Business Laws and Ethics · Internal Financial Control for Financial Reporting

Types of Controls and Reporting Risks in ICFR

Updated 10 October 2026 · Fact-checked

Internal financial controls over financial reporting are classified by purpose (preventive or detective), by method (manual or automated) and by level (entity-level or process-level). Risk assessment identifies where financial statements could be materially misstated, then matches each risk with a control that stops or finds the error.

Understand Types of Controls and Reporting Risks

A control is any policy or procedure that reduces the chance of an error or fraud in the financial statements. Internal financial controls over financial reporting (ICFR) are the controls that help a company produce reliable accounts, safeguard assets and prevent or detect misstatements.

Controls are grouped in three ways. By purpose: preventive controls stop an error before it happens (approval before payment, password access, segregation of duties). Detective controls find an error after it has happened (bank reconciliation, exception reports, physical stock count). A good system uses both, because no preventive control is perfect.

By method: manual controls depend on a person (a manager reviews and signs a journal). Automated controls are built into the system (the software blocks a payment above the limit, or matches purchase order, goods receipt and invoice). Automated controls are consistent and fast, but they are only as good as their configuration and IT general controls. Manual controls are flexible, but prone to human error and override.

By level: entity-level controls work across the whole company and set the tone: the control environment, code of conduct, board and audit committee oversight, whistle-blower policy, risk assessment process, and company-wide IT policies. Process-level controls (also called transaction-level or activity-level) operate inside a specific process such as procure-to-pay, order-to-cash or payroll. Weak entity-level controls raise the risk everywhere, even if process controls look fine.

Risk assessment comes first. The company asks: which accounts, disclosures and assertions (existence, completeness, accuracy, valuation, cut-off, presentation) could contain a risk of material misstatement due to error or fraud? Risks are rated by likelihood and size. Higher risks, such as revenue recognition, estimates, related party deals and management override, need stronger controls and closer testing.

Key rules to remember

Preventive control: Control acts BEFORE the transaction is completed; Examples: authorisation limits, segregation of duties, access passwords, system validation.
Detective control: Control acts AFTER the transaction to find errors; Examples: bank reconciliation, variance review, stock count, exception reports.
Entity-level vs process-level: Entity-level = company-wide tone and oversight; Process-level = specific transaction cycle; Entity-level controls often work indirectly; process-level controls work directly on transactions.
Risk of material misstatement: Risk of material misstatement = Inherent risk + Control risk (combined assessment); This is a conceptual combination, not an arithmetic sum. Inherent risk is susceptibility before controls; control risk is the chance controls fail to prevent or detect it.
Manual vs automated: Manual = person-dependent; Automated = system-embedded; Automated controls depend on IT general controls such as access and change management.

How to solve Types of Controls and Reporting Risks questions

Use this order for any question on control types or reporting risks.

1Read the scenario and underline the control or risk described.
2Ask: does it act before the error (preventive) or after it (detective)?
3Ask: is it done by a person (manual) or built into the system (automated)?
4Ask: does it apply company-wide (entity-level) or to one process (process-level)?
5Identify the financial statement area and the assertion at risk, such as existence or completeness.
6State the risk of material misstatement, and whether it arises from error or fraud.
7Suggest or evaluate the control and any gap, such as no detective back-up or weak IT controls.
8Close with a one-line conclusion on whether the control addresses the risk.

Quickest way: Three-label shortcut

When to use it: For MCQs and short-note questions with limited time.

Label the control with three tags: timing (preventive or detective), method (manual or automated), level (entity or process).
Use keywords: approve, authorise, block, restrict mean preventive; reconcile, review, count, report mean detective.
Words like code of conduct, board, audit committee, tone at the top mean entity-level.
Match the risk to the assertion in one phrase, then name one control.

Common mistakes in Types of Controls and Reporting Risks

Calling a bank reconciliation a preventive control.
It feels like a safeguard, so students assume it stops errors.
Fix: It happens after transactions are recorded and finds differences, so it is detective.
Assuming automated means preventive and manual means detective.
Students mix the method axis with the timing axis.
Fix: Classify separately. An automated report of exceptions is detective; a manager's approval is a manual preventive control.
Treating entity-level controls as weak because they are not tied to transactions.
They look general and non-technical.
Fix: State that they set the control environment and affect every process; weakness here raises risk across the company.
Listing risks without linking them to financial statement assertions.
Students describe business risks in general terms.
Fix: Tie each risk to an account and an assertion, such as overstated revenue affecting occurrence and cut-off.
Ignoring management override and fraud risk.
Students focus only on clerical errors.
Fix: Always mention that management can override controls, and that fraud risk needs separate consideration.

Worked examples

Example 1

Classify each control as preventive or detective, and as manual or automated: (a) the ERP system does not allow a vendor payment above ₹5,00,000 without a second approver; (b) the accountant prepares a monthly bank reconciliation and the finance manager reviews it.

Show the solution

(a) The system blocks the payment before it is made, so the control is preventive.
(a) It is built into the ERP, so it is automated.
(b) The reconciliation is performed after transactions are recorded, to find differences, so it is detective.
(b) It is done and reviewed by people, so it is manual.

Answer: (a) Preventive and automated. (b) Detective and manual.

Example 2

A company has a strong code of conduct, an active audit committee and a whistle-blower policy, but its revenue process allows sales staff to record invoices without delivery proof. Explain the type of controls involved and the reporting risk.

Show the solution

The code of conduct, audit committee and whistle-blower policy operate across the company, so they are entity-level controls.
Invoice recording is part of the order-to-cash cycle, so the gap is a process-level control weakness.
Recording sales without delivery proof creates a risk of material misstatement in revenue: overstated sales through fictitious or premature recording, affecting occurrence and cut-off.
Strong entity-level controls help but do not replace process controls; they do not directly stop a wrong invoice.
Suggested fix: a preventive control requiring a system match of invoice to delivery note before posting, plus a detective review of sales near period end.

Answer: Entity-level controls are adequate, but a process-level gap in order-to-cash creates a revenue misstatement risk. Add a preventive delivery-match control and a detective cut-off review.

Exam tips

Practise classifying one control on all three axes; MCQs often test one axis while distractors use another.
In written answers, give one real example with every type you define; examiners reward examples.
When asked about risk assessment, mention both error and fraud, and name the assertion affected.
Link the topic to the directors' and auditors' responsibilities for IFC under the Companies Act, 2013, but do not quote section numbers unless you are sure.

Practice questions from Internal Financial Control for Financial Reporting

Types of Controls and Reporting Risks in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Types of Controls and Reporting Risks: frequently asked questions

What is the difference between preventive and detective controls?

Preventive controls stop errors or fraud before they occur, such as approval limits and access restrictions. Detective controls find errors after they occur, such as reconciliations and exception reports. A sound system uses both.

What is the difference between entity-level and process-level controls?

Entity-level controls apply across the whole company and shape the control environment, such as governance, ethics codes and risk assessment. Process-level controls operate within a specific transaction cycle such as payroll or purchases.

Are automated controls always better than manual controls?

No. Automated controls are consistent and fast, but they rely on correct configuration and IT general controls. Manual controls handle judgement and unusual cases but are open to human error and override.

How are risks of material misstatement assessed?

The company identifies accounts and assertions that could be wrong due to error or fraud, rates them by likelihood and size, and then designs or tests controls in proportion. Higher risks, such as estimates and revenue, get stronger controls.