Audit and Assurance · The use and evaluation of systems of internal control by auditors

Internal Control Systems and Components in Audit

Updated 11 October 2026 · Fact-checked

A system of internal control is the set of policies and procedures management sets up to run the business, safeguard assets, prevent and detect fraud and error, and produce reliable reporting. Its components are the control environment, risk assessment, information system, control activities and monitoring. It has inherent limitations, so it gives only reasonable assurance.

Understand Internal Control Systems and Components

An internal control system is everything management puts in place to help the entity achieve its objectives. It covers more than accounting checks. It includes culture, rules, people, processes and IT.

Control objectives are usually grouped as: orderly and efficient conduct of the business, safeguarding assets, prevention and detection of fraud and error, accuracy and completeness of accounting records, and timely, reliable financial information. Compliance with laws and policies is also part of this.

The auditor uses the framework of components to understand the system. The five components in this guide are:

Control environment: the attitude, awareness and actions of those charged with governance and management. It includes integrity, ethics, competence, the board's oversight, structure, authority and HR policies.
Risk assessment process: how management identifies business risks relevant to financial reporting, estimates their significance and likelihood, and decides how to respond.
Information system: the processes and records, including IT, that capture, process and report transactions, and the related communication.
Control activities: the policies and procedures that address risks, such as authorisation, segregation of duties, reconciliations, physical controls and performance reviews.
Monitoring of controls: ongoing or periodic assessment of whether controls work, for example by internal audit or management review, with deficiencies reported and fixed.

No system is perfect. Limitations include human error and poor judgement, collusion between people, management override, controls designed for routine rather than unusual transactions, cost exceeding benefit, and changes in conditions that make controls out of date. Small entities may also lack staff for segregation of duties. Because of these limits, controls give reasonable, not absolute, assurance. This is why auditors still perform substantive procedures.

Key rules to remember

Five components of internal control: Control environment + Risk assessment + Information system + Control activities + Monitoring; Use this as a checklist. Name each component and tie it to the scenario.
Control objectives: Efficiency + Safeguarding assets + Preventing and detecting fraud and error + Reliable records + Timely reliable information; Use these to say what a control is for.
Main limitations: Human error + Collusion + Management override + Cost versus benefit + Unusual transactions + Outdated controls; Controls give reasonable assurance only, never absolute.

How to solve Internal Control Systems and Components questions

Use this method for any question on internal control systems, whether it asks for definitions, components or limitations.

1Read the requirement and decide what is asked: define, list components, explain limitations, or apply to a scenario.
2If a scenario is given, underline facts about people, culture, IT, processes, size and ownership.
3Name the relevant component or control objective in bold or as a clear heading.
4Explain it in one sentence, then link it to a fact from the scenario.
5For limitations, pick those that fit the scenario, such as a small team (no segregation) or an owner-manager (override).
6State the consequence for the audit: reliance on controls is limited, so more substantive work is needed.
7Check the mark allocation and make that many separate, developed points.

Quickest way: Component and limitation checklist

When to use it: Use in Section A or B objective questions and when you are short of time in Section C.

Match the clue to a component: tone and ethics means control environment; identifying risks means risk assessment; recording transactions means information system; approvals and reconciliations mean control activities; reviews and internal audit mean monitoring.
For limitations, match the clue: two people working together means collusion; a director overruling means management override; a mistake means human error.
Eliminate options that describe a different component.
In written answers, use one line per point: component or limitation, explanation, scenario link.

Common mistakes in Internal Control Systems and Components

Treating internal control as only accounting procedures such as reconciliations.
Control activities are the most familiar part, so students forget the rest.
Fix: Remember all five components. Culture and oversight form the control environment.
Confusing control environment with control activities.
Both seem to describe rules and behaviour.
Fix: Control environment is the overall tone and governance. Control activities are specific procedures such as authorisation or reconciliations.
Saying controls eliminate fraud and error.
Students focus on the purpose and forget the limits.
Fix: Say controls give reasonable assurance. Name limitations such as collusion and management override.
Listing limitations without applying them to the scenario.
Students recall a list and write it out.
Fix: Link each limitation to a fact, such as a dominant owner-manager or a team of two in finance.
Confusing the auditor's understanding of controls with management's responsibility for them.
Both groups deal with controls.
Fix: Management designs and operates the system. The auditor obtains an understanding and assesses it for the audit.

Worked examples

Example 1

Section C style: A small company has a dominant owner-manager who also approves all payments. Two clerks do all accounting work. Explain the limitations of internal control that apply to this company. (4 marks)

Show the solution

Identify the facts: dominant owner-manager, two clerks, one person approves payments.
Limitation 1: management override. The owner-manager can ignore or bypass controls, and no one can challenge him.
Limitation 2: lack of segregation of duties. With two clerks, one person may handle several stages of a transaction, which raises the risk of undetected fraud or error.
Limitation 3: collusion. The two clerks, or a clerk and the owner, could work together to defeat controls.
Add the audit consequence: reliance on controls will be limited, so the auditor should do more substantive procedures.

Answer: Management override, lack of segregation of duties and collusion all weaken the system. The auditor should place little reliance on controls and increase substantive testing.

Example 2

Section B style: A company's board has a written code of conduct, and the finance director reviews staff competence yearly. Which component of internal control does this mainly illustrate? A Control activities B Control environment C Monitoring D Information system

Show the solution

A code of conduct and management attention to competence show the tone and ethics set by management.
These are features of the control environment.
Control activities are specific procedures such as approvals. Monitoring is assessment of control operation. Information system is about recording and reporting transactions.
So B is the best answer.

Answer: B. Control environment.

Exam tips

Name components using the standard terms. Markers look for them.
In scenarios, quote the fact that points to the component or limitation.
Always end limitation answers with the effect on the audit approach.
Do not confuse management's responsibility for controls with the auditor's work in understanding them.
For small entity scenarios, think first of segregation of duties and owner-manager override.

Internal Control Systems and Components in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Control Systems and Components: frequently asked questions

What are the components of internal control in ACCA AA?

They are the control environment, risk assessment process, information system, control activities and monitoring of controls. Use these headings when explaining a system. Link each to the scenario facts.

What are the limitations of internal control?

Main limitations are human error, collusion, management override, cost exceeding benefit, focus on routine transactions and controls becoming outdated. Because of them, controls give reasonable assurance only.

Does COSO use the same components as ACCA AA?

COSO uses a similar idea of control environment, risk assessment, control activities, information and communication, and monitoring. Answer using the terms in your ACCA study text and the question wording.

Why does the auditor need to understand internal control?

The auditor needs it to assess the risk of material misstatement and design further procedures. If controls look effective, the auditor may test and rely on them. If not, more substantive work is needed.