Internal controls are the policies, procedures, and organizational structures a company uses to keep its financial reporting accurate, its operations running smoothly, and its compliance obligations met. In the United States, most organizations design these systems around the COSO framework’s five components, classify individual controls as preventive, detective, or corrective, and, if they are publicly traded, operate under the Sarbanes-Oxley Act’s certification and assessment rules. Private companies and nonprofits aren’t bound by Sarbanes-Oxley, but many follow the same framework voluntarily, and any organization receiving federal awards has to maintain effective internal controls as a condition of the funding.
The COSO Framework’s Five Components
The Committee of Sponsoring Organizations of the Treadway Commission published its Internal Control — Integrated Framework in 1992 and updated it in 2013. That updated version is the most widely used internal control framework in the United States and has been adopted or adapted internationally.1COSO. Internal Control It organizes internal control into five interconnected components.
Control Environment
The control environment is the foundation. It reflects the organization’s commitment to integrity, ethical values, and competent staffing, and covers board independence, oversight responsibility, organizational structure, hiring practices, and accountability standards. Leadership sets the tone. If executives treat compliance as an afterthought, everyone else will too.
Risk Assessment
Risk assessment identifies threats that could prevent the organization from hitting its objectives. Effective risk assessment means defining what counts as a high-impact event, evaluating the likelihood and potential damage of each risk, analyzing how risks interact, and prioritizing them so resources go where they matter most. Fraud risk gets its own principle under COSO because the incentives and rationalizations behind fraud differ from ordinary operational risks.
Control Activities
Control activities are the specific actions the organization takes to address the risks it identified. They range from approval requirements and reconciliations to technology controls that restrict who can access sensitive systems. The 2013 framework calls out technology controls as their own principle, recognizing that nearly every financial process now runs through software.
Information and Communication
Internal controls work only when the right people have the right information at the right time. This component covers how financial and operational data moves through the organization, how employees learn what’s expected of them, and how the organization communicates with regulators, auditors, and investors.
Monitoring
Monitoring involves ongoing evaluations of whether the other four components are actually working.1COSO. Internal Control It happens through routine management reviews, internal audits, or standalone evaluations. When monitoring uncovers a deficiency, the organization has to communicate it to the people who can fix it, then verify the fix works.
Preventive, Detective, and Corrective Controls
Individual controls are typically grouped by when they operate relative to a transaction or error. Most organizations need a mix of all three types.
Preventive Controls
Preventive controls stop errors and fraud before they happen. The classic example is segregation of duties: the employee who approves a payment should not be the same person who cuts the check. Other common preventive controls include dual authorization above a set dollar amount, restricted system access so only authorized personnel can modify financial records, and standardized approval workflows for purchasing.
Detective Controls
Detective controls catch problems after the fact. Bank reconciliations are the workhorse, comparing internal cash records against external bank statements each month to identify discrepancies. Periodic physical inventory counts, exception reports flagging unusual transactions, and internal audits also fall into this category. Detective controls don’t prevent the error, but they limit the damage by catching it before it compounds.
Corrective Controls
Corrective controls address errors and irregularities after they’ve been detected. They include procedures for adjusting accounting entries when reconciliations reveal discrepancies, retraining staff when recurring errors point to a knowledge gap, and revising policies that allowed the problem to occur. Organizations that rely only on preventive and detective controls without a corrective mechanism tend to see the same problems surface repeatedly.
IT General Controls
Because nearly every financial process flows through software, IT general controls support all other controls. Weak IT controls can undermine even well-designed manual procedures. If unauthorized users can modify financial data in the system, no amount of dual-signature policies on paper will protect the organization.
Logical access controls restrict who can use specific systems, view sensitive data, or make changes to financial records. In practice, this means role-based permissions, strong authentication, regular access reviews, and prompt removal of access when employees change roles or leave.
Change management controls apply when the organization updates its financial software, whether patching a bug, adding a feature, or migrating to a new system. Every modification runs through a defined process: a documented request, a risk and impact analysis, formal authorization, testing in a non-production environment, and a rollback plan. Version control systems maintain an audit trail so the organization can trace what changed, when, and by whom.
Sarbanes-Oxley Requirements for Public Companies
The Sarbanes-Oxley Act, enacted in 2002 after major corporate accounting scandals, established the primary federal internal control requirements for public companies. Two sections carry the most weight.
Section 302 Officer Certifications
Section 302 requires the CEO and CFO of every public company to personally certify each annual and quarterly report filed with the Securities and Exchange Commission. The signing officers must attest that they have reviewed the report, that it contains no material misstatements, and that the financial statements fairly present the company’s financial condition.2Office of the Law Revision Counsel. United States Code Title 15 7241 – Corporate Responsibility for Financial Reports
The signing officers also have to certify that they are responsible for establishing and maintaining internal controls, that they have evaluated those controls within 90 days of the report, and that they have disclosed any significant deficiencies or material weaknesses to the company’s auditors and audit committee.2Office of the Law Revision Counsel. United States Code Title 15 7241 – Corporate Responsibility for Financial Reports They must disclose any fraud involving management or employees with a significant role in internal controls, regardless of the dollar amount.
Section 404 Management Assessment and Auditor Attestation
Section 404(a) requires every annual report to contain an internal control report. Management has to state its responsibility for establishing adequate internal controls over financial reporting and include an assessment of whether those controls are effective as of the fiscal year-end.3Office of the Law Revision Counsel. United States Code Title 15 7262 – Management Assessment of Internal Controls
Section 404(b) adds a second layer: the company’s external auditor must independently evaluate and report on management’s assessment. This attestation significantly increases compliance costs, so Congress built in exemptions. Companies that are neither large accelerated filers nor accelerated filers are exempt from the auditor attestation. Smaller reporting companies with annual revenues below $100 million also qualify.3Office of the Law Revision Counsel. United States Code Title 15 7262 – Management Assessment of Internal Controls The management assessment under Section 404(a) still applies to these companies; the exemption only removes the external auditor’s attestation.
Penalties for Certification and Reporting Failures
The consequences of internal control failures at public companies extend well beyond reputation.
Under SOX Section 906, a CEO or CFO who knowingly certifies a financial report that doesn’t comply with the law faces up to a $1 million fine and up to 10 years in prison. If the false certification is willful rather than merely knowing, the penalties jump to a $5 million fine and up to 20 years in prison.4Office of the Law Revision Counsel. United States Code Title 18 1350 – Failure of Corporate Officers to Certify Financial Reports The line between “knowing” and “willful” matters: willful means the officer intended the false certification, not just that they were aware of the problems.
The Securities Exchange Act imposes criminal penalties for willful violations of its reporting and disclosure requirements. Individuals face fines up to $5 million and up to 20 years of imprisonment. Entities face fines up to $25 million.5Office of the Law Revision Counsel. United States Code Title 15 78ff – Penalties
The SEC can also bring civil enforcement actions. Civil monetary penalties are assessed per violation across three tiers. Tier 1 covers any violation. Tier 2 applies when there is fraud, deceit, or reckless disregard. Tier 3 applies when a Tier 2 violation causes substantial losses or gains. Per-violation caps range from $7,500 for individuals at Tier 1 up to $725,000 for entities at Tier 3. When the SEC brings an action in federal court, the maximum can rise to the total amount of the violator’s financial gain if that figure exceeds the statutory cap, and the determination of how many separate violations occurred involves considerable discretion, so total penalties in a major action can reach tens of millions of dollars.
Material Weaknesses and Significant Deficiencies
When an assessment identifies a problem with internal controls, the severity of the problem determines what the organization has to do about it. The Public Company Accounting Oversight Board’s auditing standards establish two key classifications.
A material weakness is a deficiency, or a combination of deficiencies, where there is a reasonable possibility that a material misstatement of the company’s financial statements won’t be prevented or caught in time.6Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting “Reasonable possibility” includes events that are either reasonably possible or probable, which is a lower bar than most people assume. A material weakness triggers mandatory public disclosure, and SEC staff generally expect management to use the specific term “material weakness” in filings.7U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting
A significant deficiency is less severe than a material weakness but still important enough to warrant attention from those overseeing financial reporting.6Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting Significant deficiencies have to be communicated to the audit committee but don’t always require public disclosure unless the company made a material change to its controls in response, in which case it must disclose the change and may need to discuss the nature of the deficiency to keep the disclosure from being misleading.7U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting
Whistleblower Channels and Protections
SOX doesn’t just require controls. It also creates channels for employees to report when those controls fail. Section 301 requires the audit committee of every public company to establish procedures for receiving, retaining, and handling complaints about accounting and internal control matters, and employees must be able to submit concerns about questionable accounting or auditing practices confidentially and anonymously.
Section 806 protects employees who report suspected violations from retaliation. An employee who provides information about conduct they reasonably believe violates federal securities fraud statutes, SEC rules, or other federal law relating to shareholder fraud is protected whether they report to a federal agency, a member of Congress, or a supervisor within the company.8Whistleblower Protection Program. Sarbanes-Oxley Act (SOX) Retaliation can include firing, demotion, suspension, threats, or any form of discrimination in employment terms.
Documenting and Testing Controls
Documentation proves to auditors and regulators that controls exist, and it gives employees a reliable reference for how things should actually work.
A control matrix is a central inventory of every control the organization relies on. Each entry typically includes a unique control ID, a plain description of what the control does, how often it operates, the individual accountable for executing it, the specific risk it addresses, and whether it’s preventive, detective, or corrective. The matrix becomes the master reference auditors use to select which controls to test.
Process narratives supplement the matrix with detailed written descriptions of how key business processes actually work: the governance structure overseeing the process, how transactions get authorized, where segregation of duties applies, which data systems feed into the process, who supervises and reviews the work, and how accounting entries get recorded. A good narrative lets someone unfamiliar with the organization follow the process end to end.
Assessment then verifies that what’s documented actually happens. A walkthrough traces a single transaction from entry to final recording, confirming each control point operates as described. This is where written procedures often drift from reality; the policy says a supervisor reviews every journal entry, but in practice entries below a certain amount go through without review. Testing evaluates whether controls operated effectively over time by pulling samples of transactions and examining the evidence, with sample size scaled to how often the control operates and how important it is to reporting accuracy.
When testing reveals a deficiency, there is no fixed calendar deadline for correcting it. The timeline depends on the severity and root cause, but management is expected to begin remediation as soon as a deficiency is identified. Remediation involves understanding the root cause, developing a plan with assigned responsibilities and due dates, executing the fix, and then testing the remediated control long enough to confirm it works. Deficiencies identified late in the fiscal year can create real problems because there may not be enough time to implement, test, and demonstrate the effectiveness of a fix before the annual report is due.
Private Companies and Nonprofits
The Sarbanes-Oxley Act applies only to public companies. That doesn’t mean private businesses and nonprofits can ignore internal controls. The COSO framework is designed for organizations of all sizes and types, and many private companies adopt it voluntarily because investors, lenders, and insurance carriers expect it.1COSO. Internal Control
Nonprofits and other non-federal entities that receive federal grants or awards face mandatory requirements under the Uniform Guidance. These organizations have to establish, document, and maintain effective internal controls over their federal awards, and those controls have to align with either the COSO framework or the Government Accountability Office’s Standards for Internal Control in the Federal Government.9eCFR. 2 CFR 200.303 – Internal Controls The Uniform Guidance also requires prompt action when noncompliance is identified and reasonable measures to safeguard sensitive information, including personally identifiable data.
For smaller organizations without dedicated compliance staff, the core principles still apply even if the execution is simpler. A five-person nonprofit won’t have a full-time internal auditor, but it can still separate check-signing authority from bookkeeping, reconcile bank accounts monthly, and require board review of financial statements. The scale changes; the logic doesn’t.