Skip to content

Strategic Business Leader · Management and internal control systems

Internal Control Weaknesses and Recommendations in ACCA SBL

Updated 11 October 2026 · Fact-checked

An internal control weakness is a gap in how an organisation prevents, detects or corrects errors, fraud or non-compliance. In SBL, you find the gap in the scenario, explain the risk it creates, and recommend a practical, cost-effective control. Link each recommendation to the weakness it fixes.

Understand Internal Control Weaknesses and Recommendations

An internal control system is the set of policies, procedures and behaviours that helps an organisation achieve its objectives, protect assets, keep reliable records and comply with rules. A weakness appears when a control is missing, badly designed or not followed.

SBL scenarios rarely say "the control is weak". You must spot it from clues. A clerk both raises and approves payments. The same manager hires and pays suppliers. The board has no audit committee. Staff share passwords. A branch is far from head office and nobody checks it. Each clue points to a gap.

A good answer has three parts for each point: the weakness (what is wrong in this scenario), the consequence (what could go wrong for this business, such as fraud, misstatement, fines or reputational damage) and the recommendation (a specific fix that suits the company's size, cost and culture). Markers reward all three, tied to the facts.

Controls also have limits. Even a well-designed system cannot give absolute assurance. Common limitations include human error, collusion between staff, management override, controls that cost more than the loss they prevent, controls aimed at routine transactions rather than unusual ones, and controls that become outdated as the business changes. Mention these when asked about limitations or whether a system can be fully relied on.

The control environment matters most. If the board and senior managers show weak attitudes to controls, ethics or risk, procedures lower down will not work well. Many SBL weaknesses are really cultural or governance issues, not just missing procedures.

Key rules to remember

Answer structure for each point
Weakness + Consequence + Recommendation
Use this chain for every point. A weakness without a consequence or fix earns few marks.
Key control activities
Segregation of duties; authorisation; physical controls; reconciliations; supervision; documentation; IT access controls
Use as a checklist when choosing recommendations.
Control types
Preventive, detective, corrective
Say which type your recommendation is. Prefer preventive for high-risk areas.
Cost-benefit rule
Cost of control < Expected loss avoided
A recommendation should be proportionate. Small firms may use owner review instead of extra staff.
Limitations of control systems
Human error; collusion; management override; cost; unusual transactions; outdated controls
Use when asked why controls cannot give absolute assurance.

How to solve Internal Control Weaknesses and Recommendations questions

Use the same method for any question asking you to evaluate controls, identify weaknesses or advise on improvements.

  1. 1Read the requirement and note the verb and the audience: identify, explain, recommend, or evaluate; for a board, audit committee or client.
  2. 2Scan the scenario and mark clues about people, processes, systems, governance and culture. Look for missing checks, one person doing many tasks, rapid growth, new IT, remote sites and pressure on targets.
  3. 3List each weakness in a short phrase using facts from the scenario, not general theory.
  4. 4For each weakness, explain the consequence for this business: fraud, error, loss, misstatement, legal breach or reputation harm.
  5. 5Recommend a specific, practical control. State who does what, and how often. Match it to the company's size and resources.
  6. 6Consider cost, staff reaction and implementation. Mention any limitation or trade-off briefly.
  7. 7Prioritise: put the most serious weaknesses first, or say which should be fixed immediately.
  8. 8Write in the required format (report, briefing note or email) with clear headings, a short opening and a professional tone.

Quickest way: Weakness-Consequence-Fix table in your head

When to use it: Use when time is short and the scenario lists many control problems.

  1. Underline every clue in the scenario as you read, in the margin write W for each weakness.
  2. Jot a three-word note for each: weakness, risk, fix.
  3. Pick the five or six strongest points and order them by risk.
  4. Write one short paragraph per point in the order: weakness, consequence, fix.
  5. Finish with a one-line overall view, for example that the control environment needs board attention.

Common mistakes in Internal Control Weaknesses and Recommendations

  • Listing textbook controls without using the scenario.

    Students recall a control checklist and write it out to save time.

    Fix: Quote or refer to a specific fact in each point, such as the named role, system or location.

  • Stating the weakness but not the consequence.

    The weakness looks obvious, so students move on.

    Fix: Always add a sentence on what could go wrong for this company, such as fraud or misstated accounts.

  • Recommending impractical or costly controls.

    Students suggest ideal controls such as hiring extra staff regardless of the firm's size.

    Fix: Fit the fix to the business. For a small firm suggest owner review of reconciliations or rotating duties.

  • Ignoring the control environment and governance.

    Students focus on procedures and miss the tone at the top, board oversight and lack of internal audit.

    Fix: Check for culture, ethics, board and committee gaps. Recommend actions such as an audit committee or a whistleblowing channel.

  • Claiming a recommended control will remove the risk fully.

    Students want to sound confident.

    Fix: Say the control reduces the risk and note limitations such as collusion or management override.

  • Weak professional skills: no prioritisation or format.

    Students rush into a long list with no structure.

    Fix: Use headings, rank by importance, and write in the format and tone the requirement asks for.

Worked examples

Example 1

Kestrel Retail has 40 stores. Each store manager orders stock, receives deliveries, and approves supplier invoices for payment. Head office pays whatever the manager approves and does not review store inventory counts. Stock losses have risen. Identify two control weaknesses and recommend improvements.

Show the solution
  1. Weakness 1: one person orders, receives and approves invoices. This is a lack of segregation of duties.
  2. Consequence 1: a manager could order goods for personal use, approve false invoices or collude with a supplier. Losses would go unnoticed.
  3. Recommendation 1: separate the roles. Let a different employee receive goods and check them against the order. Head office should match order, delivery note and invoice before paying.
  4. Weakness 2: head office does not review inventory counts, so no independent check exists over stock.
  5. Consequence 2: theft, damage or errors stay hidden, which could explain the rising losses and misstate inventory in the accounts.
  6. Recommendation 2: carry out regular inventory counts by someone independent of the store, such as internal audit or a regional manager. Investigate differences and report results to head office.
  7. Note a limitation: collusion between staff could still defeat these controls, so use surprise checks.

Answer: Weakness 1 is no segregation of duties over ordering, receiving and approving, which risks fraud and false payments. Fix it with separate roles and a three-way match at head office. Weakness 2 is no independent inventory counts, which lets theft and error go undetected. Fix it with regular independent counts and follow-up of differences. Collusion remains a limitation.

Example 2

Lumina Software, a fast-growing company, has no internal audit function and no audit committee. The finance director is also the chief executive's brother. Expenses claims by senior staff are approved by the chief executive without receipts. You are a consultant advising the board. Explain the weaknesses and recommend improvements.

Show the solution
  1. Weakness 1: no audit committee or internal audit. Consequence: nobody independently reviews controls, so problems and fraud may not be found. Recommendation: form an audit committee of independent non-executives and consider outsourcing internal audit, given the company's size and cost concerns.
  2. Weakness 2: the finance director's family tie to the chief executive weakens independence and challenge. Consequence: management override is more likely and the board may lack confidence in the figures. Recommendation: add independent non-executive directors, and have the audit committee oversee the finance function and report to the board.
  3. Weakness 3: senior expenses are approved without receipts by the chief executive. Consequence: misuse of funds, poor example to staff and possible tax or reporting problems. Recommendation: require receipts for all claims, and have the audit committee chair or another independent person approve the chief executive's expenses.
  4. Prioritise: the governance gaps in points 1 and 2 are most serious because they affect every other control. Fix them first.
  5. Professional skills: present in a short report with headings, a clear opening and a balanced tone, and recognise that growth may cause resistance to extra controls.

Answer: The key weaknesses are no independent oversight, a lack of independence in the finance director role, and unchecked senior expenses. The consequences are undetected fraud, management override and misuse of funds. Recommend an audit committee with independent non-executives, an internal audit function, and receipts and independent approval for senior expenses. Tackle governance first.

Exam tips

  • Tie every weakness to a fact in the scenario. Generic points score poorly.
  • Write weakness, consequence and recommendation in that order so the marker can tick each part.
  • Check the control environment and governance as well as day-to-day procedures.
  • Keep recommendations practical and proportionate. Mention cost and limitations briefly.
  • Use the format and tone asked for, and rank points by importance to earn professional skills marks.

Practice questions from Management and internal control systems

Internal Control Weaknesses and Recommendations: frequently asked questions

How do I spot control weaknesses in an SBL scenario?

Look for one person doing several linked tasks, missing approvals or reviews, weak IT access, remote sites, pressure on targets and gaps in governance. Mark each clue as you read. Then turn each into a weakness, consequence and fix.

What are the limitations of internal control systems?

Controls can fail through human error, collusion and management override. They may not cover unusual transactions, they cost money, and they can become outdated as the business changes. So they give reasonable, not absolute, assurance.

How many recommendations should I give?

Match the number to the marks available. Usually it is better to give a few well-developed points than a long list of short ones. Each should include a weakness, a consequence and a specific fix.

Should I recommend internal audit in every answer?

No. Recommend it only when the scenario shows a need and the company can afford it. For a smaller business you might suggest outsourcing or using other checks, such as owner or board review.