In an audit, a control is any policy, procedure, or safeguard a company puts in place to keep its financial reporting accurate, its operations running properly, and its compliance obligations met. Auditors examine these controls to decide how far they can trust the company’s own processes and how deeply they need to dig into the underlying numbers themselves. Strong controls usually mean a leaner, cheaper audit. Weak or missing controls mean the auditor has to do more direct testing, and for a public company, a serious control failure can produce an adverse opinion that becomes part of the public record.
The word “control” covers a lot of ground. A manager’s signature on a purchase order is a control. So is a software rule that blocks a duplicate invoice number, a monthly bank reconciliation, and the company’s code of ethics. What ties them together is purpose: each one is designed to keep something from going wrong in the financial statements, or to catch it quickly if it does.
What Controls Are Meant to Do
Controls fall into three functional categories based on when they act relative to a problem.
- Preventive controls stop errors or fraud before they happen. Requiring a manager to approve purchases above a certain dollar threshold is preventive. So is separating the person who writes checks from the person who reconciles the bank account. Catching a problem at the front end is almost always cheaper than cleaning it up later.
- Detective controls catch problems after the fact. Monthly bank reconciliations, physical inventory counts, and exception reports that flag unusual transactions all sit here. No set of preventive controls is perfect, so detective controls are the safety net.
- Corrective controls fix whatever the detective controls surface. If a reconciliation turns up an unauthorized journal entry, the corrective control is the process for reversing the entry, investigating what happened, and adjusting the procedure so it doesn’t recur.
The strongest control environments layer all three. A company relying only on prevention eventually misses something. A company relying only on detection is constantly cleaning up messes.
The Five Components Auditors Expect to See
In the United States, the dominant framework for designing and evaluating internal controls comes from the Committee of Sponsoring Organizations of the Treadway Commission, known as COSO. Its Internal Control—Integrated Framework was first published in 1992 and updated in 2013.1COSO. Internal Control – Integrated Framework The framework breaks internal control into five interrelated components.2Association of International Certified Professional Accountants. COSO Internal Control – Integrated Framework
Control Environment
The control environment is the foundation. It reflects the organization’s commitment to integrity, ethical values, and competence. A company whose senior leadership ignores compliance or pressures staff to hit revenue targets at any cost has a weak control environment no matter what the written policies say. Auditors pay close attention to tone at the top because it shapes how seriously everyone else takes the rest of the system.
Risk Assessment
Management identifies what could prevent the organization from meeting its objectives, covering both internal risks like turnover in key accounting roles and external ones like changes in tax law. The framework specifically requires management to consider fraud risk: where it could occur and how.
Control Activities
These are the specific actions taken to address the identified risks. Approvals, reconciliations, access restrictions, and segregation of duties all fit here. The 2013 update added a principle for technology controls, reflecting that most financial reporting now flows through IT systems.
Information and Communication
Relevant information has to flow to the right people at the right time, inside and outside the organization. An employee who spots a suspicious transaction needs a clear channel to report it. Management needs timely numbers to make decisions. Regulators and investors need accurate external reports.
Monitoring
Monitoring evaluates whether controls are still working. It can be ongoing, like automated exception reports, or periodic, like an annual internal audit. When monitoring surfaces a deficiency, the organization is expected to route it to the people who can fix it.
Entity-Level vs. Process-Level Controls
Not every control operates at the same altitude. Auditing standards distinguish controls that affect the organization broadly from those tied to specific transaction flows.
Entity-level controls include things like the code of ethics, the audit committee’s oversight work, the risk assessment process, and the controls over period-end financial reporting.3Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Some operate with enough precision to prevent or detect a misstatement on their own. Others, like general ethical tone, work indirectly by shaping whether lower-level controls actually get followed.
Process-level controls live inside specific transaction cycles: revenue, purchasing, payroll, inventory. A three-way match comparing a purchase order, receiving report, and invoice before paying a vendor is the classic example. These are the controls auditors most often test directly because they tie to specific assertions like completeness, accuracy, and valuation.
Automated vs. Manual Controls
A manual control depends on a person: reviewing a report, signing a reconciliation, counting inventory. Manual controls handle judgment well but are vulnerable to error, fatigue, and inconsistency.
An automated control is built into an information system and runs without human intervention. A system that rejects duplicate invoice numbers, enforces credit limits, or calculates depreciation on its own is executing an automated control. The payoff is consistency: once configured properly, it behaves the same way on every transaction.
For auditors, automation changes the testing approach. Rather than sampling transactions to see whether someone performed a manual review correctly, the auditor focuses on whether the system itself is reliable. If the automated control is well designed and the surrounding IT general controls are sound, the auditor can often get comfortable with the whole population rather than just a sample. Many real-world controls are hybrids, where the system produces a report but a person reviews it for exceptions. Testing those means looking at both the system output and the human review.
Segregation of Duties
Segregation of duties sits at the heart of almost every control framework because it’s both fundamental and frequently tested. The idea is simple: no single person should control every step of a transaction. Three functions in particular need to be separated: authorization, recordkeeping, and custody of assets.
When one person can approve a payment and also record it in the books, nothing stops them from inventing a vendor and paying themselves. Splitting those duties forces fraud to require collusion, which is harder to arrange and easier to spot. Smaller organizations with thin staffing sometimes can’t achieve full segregation. In those cases, compensating controls, like detailed management review or an independent reconciliation performed by a third party, can take up the slack. Auditors evaluate whether those alternatives genuinely work, not just whether they appear in a policy.
Other common categories of control activities include physical safeguards like locks, cameras, and badge-entry systems; performance reviews comparing actual results to budgets or prior periods; information processing controls covering both IT general controls and application-level validations; and reconciliations between independent sets of records.
How Auditors Evaluate a Control
An auditor’s work on controls follows a logical sequence: understand the system, judge whether the controls are designed well, confirm they’ve been put into practice, and test whether they’re actually working.
Walkthroughs
A walkthrough is usually the auditor’s first hands-on look. The auditor follows a single transaction from beginning to end through the company’s processes, using the same documents and systems employees use. Along the way the auditor asks questions, inspects documentation, and sometimes re-performs a step. This is where controls that look fine on paper but don’t work in practice tend to surface.3Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
Design Effectiveness
The auditor asks whether the control, if performed by someone with the right authority and skills, would actually prevent or catch a material misstatement. A control can fail this test even when everyone follows it. A manager approving journal entries is poorly designed if the manager has no way to verify the entries are legitimate.3Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
Operating Effectiveness
Once the design holds up, the question becomes whether the control actually worked throughout the period. The auditor tests multiple instances using inquiry, observation, inspection of documents, and re-performance.3Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Sample sizes depend on how often the control runs, how critical it is, and the level of risk. A daily control takes a larger sample than a quarterly one.4Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2315 – Audit Sampling
Why Any of This Matters to the Company
When controls test as effective, the auditor can scale back substantive procedures, meaning less direct testing of account balances and individual transactions. That saves the company both time and audit fees. When controls are weak, the auditor expands substantive testing to compensate. This is the practical reason companies invest in strong controls in the first place: a well-controlled environment usually produces a faster, less costly audit.
When a Control Falls Short
If the auditor finds a problem, the next step is classifying how serious it is. Auditing standards recognize three severity levels.
- Deficiency: A control is designed or operating in a way that doesn’t let employees prevent or catch misstatements on a timely basis. Most deficiencies are minor and go no further than management.5Public Company Accounting Oversight Board. PCAOB Auditing Standard No. 5 – Appendix A Definitions
- Significant deficiency: A deficiency, or combination of deficiencies, serious enough to warrant the attention of those overseeing the company’s financial reporting, but not severe enough to be a material weakness.5Public Company Accounting Oversight Board. PCAOB Auditing Standard No. 5 – Appendix A Definitions
- Material weakness: A deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement in the financial statements will not be prevented or caught in time.5Public Company Accounting Oversight Board. PCAOB Auditing Standard No. 5 – Appendix A Definitions
The distinction matters. A significant deficiency gets reported to management and the audit committee but doesn’t change the auditor’s opinion. A material weakness in a public company forces an adverse opinion on internal control over financial reporting, which is a red flag for investors, regulators, and lenders. It often triggers heightened SEC scrutiny, can lead to restatements, and typically pulls the stock price down.3Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
The Limit: Management Override
Every control system has one built-in vulnerability. The people who designed it can circumvent it. A CEO who directs a journal entry to inflate revenue, or a CFO who leans on the accounting team to adjust an estimate, is overriding the very controls meant to prevent that kind of manipulation.
Auditing standards treat management override as a fraud risk present in every audit, regardless of how strong the controls look. Because management can manipulate records in unpredictable ways, the standard requires specific procedures in every engagement: testing journal entries, particularly unusual ones recorded near period-end; performing a retrospective review of significant estimates to look for bias; and evaluating the business purpose of any significant unusual transactions.6Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2401 – Consideration of Fraud in a Financial Statement Audit Even the best-designed control environment cannot fully protect a company from this risk, which is why professional skepticism about management’s incentives sits at the core of the auditor’s job.