How to Build an Internal Control System: A Step-by-Step Guide Using the COSO Framework

An internal control system is the set of policies, processes and controls, carried out by the board, management and staff, that gives reasonable assurance that an organisation will achieve its objectives. The most widely used international reference is the COSO Internal Control – Integrated Framework, whose 2013 edition rests on five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Building a system means identifying risks, documenting processes and controls, assigning ownership, testing, and remediating deficiencies.

Why do organisations build an internal control system?

COSO describes three categories of objectives: effectiveness and efficiency of operations, reliability of reporting, and compliance with laws and regulations. Internal control cannot guarantee that these objectives are met; it provides reasonable assurance. The wording is deliberate. Human error, collusion and management override are possible in any system.

In growing companies and groups, the need for stronger internal control usually appears through a concrete trigger: a new acquisition, preparation for a listing or financing, recurring reporting errors, a suspected irregularity, or a board that feels it cannot see what is really happening. The purpose of the system is to move trust from individuals to processes.

What are the five COSO components?

• Control environment: the tone at the top, ethical values, organisational structure, allocation of authority and responsibility, and the commitment to competence and accountability. It is the foundation for every other component.
• Risk assessment: clarifying objectives, identifying and analysing the risks that threaten them, considering fraud risk explicitly, and monitoring the effect of change such as new products, systems or regulation.
• Control activities: the policies and procedures that bring risks to an acceptable level, including approvals, segregation of duties, reconciliations, access controls and physical controls.
• Information and communication: the right information reaching the right people at the right time, through internal channels, a whistleblowing line and communication with external parties.
• Monitoring activities: ongoing and periodic evaluations of whether controls keep working over time, with deficiencies reported to those responsible and corrected.

The framework also sets out 17 principles tied to these components. In practice the goal is not to tick each principle mechanically but to show that each component is genuinely present in the organisation and that the components work together.

How does the Three Lines Model relate to internal control?

The Institute of Internal Auditors’ Three Lines Model describes how responsibility for risk and control is distributed in an organisation. The first line consists of the business functions that run operations and manage risk day to day; controls primarily operate here. The second line, including risk management, compliance and quality functions, provides expertise, monitoring and challenge to the first line. The third line, internal audit, gives the board independent and objective assurance. The governing body remains accountable for the arrangement as a whole.

A frequent mistake is leaving responsibility for controls with internal audit. Internal audit evaluates controls; the owners are the units that run the processes. To preserve independence, internal audit should not assess a control that it owns.

How are processes and controls documented?

The build starts with scope: which entities, processes and accounts are critical? Procure-to-pay, order-to-cash, inventory, payroll, treasury and the financial close are priority candidates in most organisations. For each process, a flowchart and narrative are prepared, risks are identified, and controls are mapped to those risks. The output is commonly a risk and control matrix.

A good control description answers a set of questions: which risk does it address, who performs it, how often, how, what evidence does it leave, and is it preventive or detective? The owner of a control should be a named role, not simply a department. Segregation of duties should be designed so that no one person can initiate, approve and record the same transaction.

Information systems form a separate layer. If general IT controls over access, change management, backup and operations are weak, the reliability of automated controls that depend on those systems is also in question. Controls over the systems and reports themselves should therefore be part of the scope. Replacing manual controls with automated ones reduces error risk, but automation creates its own control requirements.

How are controls tested and deficiencies handled?

Testing separates two questions: is the control designed properly, and does it operate as designed? Design assessment checks whether the control would actually mitigate the risk. Operating effectiveness testing shows, through sampling, re-performance, observation and inspection, that the control was applied consistently over a period. Scope and sample sizes depend on the level of risk and the frequency of the control.

Deficiencies are classified by severity, for example as control deficiencies, significant deficiencies or material weaknesses. Each is given an owner, an action plan and a target date, and results are reported regularly to the board or audit committee. Retesting remediated controls closes the loop.

How does the build proceed step by step?

1. Sponsorship and scope: with board support, set objectives, scope and responsibilities.
2. Risk assessment: identify and prioritise risks for critical processes and accounts.
3. Process documentation: record process flows, risks and existing controls.
4. Gap analysis: find controls that do not cover risks, and controls that are redundant.
5. Design and ownership: design missing controls and assign an owner and frequency to each.
6. Testing and reporting: assess design and operating effectiveness and report findings to management.
7. Ongoing monitoring: update the matrix whenever processes, systems or regulation change.

Rather than rolling the system out across the whole group at once, it is often more sustainable to start with higher-risk processes and extend scope gradually. This lets control owners adapt and shows early results.

What are the common mistakes?

• Treating internal control as purely financial reporting or as a one-off documentation project.
• Neglecting the tone from the top; writing procedures cannot compensate for a weak control environment.
• Building control lists without a risk assessment, so everything is controlled and what matters is missed.
• Preparing a matrix without naming owners, leaving controls that exist on paper but are not performed.
• Over-designing controls so that operations slow down and users work around them.
• Failing to use automation, leaving reconciliations and approvals manual.
• Not keeping documentation current when a process changes.

If you would like to discuss the scope, priority processes and implementation plan of an internal control system for your organisation, Hector Kurumsal would be glad to talk. This article is for general information and does not constitute professional or legal advice.