Strategic Business Leader · Internal control and management reporting

Control Environment, Procedures and Control Types in SBL

Updated 11 October 2026 · Fact-checked

The control environment is the culture, attitude and structure that set the tone for control. Control procedures are the specific actions that enforce it. Controls are preventive (stop errors), detective (find them), corrective (fix them) or directive (tell people what to do). In SBL, identify weaknesses and recommend controls matched to the scenario.

Understand Control Environment, Procedures and Control Types

Start with a simple idea. An organisation faces risks. Internal control is everything management puts in place to keep those risks within acceptable limits and help the business reach its objectives. It covers more than accounting. It includes operations, compliance and reporting.

The control environment is the foundation. It is the attitude, awareness and actions of the board and management on control. It includes the tone set by the top, the organisational structure, the way authority is given, the integrity and ethical values of people, the commitment to competence, HR policies, and the role of the board, audit committee and internal audit. If senior people ignore rules or pressure staff to hit targets at any cost, no procedure will work well. Weak environment, weak controls.

Control procedures are the specific policies and actions that operate within that environment. Examples are authorisation limits, segregation of duties, reconciliations, physical safeguards over assets, access passwords, approval of expenses, supervision and independent checks. They are the day-to-day mechanics.

Controls can also be grouped by purpose:

Directive controls cause or encourage a desired outcome. Examples: policies, procedure manuals, training, job descriptions, a code of conduct.
Preventive controls stop an error or fraud happening. Examples: authorisation before payment, segregation of duties, passwords, locked stores.
Detective controls find problems after they have happened. Examples: bank reconciliations, inventory counts, exception reports, internal audit reviews, variance analysis.
Corrective controls limit damage and put things right once a problem is found. Examples: backup restoration, disciplinary action, correcting entries, disaster recovery plans, system patches.

In SBL you rarely define these for their own sake. You are given a case with problems, and you must diagnose what is weak and recommend sensible, cost-effective controls. Always link each control to the specific risk in the scenario and to the cost of implementing it.

Key rules to remember

Control environment (definition): Control environment = tone at the top + structure + authority + integrity and ethics + competence + board oversight; This is a checklist, not a calculation. Use it to structure comments on culture and governance.
Four control types by purpose: Directive (guide) → Preventive (stop) → Detective (find) → Corrective (fix); Useful as a sequence. A good control system uses a mix, not just one type.
Cost-benefit test for a control: Implement a control if expected benefit (risk reduced) > cost of operating it; Benefits are often judgement-based. State the logic in words and avoid inventing figures.
Recommendation structure: Weakness → Risk it creates → Recommended control → Control type → Cost or limitation; Using this chain in every answer earns application and analysis marks.

How to solve Control Environment, Procedures and Control Types questions

Use this method for any SBL question asking you to assess controls or recommend improvements.

1Read the requirement and note the verb: assess, evaluate, recommend or explain. This sets the depth and the balance of your answer.
2Scan the scenario and highlight facts that suggest control weaknesses: one person doing several tasks, no approvals, weak oversight, pressure on staff, poor IT access, no checks on data.
3Comment on the control environment first if the scenario hints at culture, management attitude or board weakness. Controls cannot fix a poor tone at the top.
4For each weakness, state the specific risk it creates for this business, such as fraud, misstatement, loss of assets or non-compliance.
5Recommend a control that fits the weakness. Name its type (preventive, detective, corrective or directive) and say how it would work in this organisation.
6Add a short comment on cost, practicality or limitations, for example staff size, resistance, or the need for management buy-in.
7Prioritise. Start with the most serious weakness and make a short, clear conclusion or overall recommendation.
8Write in the professional style asked for, such as a memo or report, and keep points concise and tied to the case.

Quickest way: Weakness-Risk-Control (WRC) shortcut

When to use it: Use it when time is short and the requirement is to recommend improvements. It gives you a repeatable paragraph for each point.

Pick the three or four most serious weaknesses in the scenario. Do not list everything.
For each, write one sentence on the weakness using case facts.
Write one sentence on the risk it creates.
Write one or two sentences on the control you recommend and label its type.
Finish with a one-line note on cost or practicality.
If the scenario signals culture problems, open with a short paragraph on the control environment.

Common mistakes in Control Environment, Procedures and Control Types

Giving a generic list of controls with no link to the scenario.
Students memorise textbook lists and write them out under pressure.
Fix: Quote a case fact in every point and explain why the control suits this business.
Ignoring the control environment and jumping straight to procedures.
Procedures are concrete and easy to name, while culture feels vague.
Fix: Ask whether the scenario shows poor tone at the top, weak oversight or pressure. If so, address it first.
Confusing preventive and detective controls.
Students treat any check as preventive, even if it happens after the transaction.
Fix: Ask when the control acts. Before the event is preventive. After the event is detective.
Forgetting directive and corrective controls.
Most examples taught are preventive or detective.
Fix: Consider policies, training and codes (directive), and recovery plans and disciplinary action (corrective) for a balanced answer.
Recommending expensive controls without considering cost or size of the business.
Students focus on ideal controls rather than practical ones.
Fix: Add a cost-benefit comment and suggest proportionate alternatives, such as management review in a small firm.
Writing only about internal controls and missing professional skills marks.
Students treat the answer as a technical list.
Fix: Show scepticism, commercial awareness and clear communication. Prioritise, justify and use the requested format.

Worked examples

Example 1

Kavya Textiles is a family-owned manufacturer. The finance manager raises purchase orders, approves supplier invoices, and releases payments online. The owner rarely reviews bank statements and says, 'We trust our people.' Recommend control improvements, naming the type of each control.

Show the solution

Identify the weaknesses: one person controls the whole purchasing and payment cycle, and the owner shows a relaxed attitude with little oversight.
Control environment: the owner's trust-based attitude sets a weak tone. Recommend that the owner actively sets expectations, requires periodic review and supports a written code of conduct. This is directive.
Segregation of duties: split ordering, invoice approval and payment release between different people. This is preventive, because it stops one person committing and hiding fraud.
Authorisation: require a second approver for online payments above a set limit. This is preventive.
Independent review: the owner or an independent person should review bank reconciliations and supplier statements monthly. This is detective because it finds errors or fraud after they occur.
Corrective: set out what happens when irregularities are found, such as investigation, disciplinary action and recovery of losses.
Cost and practicality: the business is small, so full separation may be difficult. Where staff numbers limit this, increase owner supervision and use bank approval workflows, which cost little.

Answer: Kavya Textiles should improve its control environment through active owner oversight and a code of conduct (directive), separate ordering, approval and payment duties and add second authorisation (preventive), introduce monthly independent bank and supplier reconciliations (detective), and define a response to irregularities (corrective). Because the firm is small, use owner supervision and bank approval features where full segregation is impractical.

Example 2

Explain the difference between a control environment and control procedures, and classify the following controls at Orion Retail as preventive, detective, corrective or directive: (a) a staff manual on refund policy; (b) cashiers cannot process refunds above a limit without a supervisor's PIN; (c) weekly comparison of refunds by store to the average; (d) reversing fraudulent refunds and retraining the staff involved.

Show the solution

Define the control environment: the overall culture, attitude, structure and ethical values set by the board and management that shape how seriously controls are taken.
Define control procedures: the specific policies and actions that operate inside that environment, such as authorisation limits and reconciliations.
Explain the link: procedures depend on the environment. If management ignores rules, procedures will be bypassed.
(a) The refund policy manual tells staff what to do. This is directive.
(b) The supervisor PIN stops large refunds without approval. This is preventive.
(c) Weekly comparison of refunds by store finds unusual patterns after they happen. This is detective.
(d) Reversing fraudulent refunds and retraining staff fixes damage and reduces recurrence. This is corrective.

Answer: The control environment is the culture and tone that shape attitudes to control, while control procedures are the specific actions that enforce it. At Orion Retail: (a) directive, (b) preventive, (c) detective, (d) corrective.

Exam tips

Treat the control environment as a separate point whenever the scenario mentions culture, pressure, management attitude or weak oversight.
Label each recommended control by type. It shows technical knowledge and helps structure the answer.
Tie every recommendation to a named fact in the case, and always say what risk it addresses.
Mention cost, proportionality and limitations such as management override and collusion, to show commercial acumen.
Match the format asked for, such as a briefing note, and keep points prioritised rather than exhaustive.

Practice questions from Internal control and management reporting

Control Environment, Procedures and Control Types in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Control Environment, Procedures and Control Types: frequently asked questions

What is the difference between the control environment and control procedures?

The control environment is the overall culture, tone and structure that influence how people view control. Control procedures are the specific actions, such as approvals and reconciliations, that carry out control day to day. A strong environment supports procedures, and a weak one undermines them.

What are the four types of internal control?

Directive controls guide behaviour through policies and training. Preventive controls stop problems occurring, detective controls find them after they occur, and corrective controls limit damage and restore the position. A sound system uses a mix of all four.

How do I recommend control improvements in the SBL exam?

Identify weaknesses from the scenario, explain the risk each creates, then recommend a specific control and name its type. Add a short comment on cost or practicality. Prioritise the most serious points and use the format requested.

Is a bank reconciliation preventive or detective?

It is normally detective, because it identifies errors or unauthorised items after transactions have taken place. It can have a deterrent effect, but its main purpose is to find differences.