Corporate Accounting and Auditing · Report on Internal Financial Control over Financial Reporting

Components and Essential Elements of Internal Financial Control

Updated 10 October 2026 · Fact-checked

Internal financial control rests on five COSO components: control environment, risk assessment, control activities, information and communication, and monitoring. They work at entity level (tone, policies) and process level (specific transactions). To answer, name the component, tie it to the risk, and say how you test design and operating effectiveness.

Understand Components and Essential Elements of Internal Financial Control

An internal financial control (IFC) is a set of policies and procedures a company uses to run its business in an orderly way, safeguard assets, prevent and detect fraud and error, keep accurate records, and prepare reliable financial information on time. The auditor reports on whether the company has adequate IFC over financial reporting and whether they worked effectively.

The widely used COSO framework breaks internal control into five components. The control environment is the foundation: integrity, ethics, board and audit committee oversight, management's philosophy, organisation structure, authority and responsibility, and HR policies. Risk assessment is how the company identifies and analyses risks to its financial reporting objectives, including fraud risk and the effect of changes. Control activities are the actions that address those risks: approvals, reconciliations, segregation of duties, access controls, physical checks. Information and communication means relevant, quality information is captured and shared inside and outside the company. Monitoring means ongoing and separate evaluations, such as internal audit, to confirm controls still work and deficiencies are fixed.

Think of it as a house. The control environment is the foundation, risk assessment is the survey of what could go wrong, control activities are the locks and walls, information and communication is the wiring, and monitoring is the regular inspection.

Controls also differ by level. Entity-level controls operate across the whole company: code of conduct, whistle-blower policy, board oversight, risk management process, IT general controls, period-end reporting process. They set the tone and usually act indirectly. Process-level controls (transaction-level) operate within a specific process such as procure-to-pay, order-to-cash or payroll: three-way match of PO, GRN and invoice, credit limit checks, bank reconciliation. They act directly on individual transactions.

The auditor documents these in a Risk Control Matrix (RCM): for each process, the risk, the control that addresses it, control objective, type (preventive or detective; manual, automated or IT-dependent), frequency, and owner. Then the auditor tests design effectiveness (is the control capable of preventing or detecting the risk if it works as intended?) and operating effectiveness (did it actually work consistently through the period, and by a competent person?).

Key rules to remember

Five COSO components: Control environment + Risk assessment + Control activities + Information & communication + Monitoring; Write all five in order; the control environment is the base and sets the tone.
Entity-level vs process-level: Entity-level = company-wide, often indirect | Process-level = specific process, direct on transactions; Strong entity-level controls do not replace testing process-level controls for significant risks.
Control effectiveness test: Effective IFC = Adequate design AND Operating effectiveness; A well-designed control that is not followed fails; a control followed but badly designed also fails.
RCM columns: Process → Risk → Control objective → Control → Type → Frequency → Owner → Test result; Use this layout to earn presentation marks.
Control classification: Preventive vs Detective | Manual vs Automated vs IT-dependent; Automated controls can often be tested with a small number of instances (often one) if effective IT general controls show the program has not changed during the period.

How to solve Components and Essential Elements of Internal Financial Control questions

Use this method for scenario, short-note and matching questions on IFC components and testing.

1Read the scenario and underline the control, weakness or event described.
2Match it to one of the five COSO components and name it explicitly.
3Decide the level: entity-level (company-wide, tone, policies) or process-level (specific transaction flow).
4State the risk the control addresses and whether it is preventive or detective, manual or automated.
5Say how you would test it: design (walkthrough, inquiry, inspection of the policy) and operating effectiveness (sample testing, re-performance, observation over the period).
6Conclude: is the control adequate and effective, and what is the deficiency or recommendation if not?

Quickest way: Component-Level-Test trick

When to use it: For 2-mark MCQs and quick classification questions.

Tone, ethics, board, structure, HR = control environment.
Identifying and analysing what could go wrong = risk assessment.
Approvals, reconciliations, segregation, access = control activities.
Reports, data flow, whistle-blower channels = information and communication.
Internal audit, reviews, follow-up of deficiencies = monitoring.
Company-wide = entity level; one transaction cycle = process level.
Checking if control is capable = design; checking it worked all year = operating.

Common mistakes in Components and Essential Elements of Internal Financial Control

Putting a bank reconciliation under control environment.
Students match the word 'control' without thinking about what the activity does.
Fix: Reconciliations, approvals and segregation of duties are control activities. Control environment is about tone and structure.
Confusing design effectiveness with operating effectiveness.
Both sound like 'does it work'.
Fix: Design asks if the control could stop the risk on paper. Operating asks if it actually ran correctly and consistently during the period.
Treating monitoring as the same as control activities.
Both involve reviews.
Fix: Control activities are part of the process. Monitoring evaluates whether the whole control system still works, for example through internal audit.
Assuming entity-level controls alone are enough evidence.
They look broad and impressive.
Fix: They are often indirect. For significant risks, also test process-level controls.
Listing the components without linking to the case.
Students recall theory and skip application.
Fix: Quote the fact from the scenario against each component you name.
Testing operating effectiveness without first confirming design.
Students jump to sampling.
Fix: If the design is inadequate, the control cannot be relied on, so there is no point testing operating effectiveness for reliance; evaluate the design deficiency instead.

Worked examples

Example 1

A company's board has an active audit committee, a published code of conduct and a whistle-blower hotline. Purchase invoices above ₹5,00,000 need CFO approval. Internal audit reviews purchases quarterly. Classify each feature under COSO components and level.

Show the solution

Audit committee and code of conduct: control environment, entity level.
Whistle-blower hotline: information and communication (a channel to report concerns), entity level.
CFO approval above ₹5,00,000: control activity, process level (procure-to-pay), preventive.
Quarterly internal audit review: monitoring, detective, covers the process after the event.

Answer: Audit committee and code: control environment (entity). Hotline: information and communication (entity). CFO approval: control activity (process, preventive). Internal audit review: monitoring (detective).

Example 2

An RCM states: Risk - payments made to fictitious vendors. Control - vendor master changes need approval by a manager independent of the accounts payable team, reviewed monthly. The auditor inspects the policy, performs a walkthrough, then selects 2-5 monthly approvals across the year. Explain what each step tests.

Show the solution

Identify risk and control: the risk is fictitious vendor payments; the control prevents unauthorised master changes through segregation of duties (control activity).
Inspecting the policy and walkthrough: tests design effectiveness, showing the control is capable of addressing the risk and is implemented.
Selecting a sample of approvals across the year: tests operating effectiveness, showing it was performed consistently by the right person.
Decide the outcome: if the sample shows approvals missing or by the AP team, the control did not operate effectively and the auditor assesses a deficiency and its severity.

Answer: Policy inspection and walkthrough test design; sampling approvals through the year tests operating effectiveness. Exceptions in the sample indicate a deficiency to be evaluated.

Exam tips

Always name the five components in the COSO order and add one example for each; this is the easy full-marks answer.
For scenario questions, quote the fact and then label it with component and level.
Draw a small RCM table in the answer sheet with risk, control, type and test; it shows structure and earns marks.
In MCQs, check whether the question asks about design or operating effectiveness before choosing.
Remember that management's own evaluation is not enough; the auditor performs independent tests.

Practice questions from Report on Internal Financial Control over Financial Reporting

Components and Essential Elements of Internal Financial Control in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Components and Essential Elements of Internal Financial Control: frequently asked questions

What are the five COSO components of internal control?

They are control environment, risk assessment, control activities, information and communication, and monitoring. The control environment forms the base for the rest.

What is the difference between entity-level and process-level controls?

Entity-level controls apply across the whole company, such as the code of conduct and board oversight. Process-level controls work within a specific process, such as a three-way match in purchases.

How do you test design and operating effectiveness?

Design is tested through inquiry, walkthroughs and inspection of documents. Operating effectiveness is tested through sampling, re-performance, observation and inspection of evidence over the period.

What is a risk control matrix in an IFC audit?

It is a document listing each process risk with the control that addresses it, its type, frequency and owner. The auditor uses it to plan and record tests of controls.