Internal controls are the rules and procedures implemented by a company to guarantee the uprightness and integrity of financial and accounting information, promote accountability and most importantly, prevent fraud. This article elaborates on ‘Internal Control Categories’.
There are various ways internal controls can be designed and implemented in practice. For overview purposes, internal controls can be defined and categorized in the different ways.
Mandatory Controls
Mandatory internal controls are those controls that must be developed and applied when needed. Mandatory controls are applied in those processes where management sets a zero-tolerance level. Mandatory controls are used to prevent breaches of laws and non-compliance with applicable regulations or internal policies. The application of these types of controls minimizes the chance of occurrence of key or significant risks to which an organization is exposed. The management of an organization usually sets a zero-tolerance level in the regulatory compliance area to minimize the risk that hefty fines or penalties are imposed by regulators.
Discretionary Controls
Managers may be permitted by senior management to interpret or judge the significance of identified risks and apply the so-called discretionary controls. Managers assess the identified risks and, based on the use of judgment and availability of historical data, apply the required discretionary controls to mitigate the risk.
Manual Controls and Automated Controls
Manual controls are physically applied by the management or an individual employee. In the case of manual controls, a person must review and give approval or authorization to the individual activity such as a transaction. Automated controls are controls that are programmed and built into the systems used by the organization. Automated controls do not require human intervention and are automatically applied and run in the system based on defined parameters. However, automated controls might require a person to verify the results of the automated controls.
General Information Technology Controls and Application Controls
Organizations deploy technology and infrastructure to automate business processes and operations. Acquisition and installation of technology and infrastructure require the development and implementation of different types of IT-related controls. The purpose of IT controls is to safeguard the system and infrastructure from being used by any unauthorized personnel.
The organization develops general and application IT controls.
General IT controls: These controls are applied to ensure the reliability of data generated by systems helping to ascertain whether systems operate as intended and the output produced is reliable. Application controls: These controls are automated controls built into the application or systems used by the organization. Application controls aim to ensure that complete and accurate input, processing, and output of data are performed by the system and application used.
Final Thoughts
Internal Controls is applicable and relevant to everyone in the workplace. It speaks our moral responsibility and comply with University policies and procedures, as well as to hold ourselves accountable. The sole purpose of Internal Controls is to help defend and safeguard an organization and further its objectives. Internal controls’ role is to reduce and minimize risks, and protect assets, ensure accuracy of records, promote operational efficiency, encourage adherence to policies, rules, regulations and laws.
