Plain definition
Internal control is the system of people, decisions, procedures, information, and technology used to manage risk while pursuing operating, reporting, and compliance objectives. A control can prevent a problem, expose it after the event, or help correct it.
It provides reasonable, not absolute, assurance. People can make mistakes, collude, or override a process, so a written policy is not enough: the company needs evidence that the control actually operated.
Illustrative example
Suppose a sales manager asks finance to pay a new packaging supplier urgently. Procurement has an approved purchase order and the warehouse confirms that the packaging arrived, but the supplier’s bank details were changed that morning.
Before releasing the payment, the payables analyst calls the supplier using the previously verified contact held in the supplier record, rather than the new email. The supplier denies the change. Finance freezes the amendment, pays only after verified instructions are restored, and records the attempted change for review.
The goods-receipt check supports the purchase; it does not independently verify a change to bank details. Different risks need different controls.
Why it matters
Without this distinction, a founder can see an approved invoice and assume payment is safe. The company may then send cash to a fraudster while every document appears complete.
Controls make critical work repeatable and make exceptions visible early enough to stop loss, correct records, or change a weak process.
Practical consequence
For cash, revenue, purchasing, payroll, and key data, name the risk event, the control that addresses it, the person who operates it, and the evidence it leaves.
Set a frequency and an exception response. Review whether the control still works when staff, systems, suppliers, or transaction volume change.