what it draws on, with the COSO component and principle behind each entry, so you can show an auditor which part of the framework each check supports.

Sources

1. COSO Internal Control Integrated Framework’s executive summary
2. SEC’s small business guide to Sarbanes-Oxley Section 404
3. ACFE’s 2026 Report to the Nations