Cost and Management Audit · Internal Control and Internal Audit

Internal Control: Meaning, Objectives, Limitations and Components

Updated 11 October 2026 · Fact-checked

Internal control is the process designed and run by management and those charged with governance to give reasonable assurance on reliable reporting, effective operations and legal compliance. It has five components: control environment, risk assessment, information system and communication, control activities, and monitoring. Always state objectives, components and limitations together.

Understand Internal Control: Concepts, Objectives and Components

Internal control is a set of policies and procedures that an entity builds to protect its assets, keep its records reliable and make sure people follow management's directions. It is not one department or one report. It runs through the whole business, from the board room to the stores gate.

The usual objectives are three: reliable financial and cost reporting, effective and efficient operations, and compliance with laws and regulations. Safeguarding assets and preventing or detecting fraud and error sit inside these. Controls give reasonable assurance, never absolute assurance.

The framework you must know has five components. Your Standard on Auditing text (SA 315) lists them as: (a) the control environment; (b) the entity's risk assessment process; (c) the information system, including related business processes relevant to financial reporting, and communication; (d) control activities; and (e) monitoring of controls. The same standard says the division is a useful framework for the auditor. It does not necessarily reflect how an entity designs or classifies its own controls, and other terminology or frameworks may be used if all the components are addressed. The widely taught COSO framework uses similar five components, usually named control environment, risk assessment, control activities, information and communication, and monitoring activities.

The control environment is the foundation. SA 315 (A76) lists its elements: communication and enforcement of integrity and ethical values; commitment to competence; participation by those charged with governance; management's philosophy and operating style; organisational structure; assignment of authority and responsibility; and human resource policies and practices.

Controls have inherent limitations. Human judgement can be faulty, people make mistakes, two or more people can collude, and management can override controls. Cost-benefit also matters: a control should not cost more than the risk it addresses. Controls aimed at routine transactions may not catch unusual ones. Never claim that strong controls eliminate fraud.

Key rules to remember

Five components of internal control (SA 315, A57): Control environment + Risk assessment process + Information system and communication + Control activities + Monitoring of controls; Learn the order. Control environment is the base and sets the tone for the rest.
Objectives of internal control: Reliable reporting + Effective and efficient operations + Compliance with laws and regulations; Safeguarding of assets supports all three. Say 'reasonable assurance', not 'absolute assurance'.
Control activities (SA 315, A95): Authorisation, performance reviews, information processing, physical controls, segregation of duties; These are the examples the standard gives. Control activities are the policies and procedures that help ensure management directives are carried out.
Monitoring (SA 315, A105): Monitoring = ongoing activities + separate evaluations (or a combination); It assesses the effectiveness of controls over time and includes taking remedial action.
Inherent limitations: Human error + Collusion + Management override + Cost-benefit constraint + Judgement errors; Use these as headings, then give a short example under each.

How to solve Internal Control: Concepts, Objectives and Components questions

Use this method for any descriptive or case question on internal control concepts.

1Read the question and mark the verb: define, explain, list, evaluate or identify the weakness.
2Open with a one-line definition of internal control and the three objectives.
3Name the five components in the SA 315 order and give a one-line meaning for each.
4Link each point to the facts in the case. Say which component the fact belongs to, for example a missing approval limit is a control activity gap.
5State the effect: how the gap raises the risk of misstatement, loss or non-compliance.
6Add the limitations if the question asks for evaluation, and close with a clear recommendation or conclusion.

Quickest way: Component-tagging method

When to use it: Use this for MCQs and case scenario questions where you must match a fact to a component.

Underline the control mentioned in the scenario.
Ask: is it culture or tone (control environment), spotting risks (risk assessment), recording and reporting (information), a specific check (control activity) or a review over time (monitoring)?
Match the keywords: integrity, competence, HR policy means environment; approvals, reconciliations, segregation of duties means activities; customer complaints or periodic reviews means monitoring.
Eliminate options that claim absolute assurance or that say controls cannot be overridden.

Common mistakes in Internal Control: Concepts, Objectives and Components

Saying internal control gives absolute assurance or eliminates fraud.
Students focus on the benefits and forget inherent limitations.
Fix: Always write 'reasonable assurance' and add one line on collusion and management override.
Mixing control activities with the control environment.
Both sound like 'rules and policies'.
Fix: Environment is tone, ethics, structure and HR practice. Activities are specific procedures such as authorisation, reviews and segregation of duties.
Treating monitoring as the same as internal audit only.
Internal audit is the most visible monitoring tool.
Fix: Monitoring includes ongoing supervisory activities and separate evaluations. External inputs such as customer complaints and regulator comments can also point to problems (SA 315, A106).
Listing the five components without applying them to the case.
Students learn lists by rote.
Fix: After each component, add one sentence tying it to a fact in the scenario and its effect on misstatement risk.
Forgetting that the SA 315 five-component division is a framework, not a mandatory structure for the entity.
The wording sounds like a compulsory classification.
Fix: Remember the standard allows different terminology if all components are addressed.

Worked examples

Example 1

Explain the five components of internal control and state two limitations that prevent it from giving absolute assurance. (7 marks)

Show the solution

Define: internal control is the process by which management seeks reasonable assurance on reliable reporting, effective operations and compliance.
Control environment: integrity and ethical values, commitment to competence, governance participation, management philosophy, organisational structure, authority and responsibility, and HR policies.
Risk assessment process: how management identifies and responds to risks that could affect objectives; an appropriate process helps the auditor identify risks of material misstatement.
Information system and communication: the processes that capture, record and report transactions, and how responsibilities are communicated.
Control activities: policies and procedures such as authorisation, performance reviews, information processing, physical controls and segregation of duties.
Monitoring: assessing control performance over time through ongoing activities, separate evaluations, or both, with remedial action.
Limitations: collusion between employees can defeat segregation of duties; management override can bypass controls entirely. Human error and cost-benefit limits also apply.

Answer: Internal control has five components: control environment, risk assessment, information system and communication, control activities and monitoring. It gives only reasonable assurance because of limitations such as collusion and management override.

Example 2

Shreeji Castings Ltd has no written delegation of authority. The same accounts officer raises purchase orders, receives goods and approves supplier payments. The audit committee meets once a year. Identify the weaknesses by component and recommend improvements.

Show the solution

No written delegation of authority points to the control environment: assignment of authority and responsibility is weak.
One officer raising orders, receiving goods and approving payments is a failure of segregation of duties, which is a control activity.
An audit committee meeting only once a year means weak participation by those charged with governance and weak monitoring of controls.
Effect: a high risk of unauthorised purchases, payment for goods not received and undetected fraud or error.
Recommendation: issue a written delegation of authority with approval limits; separate ordering, receiving and payment approval among different people; hold audit committee meetings more often and have it review control gaps.

Answer: The weaknesses are in the control environment (authority not assigned), control activities (no segregation of duties) and monitoring (infrequent oversight). Fix them with a delegation policy, separated duties and regular audit committee review.

Exam tips

In Section A, watch for options that say 'absolute', 'eliminates' or 'guarantees'. These are usually wrong.
For case MCQs, tag each fact to one of the five components before choosing an option.
In written answers, define first, list components in the SA 315 order, then apply to the case and recommend.
Learn the SA 315 examples: seven elements of the control environment and five examples of control activities.
Link to the Companies Act: the audit committee evaluates internal financial controls and risk management systems under section 177(4)(vii).

Practice questions from Internal Control and Internal Audit

Internal Control: Concepts, Objectives and Components in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Control: Concepts, Objectives and Components: frequently asked questions

What are the five components of internal control?

They are the control environment, the entity's risk assessment process, the information system and communication, control activities, and monitoring of controls. SA 315 uses this framework, and COSO has a similar five-part structure.

What are the main objectives of internal control?

The main objectives are reliable financial and cost reporting, effective and efficient operations, and compliance with laws and regulations. Safeguarding assets supports all of them.

Why can internal control not give absolute assurance?

Controls have inherent limitations. People make errors, can collude, and management can override controls. Controls must also be cost-effective, so not every risk is covered.

What is the difference between control environment and control activities?

The control environment is the overall tone, ethics, structure and HR practice of the entity. Control activities are the specific procedures, such as authorisation, reviews and segregation of duties, that carry out management directives.