Knowledge base · Governance & controls
What are internal controls?
Short answer
Internal controls are the policies, procedures, systems and oversight that an organisation's board and management put in place to give reasonable assurance that operations are effective and efficient, financial reporting is reliable, assets are safeguarded, fraud and errors are prevented or detected, and laws and regulations are complied with.
Definition of Internal Controls (also: internal financial controls, IFC, internal control system, COSO internal control framework)
Internal controls are how an organisation makes sure that what is supposed to happen does happen, and that what should not happen is stopped or caught. They range from simple checks, such as two signatures on a cheque, to system-enforced approval workflows, reconciliations, access restrictions and board-level oversight.
Good controls protect against error as much as fraud. But for a forensic investigator, the starting question in almost every case is: which control failed, was missing, or was overridden?
What are the components of internal control?
The most widely used reference is COSO's Internal Control – Integrated Framework (2013), which sets out five components supported by 17 principles:
| Component | What it covers |
|---|---|
| Control environment | Tone at the top, integrity and ethical values, board oversight, structure, accountability |
| Risk assessment | Identifying and analysing risks to objectives, including fraud risk |
| Control activities | Approvals, authorisations, reconciliations, segregation of duties, IT general controls |
| Information and communication | Quality information flowing to the right people, including reporting channels |
| Monitoring activities | Ongoing and separate evaluations, and fixing deficiencies |
COSO Principle 8 specifically requires the organisation to consider the potential for fraud when assessing risks, which is why a fraud risk assessment is part of any mature control system.
Types of controls
- Preventive: stop a problem before it happens, such as approval limits, access restrictions and vendor master controls.
- Detective: find problems after the event, such as reconciliations, exception reports and data analytics.
- Corrective: fix the problem and the weakness that allowed it.
- Manual versus automated: system-enforced controls are harder to bypass but depend on sound IT general controls.
Our view on what tight systems actually mean applies these categories process by process.
What does Indian law require?
The Companies Act 2013 places internal financial controls (IFC) at board and auditor level:
- s. 134(5)(e): for listed companies, the Directors' Responsibility Statement must confirm that internal financial controls are laid down, adequate and operating effectively. The Explanation defines IFC to include safeguarding assets and preventing and detecting frauds and errors.
- s. 143(3)(i): the statutory auditor's report must state whether the company has adequate internal financial controls with reference to financial statements, and whether they operate effectively.
- s. 138: prescribed classes of companies must appoint an internal auditor.
Where auditors come across fraud, s. 143(12) reporting obligations may arise. Regulated entities have further requirements, for example RBI's fraud risk management directions for banks and NBFCs.
Why do internal controls fail?
The ACFE's Occupational Fraud 2026 report found that lack of internal controls was the primary weakness in 33% of cases and override of existing controls in 19%, together accounting for more than half. Typical failure patterns include:
- One person able to create a vendor, approve its invoice and release payment.
- Controls that exist on paper but are routinely bypassed for "urgent" payments.
- Management override, such as manual journal entries at period-end without review.
- Excessive or outdated system access, including for former employees.
- Exception reports that are generated but never read.
How do internal controls differ from internal audit and forensic audit?
Internal controls are owned by management and operate day to day. Internal audit independently tests whether those controls are designed and working well. A forensic audit is triggered when there is suspicion of fraud, and examines specific transactions to establish what happened, who was involved and how controls were circumvented. Post-investigation, findings typically feed back into control redesign.
For practical guidance, see how to build a fraud risk management framework. Our forensic accounting and data analysis service covers control-gap analysis and transaction testing following suspected fraud.
Frequently asked questions
What are internal financial controls under the Companies Act 2013?
The Explanation to s. 134(5)(e) defines internal financial controls as policies and procedures for the orderly and efficient conduct of business, including safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of records, and timely preparation of reliable financial information. Directors of listed companies must confirm they are adequate and operating effectively.
What are the five components of the COSO framework?
COSO's Internal Control – Integrated Framework (2013) has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. These are supported by 17 principles. An effective system needs all five components present and functioning together, so strong transaction controls cannot compensate for a weak tone at the top or absent monitoring.
Do strong internal controls guarantee that fraud will not happen?
No. Controls give reasonable, not absolute, assurance. They can be overridden by senior management, defeated by collusion between employees or with vendors, or bypassed when staff ignore them under pressure. That is why boards combine preventive and detective controls with a fraud risk assessment, a working whistleblower mechanism and independent review, and investigate promptly when red flags appear.