Procedure internal control is the set of documented steps and checks an organization follows to ensure its processes run correctly, assets are protected, and records are accurate. In plain terms, it is the written playbook that tells employees exactly what to do, who approves what, and how to catch mistakes before they become costly problems.
What Are Internal Controls, Really?
Internal controls are the policies, procedures, and activities designed to give reasonable assurance that an organization meets its objectives. They are not just about preventing fraud, though that is a major reason they exist. They also help ensure financial reporting is reliable, operations are efficient, and laws and regulations are followed.
Think of a simple purchase process. Without controls, any employee could order anything, sign the check, and record the transaction. With controls, the person who orders is different from the person who approves, and the person who records the payment is different from the person who signs the check. That separation is a classic control called segregation of duties.
Why Procedures Matter in Internal Control
A procedure is the specific, step-by-step instruction for completing a task. The control is the check built into that procedure. For example, the procedure for paying an invoice might be:
- Receive the invoice and match it to the purchase order.
- Verify the goods or services were received.
- Obtain approval from the department manager.
- Enter the invoice into the accounting system.
- Schedule payment and have a second person review the batch.
Each step is a control point. The procedure makes the control repeatable and auditable. Without a written procedure, controls are inconsistent and depend on individual memory or habit.
Core Components of a Procedure Internal Control System
Most internal control frameworks share five key components, originally defined by the Committee of Sponsoring Organizations (COSO). These are:
- Control environment: The tone at the top, including integrity, ethical values, and management philosophy.
- Risk assessment: Identifying and analyzing risks that could prevent achieving objectives.
- Control activities: The policies and procedures themselves, such as approvals, authorizations, verifications, reconciliations, and segregation of duties.
- Information and communication: Ensuring relevant information is captured and shared with the right people in a timely way.
- Monitoring: Ongoing evaluations and separate assessments to see if controls are working.
These components apply to any organization, from a small nonprofit to a multinational corporation.
How to Write and Implement a Procedure Internal Control
Creating a procedure internal control document does not require a law degree or a consultant. It requires clear thinking and collaboration with the people who actually do the work.
- Map the process: Walk through the current process from start to finish. Note every step, every person involved, and every system used.
- Identify risks: Ask what could go wrong at each step. Could an error occur? Could someone misuse assets? Could the record be inaccurate?
- Design controls: For each risk, decide what control will prevent or detect it. Common options include approvals, dual signatures, reconciliations, and system access limits.
- Write the procedure: Use plain language. Number the steps. State who is responsible for each action. Include what forms or systems to use.
- Get approvals: Have management review and formally approve the procedure. This gives it authority.
- Train employees: Explain not just what to do, but why the control exists. People are more likely to follow a control they understand.
- Review regularly: Procedures become outdated as processes change. Schedule a periodic review, at least annually.
Common Problems and How to Avoid Them
Even well-designed procedures fail when they are too complex, too vague, or ignored. Some frequent issues include:
- Over-control: Too many approvals slow work and frustrate employees. Focus controls on high-risk areas.
- Under-control: Small organizations often lack segregation of duties because there are too few staff. Compensating controls, like owner review of bank statements, can help.
- Documentation gaps: If a procedure is not written, it is not a procedure. It is a habit.
- No monitoring: Controls that are never tested may be broken. Periodic audits or spot checks are essential.
- Ignoring exceptions: When employees bypass a control “just this once,” the control becomes meaningless.
A common misconception is that internal controls are only about preventing theft. In reality, they also prevent honest mistakes, such as paying a duplicate invoice or misclassifying an expense. A good control system catches both intentional and unintentional errors.
Template for a Procedure Internal Control Document
Procedure Title: _________________________________________
Procedure Number: ______________ Effective Date: ______________
Department: ____________________ Owner: ____________________
Purpose: ______________________________________________________________________
Scope: _______________________________________________________________________
| Step | Action | Responsible Role | Control Point | System/Form |
|---|---|---|---|---|
| 1 | ||||
| 2 | ||||
| 3 | ||||
| 4 | ||||
| 5 |
Approval: ______________________________ (Signature) ______________________________ (Date)
Sample (fictional): For a small retail store, Step 1 might be “Count cash in drawer at opening,” Responsible Role “Cashier,” Control Point “Compare to prior day’s closing count,” System/Form “Daily Cash Log.”
Costs and Benefits of Strong Procedure Internal Controls
Implementing controls costs time and money. Documentation takes effort, training takes hours, and segregation of duties may require hiring or reassigning staff. However, the cost of weak controls is often higher: fraud losses, regulatory fines, audit findings, and reputational damage.
For small businesses, the cost can be minimized by focusing on the highest-risk areas: cash handling, bank reconciliations, payroll, and purchasing. A simple spreadsheet and a monthly owner review can be effective without a full accounting department.
Frequently Asked Questions
What is the difference between a policy and a procedure?
A policy is a high-level statement of what the organization intends to do, such as “We will maintain accurate financial records.” A procedure is the detailed how-to, such as “The accounts payable clerk will match invoices to purchase orders before entry.” Policies set the rule; procedures implement the rule.
How often should internal control procedures be updated?
At least once a year, or whenever a significant change occurs in the process, the people, or the technology. If a new software system is introduced, the procedure should be rewritten before the system goes live.
Can a small business with only two employees have good internal controls?
Yes, but the controls must be adapted. With only two people, full segregation of duties is impossible. The owner can compensate by personally reviewing bank statements, approving all payments, and doing a monthly reconciliation. The key is that the owner does not delegate these checks.
What is a compensating control?
A compensating control is an alternative control that reduces risk when the ideal control is not feasible. For example, if a company cannot hire a separate person to approve invoices, the owner might review a weekly list of all payments. This does not replace the ideal control, but it provides some oversight.
Are internal controls required by law?
For public companies in the United States, the Sarbanes-Oxley Act requires management to assess and report on the effectiveness of internal controls over financial reporting. Nonprofits and private companies are not generally required by law, but many auditors and funders expect them to have reasonable controls.
What happens if a procedure is not followed?
It depends on the severity. Minor deviations may be corrected with coaching. Repeated or deliberate bypassing of a control is a red flag and should be investigated. If the bypass allows fraud or errors, the consequences can be serious, including financial loss and legal liability.
When to Ask for Professional Help
If your organization is facing a complex risk, such as a merger, a new regulatory requirement, or a suspected fraud, it is wise to consult a certified public accountant or an internal audit professional. They can assess your specific situation and design controls that fit your size and industry.