How can you design an effective internal control system?

1 Define your objectives and risks

The first step to design an internal control system is to identify and prioritize your objectives and risks. Objectives are the goals and expectations that you have for your financial reporting, operations, and compliance. Risks are the potential events or situations that could prevent you from achieving your objectives or cause errors or fraud. You should consider both internal and external factors that could affect your performance and accountability, such as regulations, industry standards, market conditions, organizational structure, culture, and resources.

2 Establish your control environment

The second step to design an internal control system is to establish your control environment, which is the foundation and tone of your internal control system. The control environment reflects the values, ethics, and attitudes of your management and staff towards internal control and its importance. You should ensure that you have a clear and consistent communication of your objectives, policies, and procedures, as well as a strong commitment to integrity, competence, and accountability. You should also assign roles and responsibilities for internal control activities, and provide adequate training and supervision.

3 Select and implement your control activities

The third step to design an internal control system is to select and implement your control activities, which are the specific actions and measures that you take to prevent or detect risks and ensure the achievement of your objectives. Control activities can be preventive or detective, manual or automated, and include various types such as authorization, verification, reconciliation, segregation of duties, physical security, and information technology controls. You should choose the appropriate type and level of control activities based on your risk assessment and cost-benefit analysis.

4 Monitor and evaluate your control system

The fourth step to design an internal control system is to monitor and evaluate your control system, which is the process of reviewing and testing the effectiveness and efficiency of your internal control system on a regular basis. Monitoring and evaluation can be done through ongoing activities, such as feedback, reports, audits, and inspections, or through separate evaluations, such as self-assessments, surveys, and external reviews. You should use both qualitative and quantitative indicators to measure your performance and compliance, and identify any gaps or weaknesses in your internal control system.

5 Report and communicate your results and issues

The fifth step to design an internal control system is to report and communicate your results and issues, which is the process of sharing and discussing your internal control system's achievements, challenges, and recommendations with your relevant stakeholders. Reporting and communication can be done through formal or informal channels, such as financial statements, memos, meetings, and newsletters. You should ensure that you have a timely, accurate, and transparent disclosure of your internal control system's status and outcomes, and that you solicit and address any feedback or concerns from your stakeholders.

6 Update and improve your control system

The final step to design an internal control system is to update and improve your control system, which is the process of making changes and enhancements to your internal control system based on your monitoring and evaluation results and feedback. Updating and improving your control system can involve modifying or adding objectives, risks, control activities, or policies and procedures, as well as implementing corrective actions or preventive measures. You should ensure that you have a continuous improvement cycle for your internal control system, and that you document and communicate any changes or improvements to your stakeholders.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?