Internal control is a system of rules and procedures that an organization establishes to ensure the reliability of its financial reporting, the effectiveness and efficiency of its operations, and its compliance with applicable rules, regulations and laws. Internal controls are devised and implemented not only by the organization's directors, but also its leadership and managers. Although they are designed to accomplish a number of objectives, internal controls are primarily oriented toward an organization's financial activities. A properly designed system of internal control in an organization's operations can prevent mismanagement and misfeasance, including embezzlement, fraud and theft.
A commonly understood feature of misfeasance is that it operates most successfully under a veil of secrecy &emdash; the fewer people who are aware of it, the greater the likelihood of success. The more people who are aware, then, the greater the likelihood either of failure or deterrence. For instance, it might be relatively easy for a bookkeeper to write fraudulent checks if only one signature is required, but if two are required, it makes the theft much more difficult.
One of the simplest methods of internal control, then, is the segregation of duties of individuals involved in financial activities. Most organizations, for example, require two signatures on checks, or on checks that exceed a certain amount, which ensures that checks cannot simply be written by one person at will. When checks are machine- or computer-printed, those responsible for printing the check should not sign them (or apply mechanical signatures) &emdash; that job should be assigned to another person. When checks are written in payment for the receipt of goods, internal control systems should require that before the payment check is written, documentation of the shipment's receipt be matched with the invoice. This simple rule ensures that the person responsible for making the payment can be reasonably certain that the goods have actually been received in good condition, even if the receiving location is far removed from the finance office. If the check must be signed by someone else, it will be accompanied by all the documentation, which will be reviewed before the check is signed and transmitted to the vendor.
An unpopular component of many internal control systems is the prohibition of personal relationships, including marriage, between employees in the financial services departments and other departments. If a personal relationship arises between, say, someone in the accounts payable department and someone in the warehouse, one would be expected to resign and find employment elsewhere to avert even the appearance of impropriety.
Publicly-held companies, and many large privately-owned companies, have internal controls requiring periodic audits by an outside accounting firm, as well as internal auditing departments charged with regularly reviewing financial transactions and other operations. Properly performed, these third-party and internal audits will examine a company thoroughly, analyzing its procedures from the perspective of internal control and exploring transactions to ensure that they are as represented.
Systems of internal control, while commonly understood as financial in nature, aren't restricted to financial activities, but extend to other areas of a company's operations, to help ensure that they're in fact taking place as expected. “Quality control” and “quality assurance” departments are operational control mechanisms that work to ensure that everything from labeling to security seals to ingredients are exactly as represented. Inventory control mechanisms help protect the company from loss due to pilferage, and security personnel not only keep unauthorized personnel out of a facility, they deter pilferage.
Internal control procedures and practices acquired greater importance in the United States in 2002 with the enactment of the Sarbanes-Oxley Act, titled the "Public Company Accounting Reform and Investor Protection Act." Enacted in response to a number of corporate and accounting scandals, it placed a much greater degree of accountability on the executives of publicly-held corporations. For instance, company executives routinely sign their companies' annual reports; Sarbanes-Oxley holds them personally accountable for their material inaccuracies. Those executives thus have extra incentive to implement thorough systems of internal control to ensure their reports' reliability.