A distribution center loses $180,000 to duplicate vendor payments over eight months. The three-way match existed on paper. Nobody ran the duplicate-invoice report. The control design was fine; the control that would have caught the failure never operated.
An internal control is any action taken by management, the board, or other parties to manage risk and increase the likelihood that objectives are achieved. The purpose of internal controls follows directly from that definition, and so does the discipline of recommending controls to mitigate risks that sit outside appetite. That definition carries three exam-relevant claims.
- Controls exist to serve objectives, not to exist for their own sake. A control with no objective behind it is cost without benefit.
- Controls manage risk to an acceptable level. They do not eliminate risk.
- Controls are management's responsibility. Internal audit evaluates them; it does not own them.
Under the Three Lines Model, operating management (first line) owns and operates controls, risk and compliance functions (second line) provide expertise and monitoring, and internal audit (third line) provides independent assurance on whether...
Common mistakes
- Calling a reconciliation preventive. A bank reconciliation runs after transactions post. It detects. Only controls that act before the event qualify as preventive.
- Ignoring the corrective leg. An exception report with no owner and no resolution deadline leaves the loss intact. Detection without correction is an incomplete recommendation.
- Recommending a $41,000 control against a $27,000 exposure. Over-control is a finding. Compare annual control cost to expected loss reduction before recommending.
Bottom line
- Controls exist to manage risk toward objectives; management owns them, internal audit independently evaluates them.
- Preventive acts before the event, detective identifies it after it occurs, corrective fixes the problem and its cause.
- Directive controls steer behavior through policy and training; compensating controls substitute when the ideal control is impractical.
- Segregation of duties separates authorization, custody, and recordkeeping; two of three in one pair of hands requires a compensating control.
Exam shortcut
Read the stem for the timing word. "Before release," "prevents entry," "requires approval prior to" signals preventive. "Reconciles," "reviews after," "reports exceptions," "counts" signals detective. "Restores," "recovers," "retrains," "remediates" signals corrective. Answer the timing, not the sophistication of the control. When a stem asks you to recommend, run the order: objective, risk, existing control, gap, cost versus expected loss reduction, residual versus appetite.
The full lesson (about 2,058 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 7
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.