internal-controls-and-audit

# Internal controls and audit Controls exist because a single person who can initiate, approve and record a transaction can also conceal one. Everything else is elaboration on that. **This structures control design and audit readiness. Statutory audit requirements, and regimes such as SOX where they apply, are matters for your auditors and qualified advisers.** ## The five components an auditor will assess Segregation of duties is one control activity inside a much larger structure, and a team that has only built control activities will still be told its control environment is weak. Auditors assess five components, and a deficiency in any one undermines the others: - **Control environment** — integrity and ethical values, oversight by whoever plays the board role, a structure with defined responsibility and authority, competence for the work assigned, and accountability actually enforced. This is the component small organizations skip and the one that determines whether every other control holds. - **Risk assessment** — objectives defined clearly enough to have risks, risks identified and responded to, **fraud risk assessed explicitly** rather than assumed away, and change identified as it happens. New systems, new people, and rapid growth all invalidate control designs quietly. - **Control activities** — the controls themselves, including those over the information systems the records depend on, and evidence that they were performed rather than merely design...