What are internal controls?
Internal controls are the policies and checks that keep the books complete and the cash from walking. They include second signatures, split jobs, and later reviews.
Definition
Internal controls are the procedures that keep the books accurate and assets protected. They are not an account on the Balance Sheet.
They are the written rules, the second signatures, and the later reviews that sit around everyday purchases and payments. A control can be a two-signature check, a locked cash drawer, or a monthly match of the books to the bank.
The later journal still records the purchase as usual. The controls decide whether that purchase was allowed to happen the way it did.
Where it shows up
Balance Sheet: Related to nothing extra.
P&L: Related to nothing extra.
Cash flow: Related to nothing extra.
See also: Segregation Of Duties · Audit Trail · Account Reconciliation
You will not see internal controls as a line on the Balance Sheet. They do not sit in assets, liabilities, or equity.
You also will not see them on the Income Statement or the Statement of Cash Flows. Those reports show the results of transactions, not the checks that sat around those transactions.
In day-to-day books, you meet the controls in the file and at the bank. A second signature on a check, a bank reconciliation, and a positive pay list are all controls in action.
The controls do not post themselves. They only decide whether a buy or a payment may proceed, and whether a later reviewer can see what happened.
How it works
Internal controls start with written rules. The rules say who may spend, who must sign, what proof is required, and how cash is stored.
They continue with segregation of duties. The person who requests a buy should not be the only person who approves it, records it, and pays it.
They also include later checks. Someone matches the books to the bank statement, and someone reviews the check run before checks go out.
Documents sit behind the checks. A three-way match of the purchase order, the goods receipt, and the vendor bill lets a reviewer see that the business ordered, received, and was billed for the same thing.
Some controls live at the bank. Positive pay sends the bank a list of issued checks so a check that was never issued cannot clear.
A control only works if someone uses it. A two-signature rule that everyone skips on Fridays is not a control; it is a note on a wall.
When a control is skipped, the usual fix is to stop payment and complete the missing step. Accounts payable should not be paid until the required signatures and matches are on file.
Example
A cafe requires two signatures on checks over $1,000. The baker may request a $1,400 espresso machine, and the manager may agree it is needed.
The owner still has to sign the check with the manager. One name is not enough at that dollar amount.
No journal is made for the two-signature rule itself. Cash leaves later, when the machine is paid, and that later entry is the purchase.
If the manager had signed the $1,400 check alone, the bank might still pay it. The cafe's control failed at the signing step, and the owner would follow up before the next check run.
The same cafe also sends the bank a positive pay file before each check run. A check that is not on that list should not clear.
Common mix-ups
Internal controls are not the same as an audit. An audit is a later independent look at whether the statements are fairly stated, while controls are the everyday checks the business runs itself.
Internal controls are not a single policy. A spend policy is one written rulebook, while controls are the wider set of rules, splits, signatures, and later matches.
Internal controls are not the same as software. A system can route a request, but a person still has to refuse a bad buy and keep the cash drawer locked.
Related terms
- Segregation Of Duties: Splitting recording, approving, and payment tasks so no one person controls a transaction end to end.
- Approval Workflow: The routing of a request or bill through the people who must sign off.
- Audit Trail: The traceable chain from a reported number back to its source document.
- Three-Way Match: Checking the purchase order, receipt, and vendor bill against each other before paying.
- Account Reconciliation: Proving that a ledger balance agrees to independent support.
- Audit: An independent examination giving an opinion on whether statements are fairly stated.
- Spend Policy: The written rules for what employees may buy and how it must be approved.
- Positive Pay: A bank control that verifies issued checks against a list before clearing them.