Internal control is the system of policies and procedures a business uses to give reasonable assurance that its transactions are authorized, recorded and reflected accurately, and that its assets are protected from unauthorized use. In US law the phrase has two binding definitions rather than one, and they were written for different purposes at different times, so a firm answering a question about internal control has to know which of them is being asked about.
Neither definition is a checklist of controls. Both are statements of the objectives a system has to meet, which is why two businesses can satisfy the same rule with entirely different procedures.
The Statutory Requirement Is Older Than Most People Think
The first definition is a federal statute, and it applies to every issuer with a registered class of securities or a reporting obligation, whether or not anyone is auditing its controls.
Every such issuer makes and keeps books, records and accounts which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer, and devises and maintains a system of internal accounting controls sufficient to provide reasonable assurances that four things are true (15 U.S.C. 78m(b)(2)(A) and (B)).
Those four objectives are worth reading as written, because they are the closest thing US law has to a definition of what controls are for. Transactions are executed in accordance with management’s general or specific authorization. Transactions are recorded as necessary to permit preparation of financial statements in conformity with generally accepted accounting principles or other applicable criteria, and to maintain accountability for assets. Access to assets is permitted only in accordance with management’s general or specific authorization. And the recorded accountability for assets is compared with the existing assets at reasonable intervals, with appropriate action taken on any differences (15 U.S.C. 78m(b)(2)(B)).
The fourth objective is the one preparers meet daily and rarely name. Comparing recorded accountability with the assets that actually exist is what a bank reconciliation, an inventory count and a fixed asset walk all are, and the statute requires the comparison AND appropriate action on the differences. Finding the variance and leaving it is not compliance.
What Reasonable Means, in the Statute’s Own Words
The word reasonable appears twice in that requirement and it is defined rather than left open. For that paragraph, the terms reasonable assurances and reasonable detail mean such level of detail and degree of assurance as would satisfy prudent officials in the conduct of their own affairs (15 U.S.C. 78m(b)(7)).
That is a cost-sensitive standard, not an absolute one. It sets the bar at what careful people would do about their own money, which is why a control that would cost more than the exposure it addresses is not required, and why no system is expected to make error impossible.
Two limits sit alongside it. No criminal liability attaches to failing to comply with the requirement except as provided in the following paragraph, and that paragraph provides that no person shall knowingly circumvent or knowingly fail to implement a system of internal accounting controls, or knowingly falsify any book, record or account (15 U.S.C. 78m(b)(4) and (5)). Weak controls are a civil matter; knowingly working around them is not.
The Narrower Definition an Issuer Reports On
The second definition is narrower, more recent, and the one behind every management report on internal control.
Internal control over financial reporting is a process designed by, or under the supervision of, the issuer’s principal executive and principal financial officers, and effected by the board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles (17 CFR 240.13a-15(f)).
It then names three categories of policies and procedures it includes. Those pertaining to the maintenance of records that in reasonable detail accurately and fairly reflect transactions and dispositions of assets. Those providing reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures are being made only in accordance with authorizations of management and directors. And those providing reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of assets that could have a material effect on the financial statements (17 CFR 240.13a-15(f)).
Where the Two Definitions Differ
Set them side by side and three differences matter in practice.
The rule’s version is tied to financial reporting. Its objective is the reliability of financial reporting and the preparation of external statements, so a control protecting operational efficiency or regulatory compliance without touching the numbers falls outside it while still being an internal control in the ordinary sense.
The rule’s version carries a materiality qualifier the statute does not. Its asset-protection limb reaches unauthorized acquisition, use or disposition that could have a material effect on the financial statements, while the statute’s asset limbs are written without that threshold.
And the rule’s version names who owns it. The process is designed by or under the supervision of the principal executive and principal financial officers, which is what makes it certifiable by named individuals rather than by the company as an abstraction.
Where the Pieces of a Control System Are Covered
The components a firm actually tests are worked through separately. The tone, structure and expectations a system rests on are in control environment. The most common single control weakness in a small client is in segregation of duties. What an auditor does to decide whether a control operated is in tests of controls, and the record that makes the testing possible at all is the audit trail.
Common Questions
A system of policies and procedures giving reasonable assurance about authorization, recording and asset protection. The statutory version requires reasonable assurance that transactions are authorized, that they are recorded so statements can be prepared and accountability for assets maintained, that access to assets is authorized, and that recorded accountability is periodically compared with the assets themselves (15 U.S.C. 78m(b)(2)(B)). Everything else is a means to one of those ends.
Neither of these two texts binds a business with no registered securities and no reporting obligation, because both are written about issuers. That settles the legal question and not the practical one: a lender, an insurer, a franchisor or an acquirer can require controls by contract, an auditor will evaluate them to plan an audit whatever the client’s size, and the same weaknesses that produce a restatement at a public company produce a loss at a private one. The prudent-officials standard in the statute is a useful bar to borrow even where it does not apply.
Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms, and a firm can put a block of its own reconciliation and control documentation work through a trial task before a client engagement depends on it.
