Reviewing Internal Controls

Reviewing internal controls is one of those necessary tasks that can often feel more like a burden than the business asset it truly is.

Trust me, I get it. After 15 years of working closely with financial institutions, I’ve experienced firsthand how an Internal Controls Over Financial Reporting (ICFR) program can evolve from a routine checkbox into a genuine tool for operational excellence.

But here’s the thing — internal controls aren’t just about fraud prevention (though that’s still critical, especially as fraud losses hit $1.5 million USD in 2023, up 24%). They’re about instilling confidence in your financial data and, yes, keeping your auditors happy.

So, how do you make reviewing internal controls less of a headache and more of an asset? Let’s cut through the noise and get to what really matters. In this article, I’ll show you how to:

• Follow key steps to reviewing internal controls without getting buried in spreadsheets.
• Align your ICFR efforts with your broader business goals.
• Leverage technology to simplify the process and add value.

Whether you’re a seasoned SOX veteran or just stepping into the ICFR world, you’ll find practical, actionable insights that can make a real difference.

Here’s a sneak peek into what we’ll cover:

• Best practices for internal control evaluation, including how to prioritize controls when everything feels critical.
• Winning buy-in from process owners without constant follow-ups or “reminders.”
• Turning control testing into a strategic advantage rather than just a compliance requirement.

Ready to rethink how you’re reviewing internal controls? Let’s dive in and explore how to make ICFR work smarter for your organization.

Internal controls vs. ICFR: What’s the difference?

When discussing audit and compliance, it’s essential to understand the difference between internal controls and ICFR (Internal Controls over Financial Reporting). While both are crucial for effective risk management, they serve distinct purposes within an organization.

Internal Controls: Internal controls are the broader system of checks and balances used across an organization to ensure operational efficiency, compliance, asset protection, and accuracy in financial records. These controls affect multiple areas, including finance, operations, and IT, helping manage overall risks beyond just financial reporting.

ICFR (Internal Controls over Financial Reporting): ICFR is a subset of internal controls that focuses solely on financial reporting. It ensures that financial statements are accurate and free from material misstatements. It’s a critical framework for public companies that need to comply with SOX (Sarbanes-Oxley Act) or similar regulations like C-SOX (Canada’s Bill 198) and impending UK regulations. It involves stringent auditing procedures and certifications by the CEO and CFO.

When to use each:

• Use internal controls when discussing broader risk management across different areas, including operational and compliance controls.
• Use ICFR when referring specifically to controls that impact financial reporting, particularly in public companies or organizations subject to SOX compliance.

Understanding the difference helps ensure that your controls are aligned with your organizational goals, whether you’re managing operational risks or safeguarding the integrity of your financial statements.

Watch: ICFR and SOX Compliance: Financial Reporting for Organizational Excellence

5 Steps to reviewing internal controls

Reviewing internal controls doesn’t have to be overwhelming. Whether you’re preparing for an audit or tightening your ICFR process, following a structured review ensures your controls are both effective and compliant. Below are the key steps to reviewing internal controls and optimizing them for business value.

1. Assess and document current controls

Before jumping into testing or analysis, take the time to document all your existing internal controls. This step gives you a clear snapshot of what’s in place and helps uncover any gaps or areas that need improvement.

• Document Controls: Create a comprehensive list of your organization’s controls, noting their purpose and the risks they mitigate.
• Create a Heat Map: Use a heat map to visualize control performance and identify high-risk areas.
• Downloadable Checklist: Make use of an internal control review checklist to guide the assessment process and ensure no areas are overlooked.

This step ensures you have a solid foundation before moving into more detailed analysis.

2. Identify and evaluate risks

Once you’ve got a handle on your current controls, the next step is assessing the risks. Continuous risk assessments are essential because they ensure your controls are aligned with your organization’s ever-changing needs — whether that’s in finance, operations, or compliance. Assessments help make sure your controls are keeping up with the real-world challenges your business faces.

• Perform Risk Assessments: Conduct an in-depth assessment of potential risks, including operational, compliance, and financial risks.
• Update Risk Register: Ensure your risk register is current, reflecting any new threats or changes in the business environment.
• Prioritize Risks: Rank risks by likelihood and potential impact to focus your control efforts where they’re needed most.

By identifying and evaluating key risks, you can focus on high-priority areas that might need new or updated controls.

3. Test control effectiveness

Testing your controls is the backbone of any internal controls review. It helps ensure that your controls not only exist but also function as intended.

• Design Testing: Evaluate whether your controls are appropriately designed to mitigate the risks identified in the previous step.
• Operational Testing: Confirm that controls operate effectively during day-to-day processes. This may involve sampling transactions, reviewing control documentation, or performing walkthroughs to ensure accuracy and effectiveness.
• Audit Checklist: Use a detailed audit checklist to record the results of control tests and to identify any weaknesses or gaps.

Thorough control testing ensures that your controls are both fit for purpose and reliable in practice.

4. Review and analyze results

Once your testing is complete, it’s time to analyze the findings. This step helps you turn raw data into actionable insights for control improvements.

• Analyze Findings: Review your testing data to identify trends, failures, or areas where controls are lacking.
• Document Issues: Maintain clear documentation of control failures and recommended fixes, ensuring a clear audit trail.
• Use Visual Aids: Employ tools like dashboards or charts to simplify the presentation of complex data and to help stakeholders easily understand the results.

This step turns your audit into a roadmap for improvement, helping ensure that your internal control system evolves with your business needs.

5. Implement improvements

The final step is to apply what you’ve learned from your review. Implementing improvements ensures that your internal controls stay relevant and effective.

• Update Controls: Adjust or redesign existing controls where weaknesses were identified, and introduce new controls as necessary.
• Train Employees: Provide training to key staff on new or updated controls to ensure proper implementation.
• Monitor Changes: Continuously track control performance, using technology and automation where possible to maintain an ongoing review process.

Making continuous improvements is key to risk management and financial reporting accuracy. The end goal is not just compliance but creating a system of controls that contributes to business growth and operational efficiency.

Engaging key stakeholders when reviewing internal controls

When it comes to reviewing internal controls, getting your key stakeholders involved early and often is crucial. Trust me, in my years of working with finance and audit teams, the difference between a smooth review process and a chaotic one usually boils down to collaboration.

1. Involving senior management

Let’s start at the top. Senior management — think CFOs and CEOs — play a huge role in the success of internal control reviews. Their support is what drives home the importance of these reviews across the organization. Schedule regular check-ins to share audit findings and offer recommendations. It’s not just about getting buy-in, it’s about making sure they understand the risks, control deficiencies, and how these impact overall business objectives.

I always recommend providing executive summaries that highlight key risks and controls. Senior leadership doesn’t need the nitty-gritty details — they want clear, actionable insights. Remember, their approval is critical, especially when your internal controls are tied to regulatory compliance.

2. Collaborate with department heads

No one knows the ins and outs of processes better than department heads. These folks are on the frontlines of day-to-day operations, which means they can provide invaluable insights into how internal controls actually function in real time.

I’ve seen the most success when joint review sessions are scheduled with department leaders to go over control performance. By setting up feedback loops, you not only improve the controls but also foster a culture of continuous improvement.

3. Engage internal audit teams

Internal auditors are your independent voice in the review process. Their objective input helps you spot weaknesses in your controls that may go unnoticed. Auditors should be brought in as advisors, not just for post-mortem reviews, but for ongoing assessments.

Leverage audit reports to inform your internal control reviews and work with audit teams to track control improvements. One of the best things you can do is facilitate collaboration between internal auditors and control owners. This ensures that any gaps in internal controls are quickly identified and addressed.

4. Include frontline employees

Don’t forget about your frontline employees. These are the people who interact with your internal controls day in and day out. I always encourage organizations to use surveys and focus groups to collect feedback directly from the ground level.

Their firsthand experience with how internal controls are implemented can shine a light on issues you won’t find in reports. Plus, involving them in the review process builds a sense of ownership and accountability — a win-win for everyone.

Strengthen your internal controls with Resolver

When it comes to internal controls and ICFR, you need a solution that’s built for efficiency, compliance, and real-time insight. Resolver’s Internal Controls Management Software has been proven to boost audit efficiency by 30%, according to a recent Total Economic Impact (TEI) study conducted by Forrester Research. Whether you’re aiming to enhance ICFR confidence or simplify SOX compliance, our solution offers rapid implementation with measurable ROI, eliminating the lengthy setup other systems often require.

With Resolver, you can:

• Automate workflows to focus more on assurance, not documentation.
• Simplify testing by integrating working papers, review notes, and results all in one place.
• Align your efforts with a top-down, risk-based approach, ensuring that you’re always focusing on the controls that matter most.

Whether you’re aiming to boost ICFR confidence or simplify SOX compliance, Resolver’s solution offers rapid implementation and an immediate return on investment, delivering results without the months of setup other systems require.

Want to see how Resolver can transform your internal controls? Explore our Internal Controls Management Software and book a demo to learn more.

FAQ

Q1. What are the 5 main types of internal controls?

The five main types of internal controls include:

1. Preventive Controls: Stop errors or fraud before they happen (e.g., segregation of duties).
2. Detective Controls: Identify errors or fraud after they occur (e.g., reconciliations).
3. Corrective Controls: Address issues once detected (e.g., backups).
4. Directive Controls: Provide guidance on expected behavior (e.g., policies and procedures).
5. Compensating Controls: Alternative measures used when primary controls fail.

Q2. How often should you be reviewing internal controls?

You should be reviewing your internal controls at least annually, but more frequent reviews may be necessary when:

• There are changes in business operations.
• New risks emerge.
• Regulatory changes require updates.

Continuous monitoring using Resolver’s Internal Controls Management Software can help ensure real-time effectiveness.

Q3. How do auditors evaluate internal controls?

Auditors evaluate internal controls by:

• Reviewing internal controls design: Checking if controls are well-designed to manage risks.
• Operational testing: Ensuring that controls are functioning as expected through sample testing.
• Analyzing control deficiencies: Identifying gaps or failures and recommending improvements.

For more information on testing controls, check out our Audit Management Software.

Q4. What is ICFR audit testing?

ICFR (Internal Controls Over Financial Reporting) testing focuses on ensuring the accuracy of a company’s financial statements. This audit involves:

• Design effectiveness testing: Verifying whether controls are capable of preventing or detecting material misstatements.
• Operational effectiveness testing: Ensuring controls are operating as intended.

For more on ICFR compliance, watch our Mastering ICFR and SOX Compliance webinar.

Q5. What are common internal control deficiencies?

Common deficiencies in internal controls include:

• Inadequate segregation of duties.
• Poor documentation of control processes.
• Insufficient review of financial statements.
• Failure to follow up on control failures.

Find out how Resolver can help mitigate these risks with our Internal Controls Software.

Q6. What are the steps to reviewing internal controls?

The process for reviewing internal controls involves:

• Documenting current controls: Assess the controls already in place.
• Risk assessment: Identify risks that need to be managed.
• Control testing: Verify that controls are operating effectively.
• Analyze findings: Review results to identify gaps.
• Implement improvements: Adjust or add controls as needed.

This content was originally published on August 17, 2015, and updated for data and content relevancy.