Internal controls and audit

Controls exist because a single person who can initiate, approve and record a transaction can also conceal one. Everything else is elaboration on that.

This structures control design and audit readiness. Statutory audit requirements, and regimes such as SOX where they apply, are matters for your auditors and qualified advisers.

The five components an auditor will assess

Segregation of duties is one control activity inside a much larger structure, and a team that has only built control activities will still be told its control environment is weak. Auditors assess five components, and a deficiency in any one undermines the others: