Internal Controls Over Financial Reporting: What Is Tested and Why

Internal controls over financial reporting are the ordinary arrangements that make a set of numbers reliable before anybody audits them: approvals, reconciliations, split duties, restricted system access. Alongside the opinion on the statements, the auditor also reports on whether those arrangements are adequately designed and actually operating. The controls report is about the machinery, and machinery running is not the same as the output being right.

Start with a household rather than a company. Two people share the money. One does the shopping and keeps the paper slips in a jar. The other, at the end of every month, sits down with the bank messages and matches them against the slips in the jar. Nobody in that household calls this a control system. Matching the slips is just how they run the month. But it catches a double charge, it catches a slip nobody kept, and it catches a payment neither of them recognises, and it catches those things because the person checking is not the person spending.

The household routine is the whole idea, and it does not get much grander when the numbers get bigger. The statutory audit as a process, the document it produces, and how internal audit differs from it are covered separately. Underneath all of that sits a further layer. The everyday arrangements a company runs internally decide whether the raw figures were right before an auditor ever looked, and the auditor gives a separate report on those arrangements. Two things need pulling apart. One is what the controls report says. Far more important is what it cannot say.

What is a control, and what does one actually look like?

A controlAny arrangement inside a business that is there to stop a figure going wrong, or to catch it if it does, before the figure reaches the accounts. is an arrangement a company puts in place to stop a figure going wrong, or to catch it if it does. On its own that definition teaches nothing. The words sound like a policy manual. So look at three real ones instead, at the scale a stationery business actually has them.

The first. Somebody other than the person raising an invoice approves it. At Anjani Stationers Private Limited, Vaidehi Rao approves payments above a level she has agreed with the board, and she is not the person who keys in the supplier invoice in the first place. Two people, two steps, one payment. Splitting the task that way is segregation of dutiesSplitting a task so that no single person can both start a transaction and approve it. The point is not distrust; it is that one person acting alone has nothing to check them., and the point is not that anyone is suspected of anything. The point is that a single person acting alone has nothing standing between a mistake and the ledger.

The second. The bank balance is reconciled every month, and the person doing the reconciling cannot make payments. A reconciliationAgreeing what the business has recorded against what an outside party says, most often the bank statement, and chasing every difference until it is explained. is simply agreeing what the business thinks happened against what an outside party says happened, and chasing the difference until it is explained. The second half of the sentence is the part that carries the weight. The same person can create the difference and then explain it away, so a reconciliation done by somebody who can move money is worth very little.

The third. Access to the accounting system is limited by role. The person who posts sales cannot open the supplier master file, and cannot change the bank account a payment goes to. Restricting access is not a technology decision. The idea is the same as the first two, enforced by software rather than by a signature.

Controls are ordinary operational arrangements that a business would want anyway, not a separate compliance artefact bolted on for the auditor. Nobody at Anjani Stationers does a monthly bank reconciliation in order to satisfy a report. The reconciliation happens because otherwise the cash figure drifts and nobody notices for a year. The reporting sits on top of arrangements that already had a reason to exist. A business with genuinely weak controls is therefore usually hard to run, not merely hard to audit.

What is the auditor required to say about internal controls?

Alongside the opinion on the statements, the auditor gives a separate report on the company's internal financial controls. The controls report answers two questions, and keeping them apart is the single most useful move a reader can make. The first is whether the controls are adequately designed. The second is whether they were operating effectivelyWhether a control was actually performed, by the right person, throughout the period, rather than merely existing on paper as a described arrangement., meaning actually performed, by the right person, throughout the period.

Design and operation are different questions, and either can fail on its own. A control can be beautifully designed and never run. The approval box exists in the system, nobody has looked at it since March, and every payment goes out unapproved. Design passes; operation does not. Or a control can run perfectly all year and be pointed at nothing. The same person raises the invoice and approves it, every single time, without fail. Operation is flawless. Design was never there.

A control that exists on paper and is never performed is worth exactly the same as no control at all, so the report has to answer both questions rather than one. Think about the fire extinguisher in a stairwell. Whether it is the right kind of extinguisher for the risk is one question. Whether it has been checked since it was screwed to the wall is another. Nobody in a fire is comforted by the first answer alone.

What is a deficiency, and when does it become a material weakness?

There is a ladder here with three rungs, and the ladder is worth learning because the words appear in reports and readers rank them wrongly.

A deficiencyA control that does not prevent or catch a misstatement on a timely basis, either because it is designed badly or because it is not being performed. is the bottom rung: a control that does not prevent or catch a misstatement on a timely basis. Either it is designed badly or it is not being performed. Every business of every size has some. A significant deficiency is the middle rung: one weighty enough that the people responsible for oversight, meaning the board or the audit committee sitting under it, ought to hear about it. A material weaknessA deficiency, or a group of them, where a misstatement large enough to change what a reader decides could occur without being prevented or caught. is the top rung: a deficiency, or a combination of them, where a misstatement large enough to matter could occur and not be prevented or detected.

Now read that last sentence again and notice the verb. Every rung on this ladder is about what could happen, not about what did happen, so a reported material weakness does not mean anything went wrong. A material weakness means something could have gone wrong and nothing in the business would have stopped it. A possibility and an event are entirely different claims, and readers collapse them constantly.

Take it out of accounting for a second. A ground floor window does not lock. Nothing has ever been stolen from the house. Not once, in eleven years. The window is still a weakness, and the fact that nobody has climbed through it is not evidence about the window. The evidence is about the eleven years. A person who reported the window would be describing a possibility, and a person who heard the report and concluded that a burglary had occurred would have misread it completely.

Why can the controls be adequate and a number still be wrong?

Two reasons, and they matter more than anything else about controls.

The first reason is reach. Controls address error and routine fraud. A key stroke that put a figure in the wrong column, an invoice paid twice, a supplier bank detail quietly changed, a sale recorded in the wrong month. Every one of those is a processing event, and a processing event can be caught by another person, another system, or another record. A judgement made in good faith that later turns out badly is not a processing event, so no arrangement anywhere in the business is built to catch it. Nobody at Anjani Stationers can approve the useful life of a binding machine into correctness. There is no second signature that makes an estimate true.

The second reason is management overrideThe people who set the controls stepping around them. Because they decide what the rules are and who enforces them, no control they built can reliably stop them.. The people who set the controls can step around them. Picture the owner of a small shop who made the rule that nobody takes money from the till without writing a slip, and who then takes money from the till without writing a slip. The person who made the rule decides who checks, what gets checked, and what happens to anybody who raises it, so the staff cannot enforce the rule against them.

Management override is precisely why a clean controls report is not a guarantee, and this limitation is acknowledged inside the reporting framework itself rather than being an outside criticism of it. The framework does not claim to have solved override. The framework says plainly that controls have inherent limitations and that override is one of them. So a reader who says a controls report failed to stop override has not found a flaw. The complaint restates something the report already told them.

What are the limits of what a controls report can tell a reader?

Three, and they are structural rather than embarrassing. Naming them is what allows the report to be read accurately instead of over-read.

The first limit is sampling. Controls are tested on a selection, not on every occurrence. Anjani Stationers Private Limited processes thousands of supplier invoices in a year, and nobody re-performs the approval on all of them. A selection is examined and a conclusion is drawn about the rest. Sampling is not laziness, and it is the only way any such work could ever finish. But it means the conclusion is about the population as sampled rather than about every single instance in it.

The second limit is the date. The assessment attaches to a point in time. A fire safety certificate dated in March is a statement about a building in March. The certificate says nothing about that building in December, and everyone understands that instinctively about a building while forgetting it about a company.

The third limit follows from the second. A control environment can degrade between assessments, and it usually degrades quietly. The person who did the monthly reconciliation leaves and nobody picks it up. The system is upgraded and the access roles are rebuilt loosely to get everyone working again. Volumes double and the approval that was reasonable at the old volume becomes a rubber stamp at the new one. A clean controls report says the machinery was adequate as designed and as tested, at that point, on that sample, and it says nothing at all beyond those three limits.

Where do Anjani Stationers' own numbers rest on control, and where on judgement?

Now put the case entity on the table and sort its published figures by what actually decides them. Anjani Stationers Private Limited runs a control environment at the scale a small business genuinely has one, and it carries no reported material weakness. Carrying none is the ordinary position for an ordinary business.

Vaidehi Rao, as finance controller, approves payments above a level she has agreed with the board, and she does not raise the invoices she approves. The bank reconciliation is done monthly. Access to the accounting system is limited by role. Three arrangements, described in a sentence each, and between them they stand behind a large amount of what the company publishes.

Look at the shaded block and then look at the total. Rs 9,00,000, Rs 12,00,000 and Rs 2,40,000 come to Rs 23,40,000 of figures whose size is settled by somebody forming a view. No control anywhere in Anjani Stationers protects any of those three, and a clean controls report would say nothing whatever about any of them.

Be precise now about what is and is not being claimed. A control does feed those figures. The receivables ageing that sits under the provision is produced by the same invoicing and cash application that controls stand behind, and Rs 2,23,000 of the year's Rs 6,00,000 charge is nothing more than that ageing carried through at unchanged rates. The asset register that lists what the company bought is control output too. But the ageing does not decide what rates to apply to it, the register does not decide how long a binding machine lasts, and nothing in the system has a view on whether the Sunrise Public School group will ever win its claim. Controls supply the inputs to a judgement and never make the judgement, and the difference between those two is the whole of this section.

Start where the panel opens. The lens rests on the provision of Rs 9,00,000, nothing is switched on, and four amounts adding to Rs 26,90,000 carry no control segment whatever: the provision itself, the Rs 12,00,000 of depreciation and amortisation, the Rs 2,40,000 claim, and the Rs 3,50,000 of goodwill, an amount that appears only on consolidation and is tested instead of being written off over time. Turn on the invoice approval setting and three rows light up while nine stay dark. Turn on the bank reconciliation setting and a different three light up. System access is the widest of the three and the one worth dwelling on. Even at its widest it reaches the recorded figure for the provision and for depreciation without reaching the judgement that produced either, and it never touches the Rs 2,40,000 claim at all: a claim nobody recognised cannot be moved by a journal entry. The lesson sits in one word: a weakness attaches to a named process, and the rows it misses say as much as the rows it hits.

What should a reader take from a clean controls report?

Three things, and the second of them is the one readers most often miss.

First, the routine numbers are more likely to be right than not. The assurance is worth something real. Revenue of Rs 2,70,00,000 built from invoices that a second person approved, receivables of Rs 95,00,000 tied back to those invoices and to cash actually received, a bank balance agreed to a statement every month by somebody who cannot move money. A reader who dismisses that as paperwork has thrown away the one thing the report genuinely offers.

Second, and this is the payload: estimates and judgements are not what controls protect. A clean controls report and an earnings quality assessment answer different questions, and neither one substitutes for the other. The controls report was never addressed to estimates, so everything already established about reading them still applies in full after a clean report. The Rs 3,77,000 of judgement inside the year's provision charge is exactly as much a matter for the reader's own judgement after a clean report as before it. So is the choice of useful lives standing behind Rs 12,00,000 of depreciation and amortisation. So is the view that the Sunrise Public School group's Rs 2,40,000 claim is not probable.

Third, a reported material weakness is a genuine signal and repays reading in detail. A reported weakness is uncommon, and when it appears it is specific: it names a process, a period and a possibility. Read which process. Then work out for yourself which published figures pass through that process and which do not, exactly as the panel above does. A weakness in one process is not a verdict on a whole set of accounts, and treating it as one throws away the specificity that makes it useful.

Who actually picks up a controls report, and what for?

The same few sentences land differently depending on who picked the report up, so follow it into three sets of hands.

For a bank the report is a proxy for whether monthly figures can be trusted at all, for an equity analyst it is a map of where to stop reading and where to start, and for Vaidehi Rao it is a work list with her name on it. Start with the bank. A lender to Anjani Stationers Private Limited meets audited accounts once a year, and in between it gets management-prepared numbers every month or quarter. The in-between numbers are what the lending decision actually runs on, and nobody assures a single one of them. The condition of the machinery is therefore the closest thing the lender has to a read on whether such numbers are worth anything. Where a monthly reconciliation happens and approvals are split, monthly information carries some weight. Where neither happens, monthly information is an estimate with decimal places attached to make it look otherwise.

For the equity analyst the use is triage. A clean position lets attention come off whether revenue of Rs 2,70,00,000 was captured properly and go onto the Rs 23,40,000 that the report was never speaking about. Reading time is finite. Spending it where the report has already answered the question buys nothing, and spending it where the report is silent buys everything.

Vaidehi Rao meets the report from the other side of it. A raised deficiency is not a signal to her, it is a task with an owner and a date. She also carries something outside readers tend to forget. These arrangements cost somebody real hours every month, and they quietly die the moment no one is answerable for them. One person living on one salary with one bank account can keep the whole picture in their head and needs none of this. A business with a subsidiary, a related party balance and a long list of suppliers cannot, and the arrangements are what stands in for the head that ran out of room.

Vaidehi Rao, Chitra Binding Works, the Sunrise Public School group and Anjani Stationers Private Limited are invented.
Educational material. Not advice on any investment, tax, budget or market position.