Internal controls and governance
Clear definitions and practical examples to help you understand the numbers and decisions.
Internal control
Internal control is the system of people, decisions, procedures, information, and technology used to manage risk while pursuing operating, reporting, and compliance objectives. A control can prevent a problem, expose it after the event, or help correct it.
Read the explanationControl environment
The control environment is the setting in which every other control operates: the board and leaders’ conduct, ethical expectations, reporting lines, competence, incentives, and willingness to deal with bad news. It does not perform a reconciliation or approve a payment. It makes it more or less likely that people will follow those controls when a target is under pressure.
Read the explanationPreventive control
A preventive control acts before a risky transaction, change, or access request is completed. It places a condition in the process: a system block, required approval, permitted-user rule, or validation of key evidence. Its purpose is to stop an error or unauthorized action while it is still cheap to correct.
Read the explanationDetective control
A detective control looks for an error, irregularity, or failed preventive control after the fact or after an attempt. Reconciliations, exception reports, management reviews, and inventory counts are common examples. Its value depends on how quickly it is performed, who investigates the exception, and whether the response is completed.
Read the explanationCorrective control
A corrective control is the action taken after a problem is found: contain the immediate effect, repair records or access, identify the cause, and change the process where necessary. It is different from a detective control. A reconciliation may reveal a duplicate payment; corrective action deals with the payment, the records, and the condition that allowed it.
Read the explanationSegregation of duties
Segregation of duties separates steps that would be dangerous in one person’s hands. For a supplier payment, those steps may include creating supplier details, confirming goods were received, entering an invoice, releasing payment, and reconciling the bank account. The point is not to create bureaucracy; it is to make an error or misuse visible to another person.
Read the explanationDual authorisation
Dual authorisation requires two authorised people to approve a defined action before it proceeds, commonly a high-value payment, change to a bank beneficiary, or unusual contract. It reduces reliance on one person or one compromised credential. The two approvals should be separate in authority and in the evidence each person examines.
Read the explanationApproval limit
An approval limit is the maximum commitment that a role may approve under the organisation’s authority rules. It should be applied to the real exposure: the full contract term, related change orders, or linked purchases where those are part of one decision. Splitting invoices or signing a recurring agreement in small monthly amounts should not turn a larger commitment into a lower-authority decision.
Read the explanationDelegation of authority
Delegation of authority formally assigns decision rights to roles within defined limits and conditions. It tells staff who may commit the organisation, approve a payment, sign a contract, or make another specified decision. Delegating a decision right can speed routine work, but the person or body that grants the authority retains its broader accountability for the framework and oversight.
Read the explanationAuthorisation matrix
An authorisation matrix translates the organisation’s delegation into an operational map. For each transaction or decision type, it identifies the authorised role, limit or condition, required evidence, and escalation route. It gives staff and systems a common answer to “who may approve this, on what basis, and what happens if it falls outside the rule?”
Read the explanationThree-way matching
Three-way matching compares three pieces of evidence before an invoice is paid: what was ordered, what was received or accepted, and what the supplier invoiced. The comparison commonly tests supplier, item or service, quantity, price, and agreed terms. It creates a disciplined question: does the company have evidence that it owes this amount for what it intended to buy?
Read the explanationAudit trail
An audit trail is the linked record of a transaction or decision: the source request, supporting documents, system entries, approvals, changes, timestamps, and the people who made them. It lets someone who was not involved reconstruct what happened without relying on memory or a later verbal explanation.
Read the explanationAccess control
Access control governs who can enter systems, see information, create or change records, approve actions, and administer other users. Good access is based on a role and a real business need, is limited to the minimum needed, and changes promptly when a person moves or leaves. It is a practical expression of authority and segregation of duties.
Read the explanationManagement override
Management override occurs when a senior person directs or enables an exception to an established control, policy, workflow, or accounting treatment. Some overrides can be justified, such as an urgent safety decision or a documented business exception. The risk arises because senior authority can defeat controls designed to protect the organisation from error, bias, or misuse.
Read the explanationControl deficiency
A control deficiency exists when a control is missing, poorly designed, not operating as intended, or unable to address its stated risk. It may arise from an unclear rule, weak evidence, an automated configuration error, lack of competence, or a review that is performed too late. The label identifies a condition; the seriousness depends on likelihood, possible impact, and other controls.
Read the explanationCompensating control
A compensating control is a different action that reduces a risk when the preferred control cannot be used or is not feasible. It is not simply any extra review. It should address the same risk with enough frequency, independence, evidence, and authority to make the residual risk acceptable for the circumstances.
Read the explanationRisk assessment
Risk assessment is the process of identifying events or conditions that could affect an objective, considering their causes, likelihood, and potential impact, and deciding how to respond. It connects strategy, operations, reporting, compliance, and controls. It is not a list of alarming possibilities; it should produce prioritised decisions that someone can act on.
Read the explanationInherent risk
Inherent risk is the level of exposure in an activity before considering the controls that management has put in place. It reflects the nature of the activity and its environment: complexity, judgment, transaction volume, rapid change, incentives, external dependence, or susceptibility to error or fraud. It is a starting point for deciding where control effort may be needed.
Read the explanationResidual risk
Residual risk is the exposure that remains after considering the controls, safeguards, or responses in place. It is the risk management and the board must be willing to accept, reduce further, transfer, avoid, or monitor. Effective controls may lower likelihood, impact, or both, but they rarely remove all uncertainty.
Read the explanationRisk appetite
Risk appetite is the amount and type of risk an organisation is prepared to accept in pursuit of its objectives. It is a strategic choice, not a claim that every risk is desirable. It should reflect purpose, financial capacity, obligations, stakeholders, and the consequences of failure, then guide choices about growth, investment, compliance, safety, and resilience.
Read the explanationRisk tolerance
Risk tolerance is the permitted range of variation or exposure around an objective before action or escalation is required. It turns a broad risk appetite into usable boundaries: a service may allow a limited delay, a project may allow a defined cost variance, or a compliance process may allow no intentional breach. Tolerances must suit the objective and the consequence of exceeding them.
Read the explanationRisk register
A risk register is a structured record of identified risks, their objectives, causes, assessments, responses, accountable roles, triggers, and review dates. Its purpose is to help management follow through on risk decisions, not to create a catalogue that becomes stale after a workshop.
Read the explanationControl owner
A control owner is the role responsible for making sure a specific control operates as designed: the procedure is clear, the person performing it is capable, evidence is retained, exceptions are addressed, and weaknesses are escalated. Ownership of a control is narrower than accountability for the whole business objective or risk.
Read the explanationInternal audit
Internal audit is an independent function within or engaged by an organisation that provides assurance and advice about governance, risk management, and internal controls. It evaluates whether processes are designed and operating effectively, reports its conclusions to appropriate oversight, and follows up agreed actions. It does not run the controls it audits.
Read the explanationExternal audit
External audit is an independent examination of an entity’s financial statements, performed by an external audit firm or auditor under applicable law and professional standards. The auditor obtains evidence and expresses an opinion on whether the statements are presented fairly, in all material respects, under the applicable reporting framework.
Read the explanationAudit committee
An audit committee is a committee of the board or equivalent governing body that oversees the integrity of financial reporting, the external audit relationship, internal audit, internal control, risk matters within its remit, and the handling of significant concerns. Its exact authority and composition depend on law, listing rules, and organisational structure.
Read the explanationRelated-party transaction
A related-party transaction is a transfer of resources, services, or obligations between a reporting entity and a related person or entity, whether or not a price is charged. A related party can include an entity controlled by a director, a parent, a subsidiary, or another party defined by the reporting framework.
Read the explanationConflict of interest
A conflict of interest exists when a person’s personal, family, financial, or outside interest could influence, or reasonably appear to influence, their professional judgment. The conflict is a situation to disclose and manage; it is not automatically evidence of misconduct, fraud, or a bad decision.
Read the explanation