Internal Control

Internal controls are the deliberate checks built into how work is done: approval limits, three-way matching, reconciliations, counts, access restrictions and reviews. Preventive controls stop problems; detective controls find them afterwards.

A control that is designed but not operated is worse than none, because it creates false assurance. Evidence that each control actually ran — and what happened when it failed — is what makes the system real.