Strategic Business Leader · Audit and compliance

Internal Control Systems and Reviewing Their Effectiveness

Q: What are the main components of an internal control system?

Using the COSO framework, they are the control environment, risk assessment, control activities, information and communication, and monitoring. In an SBL answer, use them as a checklist to make sure you cover culture and monitoring as well as procedures.

Q: How do I write control weaknesses and recommendations in SBL?

For each weakness, link it to a fact in the case, explain the risk and consequence, then give a specific recommendation and who should carry it out. Keep each point short and tailored to the organisation.

Q: Who reviews the effectiveness of internal controls?

Management monitors controls daily and the board is responsible for the system as a whole, usually with help from the audit committee. Internal audit tests controls and reports, and external auditors consider controls relevant to the financial statements.

Q: Do I need to learn COSO in detail for SBL?

You need to know its five components and be able to apply them to a scenario. Detailed memorisation of principles is less useful than showing you can use the framework to evaluate a case.

Updated 11 October 2026 · Fact-checked

An internal control system is the set of policies, procedures and behaviours that helps an organisation achieve its objectives, protect assets, keep reliable records and comply with rules. To review it, identify the objective and risk, assess whether each control is designed and operating well, then report weaknesses with practical recommendations.

Understand Internal Control Systems and Reviewing Their Effectiveness

An internal control system is everything management puts in place to make sure the organisation meets its objectives in an orderly way. It covers operations, reporting and compliance. It is not only about stopping fraud. It also supports efficiency, accurate information and safeguarding of assets.

Think of controls as the response to risk. A risk is something that could go wrong. A control reduces the likelihood or impact. If you cannot link a control to a risk, you cannot judge whether it is useful.

Most frameworks, including the COSO internal control framework, describe the same building blocks. These are the control environment (tone at the top, integrity, board oversight, structure, authority, competence), risk assessment, control activities (authorisation, segregation of duties, reconciliations, physical safeguards, IT controls), information and communication, and monitoring. The control environment is the foundation. Weak tone at the top can undermine even well-designed procedures, because senior people can override them.

Controls can be preventive (stop errors happening), detective (find errors after the event) or corrective (fix them). They can be manual or automated. Every control has limits: human error, collusion, management override, cost versus benefit, and change in circumstances.

Effectiveness is reviewed at several levels. Management monitors day to day and through self-assessment. The board, usually supported by the audit committee, reviews the system at least annually and reports on it in the annual report. Internal audit tests controls and reports findings. External auditors consider controls relevant to the financial statements and may report significant deficiencies to those charged with governance. In SBL, you are usually asked to spot weaknesses in a case, explain the risk, and recommend improvements.

Key rules to remember

Five components of internal control (COSO): Control environment + Risk assessment + Control activities + Information and communication + Monitoring; Use as a checklist to structure an evaluation of any case organisation.
Weakness analysis rule: Weakness → Risk it creates → Consequence for the organisation → Recommendation; Every point you make should follow this chain to earn application marks.
Control types: Preventive, detective, corrective; Say which type a recommendation is and why it fits the risk.
Key control activities: Authorisation, segregation of duties, reconciliation, physical security, supervision, IT access and general controls; Typical recommendations; always tailor them to the scenario.
Cost-benefit test: Cost of control < Expected loss reduced; A control is worth adding only if its cost is justified by the risk it reduces. Treat as a judgement, not an exact calculation.

How to solve Internal Control Systems and Reviewing Their Effectiveness questions

Use this method for any question asking you to evaluate, review or improve internal controls in an SBL case.

1Read the requirement and note whether you must identify weaknesses, recommend improvements, explain a review process, or advise the board.
2Scan the scenario for facts that signal weak control: one person doing several jobs, no approval, no review, dominant executives, poor IT access, no internal audit, ignored warnings.
3For each fact, state the weakness in the organisation's own context. Do not give a generic definition.
4Explain the risk and consequence: fraud, error, loss of assets, misstatement, regulatory breach or reputational damage.
5Give a specific, practical recommendation and say who should do it. Link it to the risk.
6Consider the control environment and culture, not just procedures. Mention board oversight, tone at the top and the role of the audit committee or internal audit where relevant.
7Note limits or cost: the control must be proportionate and cannot remove all risk.
8Close with a short, clear conclusion or priority, in the format asked for (report, memo, briefing), to earn professional skills marks.

Quickest way: Weakness-Risk-Fix table in your head

When to use it: When time is short and the question asks for weaknesses and recommendations.

Underline each control problem in the scenario as you read.
Jot a three-part line for each: weakness / risk / fix.
Pick the strongest points that match the marks available, roughly one point per mark.
Write each point in two or three sentences, using scenario names and facts.
Add one point on control environment or monitoring if you have not covered it.
Finish with a one-line priority recommendation.

Common mistakes in Internal Control Systems and Reviewing Their Effectiveness

Listing textbook controls without linking them to the scenario.
Students memorise lists and write them out to feel safe.
Fix: Start from a fact in the case, name the person or process, then recommend a control for that exact issue.
Stating a weakness but not explaining the risk or consequence.
It feels obvious that, for example, no segregation of duties is bad.
Fix: Always add why it matters here: who could misstate or steal, what the loss or impact would be.
Ignoring the control environment and culture.
Students focus on procedures such as reconciliations because they are easier to describe.
Fix: Check for tone at the top, dominant individuals, weak board oversight and no whistleblowing route, and cover them.
Recommending expensive or unrealistic controls.
Students assume more control is always better.
Fix: Make recommendations proportionate to the size and risk of the organisation and mention cost versus benefit.
Confusing the roles of management, internal audit, the audit committee and external auditors.
All of them are involved in review, so the roles blur.
Fix: Management owns and operates controls, the board is responsible for the system, internal audit tests and reports, and external auditors form their own opinion on the financial statements.
Claiming a control system can eliminate fraud or error.
Students overstate the benefit of controls.
Fix: State that controls give reasonable, not absolute, assurance because of override, collusion and human error.

Worked examples

Example 1

Delta Retail operates 40 stores. Each store manager orders stock, receives deliveries, approves supplier invoices and authorises the store's petty cash. Head office does not review store results. There is no internal audit function. Identify the control weaknesses and recommend improvements. (10 marks style)

Show the solution

Weakness 1: one manager handles ordering, receiving and invoice approval. Risk: fictitious or inflated orders, collusion with suppliers, theft of stock. Fix: separate ordering from receiving and invoice approval, for example by having a stock clerk record deliveries and head office or a second person approve payment.
Weakness 2: the manager authorises petty cash alone. Risk: misuse of cash that goes unnoticed. Fix: set limits, require receipts, and have someone independent count and reconcile petty cash regularly.
Weakness 3: head office does not review store results. Risk: losses, shrinkage and errors are not detected, and managers are not accountable. Fix: monitor stock levels, margins and shrinkage by store against budget and prior periods, and investigate unusual variances.
Weakness 4: no internal audit. Risk: no independent assurance that controls operate across 40 sites. Fix: establish an internal audit function or outsource it, with visits prioritised by risk, reporting to the audit committee.
Add a control environment point: management should set a clear code of conduct and a whistleblowing channel so that staff can report concerns.
Note cost: with 40 stores the risk justifies these controls, though smaller stores may need lighter versions.

Answer: Main weaknesses are lack of segregation of duties in purchasing, weak petty cash control, no head office monitoring and no internal audit. Recommend separating duties, reconciling and limiting petty cash, analysing store performance centrally, and setting up internal audit reporting to the audit committee.

Example 2

The board of Orion plc must report on the effectiveness of its internal control system in the annual report. Advise the board on how it should carry out its review. (8 marks style)

Show the solution

State the responsibility: the board is responsible for the system of internal control and for reviewing it at least annually. It may delegate detailed work to the audit committee but remains responsible.
Set the scope: the review should cover all material controls, including financial, operational, compliance and risk management controls, not just financial reporting.
Use evidence: reports from management, the risk register and risk management processes, internal audit findings, external auditor comments, incident and whistleblowing reports, and control self-assessments.
Assess against a framework such as COSO, checking each component: control environment, risk assessment, control activities, information and communication, monitoring.
Judge whether controls are well designed and operating as intended, and how quickly weaknesses are corrected. Consider whether the system responds to changes in the business and its risks.
Report: disclose that the review took place, the process used and any significant weaknesses and the action taken. Keep the statement honest, not boilerplate.
Note the limitation: the board can give reasonable assurance only, not absolute assurance.

Answer: The board should review the whole control system at least annually, using management and internal audit reports, risk information and a recognised framework such as COSO, assess design and operation, act on weaknesses, and report the process and significant findings in the annual report, recognising that assurance is reasonable, not absolute.

Exam tips

Mirror the case. Use names, numbers and roles from the scenario in every point, so your answer cannot be copied from a textbook.
Check the verb. Identify, evaluate, recommend and advise need different depth. Evaluate means judge how good the controls are, not just list them.
Always cover the control environment and board oversight in a governance-style question, because examiners often plant tone-at-the-top issues.
Keep the format asked for, such as a briefing note or report to the audit committee, and keep a professional, concise tone to earn professional skills marks.
Prioritise. When asked for the most important weakness, say which and why, using risk and impact.

Practice questions from Audit and compliance