Internal Control Assessment: Protecting Your Business

A financial error rarely begins with one major breach. More often, it starts with an unapproved invoice, excessive system access granted to a single employee, a delayed reconciliation, or a practice everyone is used to but nobody verifies. An internal control assessment brings these points to light — before an operational gap turns into a financial loss, a tax exposure or a reporting problem.

For a company, control is more than a formal policy. It is a system of rules, responsibilities and checks that ensures transactions are recorded correctly, payments are approved, data remains protected, and management makes decisions based on reliable information. This matters most for growing businesses, those operating across several locations, and those connected to the U.S. market, where the complexity of financial processes increases quickly.

What an Internal Control Assessment Examines

The purpose of an assessment is not merely to confirm that a company has documents and procedures. The key question is whether those procedures work in day-to-day practice and genuinely reduce material risk.

Across financial processes, the assessment covers revenue recognition, procurement, supplier payments, payroll, bank reconciliations, inventory management, and the month-end and year-end close. In each process, segregation of duties is essential: the employee who adds a new supplier to the system should not be the only person who approves the payment and executes the bank transfer.

Information technology controls are assessed as well: who has access to the accounting system, who can change bank details, how passwords and access rights are managed, whether a change history is retained, and how data is recovered. These controls are particularly relevant for remote teams, multiple software systems and the use of external service providers.

From a tax perspective, attention is paid to the data and the approval chain on which tax returns and tax reporting are prepared. If revenue, expense, payroll or VAT-related information comes from different sources, a clear reconciliation mechanism is essential. Otherwise, even a formally correct return may be built on incomplete or inaccurate data.

Why an Audit Alone Is Not Enough

An external audit provides an independent opinion on the reliability of the financial statements. An internal control assessment, by contrast, is a more practical management tool: it identifies where errors, fraud opportunities, data loss or compliance breaches may arise, and what action is needed to reduce the risk.

During an audit, controls are often evaluated only to the extent needed to plan the audit procedures. A separate, targeted assessment can go much deeper into a specific process — for example, only payment authorization, revenue recognition or user access to the accounting system. The choice depends on the company's size, risk profile, regulatory requirements and issues identified in recent periods.

A small business cannot always achieve full segregation of duties, because only a few people work in the finance team. In such cases, the goal is not to mechanically copy a large corporation's model. Compensating controls can be introduced instead: periodic review by the owner or the finance director, independent bank reconciliation, a pre-approved payment register, defined limits, and regular review of system reports, including the change log.

When an Assessment Is Especially Needed

An internal control assessment is useful on a periodic basis, but certain events make postponing it riskier. Rapid growth, for example, often means new employees, new software and higher transaction volumes. A process that worked for ten invoices may no longer be sufficient for thousands of transactions.

Particular attention is needed during an acquisition, the creation of a new legal entity, entry into a foreign market, a change of ERP or accounting system, and a significant reorganization of the finance team. These changes are often accompanied by temporary manual operations, unclear responsibilities and data migration risk.

Other warning signs include recurring adjustments after the month-end close, delayed bank reconciliations, unexplained inventory differences, frequent changes to supplier bank details, or accounts whose origin the finance team cannot quickly explain. These signs do not always indicate a violation, but they do show that the process needs more transparency and review.

A Practical Assessment Process

An effective assessment starts with an understanding of the business's objectives and risks. For one company, the priority may be correct revenue recognition; for another, inventory protection; for a third, control over payroll and tax processes across multiple locations. The assessment should be based on real risks, not on a pre-prepared questionnaire that is identical for every business.

Next, the key processes, responsible persons, systems in use and critical documents are defined. Interviews are only the beginning. It is essential to trace real transactions: how a purchase request was created, who approved it, how the invoice was matched to the goods received, who released the payment, and whether the transaction was posted to the correct account.

At this stage, the gap between the described policy and actual practice often emerges. A policy may state that every payment requires two-level approval, yet in the system a single user both approves and executes the transfer. Such a gap should not be treated merely as a technical deficiency — it is a matter of accountability and financial risk.

After testing, a prioritized picture of risks and recommendations is prepared. High-risk issues require a prompt response: restricting access, changing the authorization rule, restoring reconciliations, or introducing an independent review. For medium- and low-priority issues, it is important to assign an owner, a deadline and a measure of success. A recommendation with no owner and no deadline often remains merely a page in the report.

Control Design and Operating Effectiveness

A control may be properly designed yet not performed in practice. For example, a monthly bank reconciliation is a good control only if it is genuinely completed on time, differences are investigated, and the result is reviewed by a responsible person. The assessment must therefore answer two questions: is the control sufficient for the given risk, and is there evidence that it operates consistently?

Excessive control is also a problem. If a low-risk transaction requires several signatures and manual checks, the process slows down and employees begin to work around it. An effective system strikes a reasonable balance between protection and operational speed.

How Management Can Use the Results

The value of an assessment grows when its results move onto the management agenda. A finance director can use it to speed up the close and improve reporting quality; a chief executive — to prioritize operational risks; an owner — to strengthen independent oversight of cash flows and payments.

Control improvement should not become a one-off project. After a new system is introduced, an employee leaves, a new market opens or tax requirements change, the risk picture changes as well. A practical approach is to review key controls periodically and give management short, evidence-based reporting: what has changed, which risks have been reduced, and where action is still needed.

Combining AGIC's audit, advisory and accounting expertise helps a company see controls not merely as an inspection requirement, but as a management tool. The aim is to create a financial environment in which data is timely, responsibilities are clear, and tax and management decisions rest on verifiable facts.

Good control does not express distrust of employees. It protects employees from unclear responsibility, protects the company from avoidable errors, and enables management to make important decisions on the basis of a reliable financial picture instead of assumptions.