Responsibility for internal control and segregation of duties
Who is responsible for internal control?
Responsibility for internal control is distributed across various levels of an organization, with specific roles assigned to individuals and groups within the entity, as well as external parties such as regulators and auditors. A sound internal control system relies on the collaboration of all these players to be effective.
| Party | Primary responsibility | Key point |
|---|---|---|
| Board of directors and audit committee | Oversees the internal control system and sets the tone at the top | Reviews internal and external audit reports to monitor the control framework |
| Senior management (e.g., CEO, CFO) | Designs, implements, and maintains internal controls | Sets control policy, allocates resources, and reinforces an ethical culture |
| Operational and functional managers | Applies and monitors controls within their own areas | Acts as the first line of defense and reports control issues to senior management |
| Internal audit function | Independently assesses whether controls are designed and operating effectively | Reports to the audit committee or board, not to management, to preserve independence |
| Employees | Comply with control policies and procedures in daily work | Report irregularities, control weaknesses, or unethical behavior |
| External auditors | Consider internal control when planning every audit | For public companies subject to SOX Section 404(b), external auditors also evaluate and report on the effectiveness of internal control over financial reporting; they don’t design or implement controls |
| Regulators and standard-setting bodies | Establish laws and frameworks that shape internal control practice | For example, the Sarbanes-Oxley Act (SOX) mandates internal control over financial reporting requirements in the US |
Personnel policies and the control environment
An effective control environment begins with strong personnel policies and procedures. These policies guide the recruitment, training, supervision, and evaluation of employees, ensuring that competent and trustworthy individuals are placed in positions of responsibility. Clearly defined job descriptions, ethical codes of conduct, and ongoing professional development support a culture of accountability and transparency, which are critical for internal control effectiveness.
Segregation of duties
Key functional responsibilities to segregate
Internal control best practices recommend that the following four types of responsibilities be segregated to different people or departments:
- Authority to execute transactions - This refers to the approval or initiation of transactions. For example, a purchasing manager may have the authority to place orders for goods and services.
- Recording transactions - This involves maintaining the accounting records, such as entering transactions into the general ledger or subledgers. A separate accounting staff member would typically perform this function.
- Custody of assets - This responsibility includes physical possession or control over assets such as cash, inventory, or fixed assets. For instance, a warehouse supervisor may manage inventory storage and access.
- Reconciliation of assets to records - Periodic reconciliation ensures that physical assets match the recorded balances in the accounting system. Ideally, someone who does not have access to assets or records them should perform this task to maintain objectivity.
Failure to segregate these duties increases the risk that errors or fraud could occur and go undetected. For example, if one person is responsible for authorizing payments, recording them, and reconciling bank statements, they could easily conceal unauthorized transactions.
Examples of segregation of duties by department
To illustrate how segregation of duties can be applied in practice, consider the following departmental examples:
Example: Cash receipts
A company separates cash receipts duties across four people: the mailroom clerk opens incoming mail and lists the checks received (custody), the cashier deposits the checks (custody), accounts receivable posts the payments to customer accounts (recording), and an employee independent of all three performs the bank reconciliation (reconciliation). If the accounts receivable clerk also handled incoming cash, they could pocket a customer’s payment and cover the shortage by crediting it against a later customer’s payment - a fraud scheme known as lapping.
Segregation of duties can be defeated when two or more employees collude, or when management overrides the controls in place; these inherent limitations are covered in the next chapter, Internal control limitations, risks, and deficiencies.