Study smarter with Fiveable
Get study guides, practice questions, and cheatsheets for all your subjects. Join 500,000+ students with a 96% pass rate.
Internal control isn't just a checklist auditors run through—it's the backbone of how organizations protect themselves from fraud, errors, and operational failures. You're being tested on your ability to understand how these five components work together as an integrated system, not as isolated concepts. Exam questions frequently ask you to identify which component has failed in a given scenario, or to explain how weaknesses in one area cascade into problems elsewhere.
The COSO framework organizes internal control into five interconnected components, and auditors must evaluate each when assessing control risk. Master the relationships between components, the specific elements within each, and how deficiencies manifest in real-world scenarios. Don't just memorize definitions—know what each component accomplishes and how auditors test its effectiveness.
Before any specific controls can work, an organization needs the right culture and structure in place. The control environment establishes whether employees take controls seriously or view them as obstacles to work around.
Once the foundation exists, organizations must systematically identify threats to their objectives. Risk assessment is a dynamic process that connects organizational goals to the specific dangers that could prevent achieving them.
Compare: Control Environment vs. Risk Assessment—both are foundational, but control environment addresses who we are while risk assessment addresses what could hurt us. FRQs often present scenarios where a strong ethical culture exists but management failed to identify emerging risks.
Risk assessment identifies threats; control activities respond to them. These are the specific policies, procedures, and mechanisms that either prevent errors and fraud from occurring or detect them quickly when they do.
Compare: Preventive vs. Detective Controls—preventive controls are generally more cost-effective because they stop losses before they occur, but detective controls provide a safety net when prevention fails. Auditors evaluate whether the mix of controls adequately addresses identified risks.
Controls only work if the right people have the right information at the right time. Information and communication systems serve as the nervous system connecting all other components.
Internal control isn't a one-time implementation—it requires continuous attention to remain effective. Monitoring activities close the loop by evaluating whether the other four components are present and functioning.
Compare: Ongoing Monitoring vs. Separate Evaluations—ongoing monitoring catches problems faster but may miss systemic issues that become "normal." Separate evaluations provide fresh perspectives but occur less frequently. Strong systems use both approaches.
| Concept | Key Elements |
|---|---|
| Control Environment | Tone at the top, governance structure, competence standards, ethical values |
| Risk Assessment | Risk identification, likelihood/impact analysis, change management |
| Preventive Control Activities | Segregation of duties, authorization, physical safeguards |
| Detective Control Activities | Reconciliations, variance analysis, independent verification |
| IT Controls | General controls, application controls, access security |
| Information Quality | Relevance, timeliness, accuracy, accessibility |
| Communication Channels | Upward, downward, horizontal, external |
| Monitoring Methods | Ongoing monitoring, separate evaluations, deficiency reporting |
A company has strong written policies but employees routinely ignore them because senior management doesn't follow the rules either. Which internal control component is deficient, and why does this affect all other components?
Compare and contrast how preventive and detective control activities address the risk of unauthorized disbursements. Which specific controls would an auditor expect to see for each type?
An organization identifies a new competitor entering its market but fails to adjust its internal controls. Which two components have likely failed, and how are they connected?
If an employee discovers a control weakness but has no clear way to report it without going through their direct supervisor (who may be involved), which component is deficient? What specific element is missing?
An auditor finds that management reviews monthly financial reports but never investigates unusual variances. Is this a failure of control activities, monitoring activities, or both? Explain your reasoning using the COSO framework definitions.