Every business has assets that can be stolen, records that can be wrong and rules that can be broken. Internal control is the set of arrangements that stops these things happening, or catches them quickly when they do. Internal audit is the function that checks that those arrangements work. Both are core ideas for an accountant, because auditors, directors and regulators all rely on them.
This topic covers the objectives and components of internal control, the main types of control, the limits of control, the work of internal audit and the difference between internal and external audit. The Institute of Chartered Accountants of Nigeria (ICAN) Business Environment paper tests all of these, usually through a scenario that asks you to spot weaknesses and recommend fixes.
In 30 seconds
Internal control is the system of policies and procedures that management puts in place to safeguard assets, keep reliable records, promote efficiency and ensure compliance. It has five components: control environment, risk assessment, control activities, information and communication, and monitoring. Controls can prevent, detect or correct problems. They have limits: error, collusion, management override and cost.
Internal audit is an independent function inside the organisation that evaluates risk management, control and governance. External audit gives shareholders an opinion on the financial statements.
What is internal control?
Internal control is the whole system of policies, procedures and checks that management sets up to help the organisation achieve its objectives and run in an orderly way. It is not a single department. It runs through every process and is the responsibility of everyone, though the board and management carry the main responsibility.
Objectives of internal control
- Safeguard assets. Protect cash, stock, equipment and information from theft, loss and misuse.
- Keep reliable records. Make sure transactions are recorded completely and accurately, so that financial statements can be trusted.
- Promote efficient and effective operations. Avoid waste and make sure resources are used well.
- Ensure compliance. Follow laws, regulations and the organisation’s own policies.
- Prevent and detect fraud and error. Reduce the opportunity and find problems early.
Internal control in the syllabus
Internal control is the set of routines and checks a firm builds in to keep its financial information trustworthy, hold people to account and stop fraud. It is a key part of governance and risk management, and it gives assurance about operational effectiveness and efficiency, reliable financial reporting and compliance with laws and policies. Three ideas lie behind the definition:
- Internal control is a process, a means to an end and not an end in itself.
- It is driven by people. It goes beyond manuals and forms to the actions, attitudes and responsibilities of people at every level.
- It gives reasonable, not absolute, assurance to management and the board.
Controls strengthen the reliability of information, compliance with policies and laws, the safeguarding of assets, the economical and efficient use of resources, and the achievement of goals.
Objectives of internal control
| Objective | What it means |
|---|---|
| Efficient conduct of business | Processes run smoothly, free from disruption, which protects the creation of value |
| Safeguarding assets | Tangible and intangible assets are used for proper purposes and are not open to misuse or theft |
| Preventing and detecting fraud and other unlawful acts | Even small firms can be victims, and fraud grows more varied as organisations grow |
| Completeness and accuracy of financial records | Accurate statements need reliable records of the transactions that took place |
| Timely preparation of financial statements | The firm can meet its legal duty to file accounts on time and give shareholders meaningful statements. Controls also support management accounting for planning and decisions |
Seven essential controls for an accounting team
| Control | How it works |
|---|---|
| Separation of duties | The first preventive control. Key tasks are split among different people so that none controls a transaction from start to finish, for example one person starts it, another authorises it and a third reconciles. The person who receives payments is not the person who pays out |
| Access controls | Policies and mechanisms that restrict access to financial data and systems. Physical: locks, card entry, cameras. Administrative: rules on who may see what and when, and background checks. Technical: unique user names and passwords, and multi-factor authentication |
| Physical audits | Inventory counts that compare stock on hand with the accounting records, to find errors, theft or damage. Surprise counts reduce manipulation, and a record of each count creates an audit trail |
| Standardised financial documents | Consistent invoices, receipts and purchase orders make reporting uniform and cut errors |
| Periodic trial balances | A snapshot of all ledger balances at set dates. If debits and credits differ, there is an error somewhere in the books |
| Periodic reconciliations | Comparing internal records with outside records, such as the cash book with the bank statement, card statements, and the receivables ledger with customer balances. They find errors, detect fraud, support compliance and keep statements accurate |
| Approval workflows | Spending needs approval in a set sequence. A ₦5 million campaign, for example, goes from the team’s proposal to the marketing manager, then to finance to confirm the budget, and then to final approval. It adds accountability and an audit trail |
Internal check
Internal check is the part of internal control in which work is checked automatically by another person as part of the normal workflow, so no one person controls every aspect of a transaction. Its essential elements are continuous review of day-to-day transactions, operation as part of the system, and work that is complementary to the work of others.
The components of internal control
Background.
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, a widely used standard, describes five connected components.
| Component | What it means | Example |
|---|---|---|
| Control environment | The attitude, awareness and actions of the board and management. The ‘tone at the top’. It shapes how seriously everyone takes control | A code of conduct that managers follow. Clear lines of authority. Competent staff |
| Risk assessment | Identifying and analysing the risks that could stop the organisation meeting its objectives | A review of fraud, cyber and cash-handling risks each year |
| Control activities | The policies and procedures that respond to those risks | Authorisation limits, reconciliations, segregation of duties |
| Information and communication | Systems that capture and pass on the information people need to do their jobs and meet their responsibilities | Accurate reports to managers. A way for staff to report concerns |
| Monitoring | Checking over time that controls still work and fixing weaknesses | Management review of exceptions. Internal audit visits |
Types of control
| Type | Purpose | Examples |
|---|---|---|
| Preventive | Stop an error or fraud from happening | Passwords. Authorisation before payment. Locks on a stockroom. Segregation of duties |
| Detective | Find an error or fraud that has already happened | Bank reconciliations. Stock counts. Reviews of variances against budget |
| Corrective | Put right what has gone wrong and stop it recurring | Restoring data from a backup. Disciplinary action. Correcting a posting error |
Common control activities
- Authorisation and approval. Transactions above a limit need a manager’s approval.
- Segregation of duties. No one person controls a transaction from start to finish.
- Physical controls. Safes, locks, security staff and restricted access to stock and records.
- Arithmetical and accounting controls. Reconciliations, control account checks, control totals and sequentially numbered documents.
- Supervision and review. Work is checked by someone senior.
- Management controls. Budgets, variance reports and performance reviews.
- Information technology (IT) controls. Passwords, user access rights, firewalls, and regular backups kept off site.
- Personnel controls. Careful recruitment, training and compulsory annual leave, so that someone else covers the job and may spot irregularities.
Segregation of duties
Segregation of duties means dividing the steps of a transaction between different people, so that one person cannot make and conceal an error or fraud alone. The key duties to keep apart are authorising a transaction, having custody of the related asset, recording it and reconciling the records.
| Step in buying goods | Document | Who should do it |
|---|---|---|
| Ask for the goods | Purchase requisition | The department that needs them |
| Approve and order | Purchase order | The purchasing officer, with a limit for approval |
| Receive and check the goods | Goods received note | Store staff, who are separate from purchasing |
| Record the supplier’s invoice | Supplier invoice, matched to the order and the goods received note | An accounts clerk |
| Pay | Payment voucher and cheque or transfer | An authorised signatory who did not raise the order or record the invoice |
Why controls matter: the fraud triangle
Background.
Donald Cressey proposed that fraud occurs when three things come together: pressure (such as debt), opportunity (such as weak controls) and rationalisation (telling oneself it is acceptable). Internal control works mainly on the opportunity side. If controls remove the chance to steal unnoticed, fraud becomes harder even when pressure and rationalisation are present.
Limitations of internal control
However well designed, a control system gives reasonable assurance, not a guarantee.
- Human error. Staff misunderstand instructions, make mistakes or are careless.
- Collusion. Two or more people working together can defeat segregation of duties.
- Management override. Senior managers can bypass controls.
- Cost against benefit. A control should cost less than the loss it prevents, so some risks are accepted.
- Designed for routine. Controls handle normal transactions better than unusual ones.
- Change. Controls become outdated when the business, its systems or its risks change.
Internal audit
Internal audit is an independent, objective assurance and advisory activity within an organisation. It evaluates and helps improve the organisation’s risk management, internal control and governance.
What internal auditors do
- Review internal controls and test whether they work.
- Operational (value for money) audits that examine economy, efficiency and effectiveness.
- Compliance audits that check adherence to laws, regulations and policy.
- Financial audits of the reliability of accounting records and reports.
- IT audits of systems, security and data.
- Fraud investigations when irregularities are suspected.
- Advice to management on risk and on improving processes.
Independence of internal audit
Internal audit can only add value if it is independent. It should report to the audit committee or the board, not to the managers whose work it reviews. Auditors should have the authority to see any record and to speak to any employee, and should not be given operating duties in the areas they audit.
Public companies in Nigeria are required by Companies and Allied Matters Act 2020 (CAMA 2020) to have an audit committee, which gives internal audit a route to the board.
Types, objectives, roles and benefits of internal audit
Internal audit is an independent look, from inside the firm, at how it is run, governed, controlled and protected against risk, with the aim of improving it and giving assurance.
| Type of internal audit | What it does |
|---|---|
| Compliance audit | Checks that internal rules, procedures and policies are followed |
| Financial audit | Includes payroll audits, to make sure staff are paid correctly, and benefit plan audits, to make sure plans meet legal requirements and are funded |
| Technology (IT) audit | Assesses IT infrastructure for weaknesses and best practice |
| Operational audit | Assesses processes and procedures to find ways to improve operations |
| Performance audit | Assesses whether the business meets the performance measures set by management |
Objectives. Review of accounting and internal control systems. Examination of financial and operating information. Review of the three Es: economy, efficiency and effectiveness. Review of compliance with laws and regulations. Review of arrangements for safeguarding assets. Review of how corporate goals are being met. Identification of significant risks and monitoring of risk management policy and strategy.
Roles. To improve operations, identify weaknesses, ensure compliance, protect assets and improve decisions. Benefits. Greater efficiency and effectiveness, reduced risk, better compliance and better decisions.
Internal and external audit compared
| Point | Internal audit | External audit |
|---|---|---|
| Purpose | Improve risk management, control and governance | Give an opinion on whether the financial statements give a true and fair view |
| Appointed by | Management or the board | The shareholders |
| Reports to | The audit committee, board or senior management | The shareholders |
| Scope | Wide: any area of the organisation | Narrow: the financial statements |
| Required by law | Not for most companies, but required for some regulated entities | Yes, for companies, each year |
| Staff | Employees of the organisation, or an outsourced firm | An independent audit firm |
| Timing | Continuous through the year | Usually after the year end |
| Independence | Independent of the activities audited, but part of the organisation | Fully independent of the company |
Statutory audit, and audit compared with assurance
A statutory audit is required by law so that financial statements are accurate and reliable for public disclosure. Assurance is the wider term for giving confidence about financial and non-financial information. A statutory audit is one kind of assurance.
| Point | Audit | Assurance |
|---|---|---|
| What it is | A systematic, independent examination of financial statements, records and processes by an external auditor | Evaluating information, systems, processes or controls to give stakeholders confidence |
| Purpose | To express an opinion on whether the financial statements are fair and comply with accounting standards and regulations | To raise the reliability, credibility and usefulness of the information evaluated |
| Scope | Financial statements | Wider: reviews, examinations and agreed-upon procedures on matters such as sustainability reporting, cybersecurity and internal controls |
| Driven by | Law and the needs of shareholders | The needs of stakeholders such as investors, regulators and customers |
An audit has four elements: independence from the client, extensive testing of transactions, controls and documents, a compliance focus on standards, law and controls, and a historical perspective, because it looks back at past performance.
Worked example: spotting control weaknesses
Scenario. At Adaeze Supplies, one clerk raises purchase orders, receives the goods, records the supplier invoices and signs the cheques. The owner visits the shop once a week and never checks the bank statements. Identify the weaknesses and recommend improvements.
| Weakness | Risk | Recommended control |
|---|---|---|
| One clerk orders, receives, records and pays | The clerk could order for personal use or pay a fictitious supplier and hide it | Segregate the duties between at least three people |
| The clerk signs cheques alone | Unauthorised payments | A second signatory, or owner approval above a set limit |
| No one checks the bank statements | Errors and fraud go undetected | A monthly bank reconciliation by someone who does not handle cash, reviewed by the owner |
| No documentation check | Payment without a matching order and goods received note | Match invoice, order and goods received note before payment |
| Limited supervision by the owner | Weak control environment | Regular review of reports, and surprise stock counts |
Each recommendation must answer a named weakness. Do not list generic controls.
Internal control in more detail
Segregation of duties: the four functions to separate
The core idea of separation of duties is that no one person should control a transaction from start to finish. Four functions should be held by different people: authorisation (approving the transaction), custody (holding the asset, such as cash or stock), recording (writing it in the books) and reconciliation (checking the records against reality). If one person does several, he can commit and hide an error or fraud.
The purchases cycle: where each control sits
| Stage | Risk | Control |
|---|---|---|
| Requisition | Buying what is not needed | Written request approved by a budget holder |
| Ordering | Orders to unapproved or fictitious suppliers | An approved supplier list, numbered purchase orders, approval limits |
| Receiving | Goods short or poor quality | A goods received note signed by someone independent of ordering, with a count and quality check |
| Invoice | Paying for goods not received or double paying | Match the order, goods received note and invoice before approval |
| Payment | Payment to the wrong person or for the wrong amount | Payment approved by someone other than the person who recorded the invoice, with two cheque signatories or dual authorisation |
| Reconciliation | Errors and fraud left undetected | Monthly supplier statement and bank reconciliations reviewed by a senior person |
Types of control
Preventive controls stop errors and fraud before they happen, such as approval limits and passwords. Detective controls find problems after they happen, such as reconciliations and exception reports. Corrective controls fix them, such as recovering a loss or amending a procedure.
Why internal control gives only reasonable assurance
Controls are made by people and run by people. They can fail because of human error, collusion between two staff to get round segregation, management override, controls that cost more than the risk they address, and changes that make old controls out of date. That is why the syllabus speaks of reasonable, not absolute, assurance.
Internal and external audit compared
| Point | Internal audit | External audit |
|---|---|---|
| Appointed by | Management or the board | The shareholders |
| Reports to | Management, the board or the audit committee | The shareholders |
| Main aim | To improve controls, risk management and efficiency | To give an opinion on whether the financial statements give a true and fair view |
| Scope | All aspects of the organisation, set by management | The financial statements, set by law |
| Independence | Independent of the work audited, but an employee or contractor | Independent of the company |
Exam focus: internal control and internal audit answers
These two areas were examined in November 2025 (Question 3, internal control) and May 2026 (Question 3, internal audit). The points below are the ones the model answers rewarded.
What internal controls strengthen
- The reliability and integrity of information.
- Compliance with policies, plans, procedures, laws and regulations.
- The safeguarding of assets.
- The economical and efficient use of resources.
- The accomplishment of established objectives and goals for operations or programmes.
Four fundamental concepts in the definition of internal control
- It is a process. It is an ongoing series of activities that helps the organisation achieve its objectives. It is a means to an end, not an end in itself.
- It is carried out by people. It depends on the actions, attitudes, competence and integrity of people at every level, not just on written policies.
- It gives reasonable, not absolute, assurance. No system can remove all risk.
- It is designed to help achieve objectives. These are effective operations, reliable financial reporting and compliance with laws and regulations.
Three examples of access control
- Physical controls. Locks on doors, card readers for the IT room and cameras that capture unauthorised entry to areas where financial data is kept.
- Administrative controls. Policies on who may reach which information and when, such as background checks for staff who handle sensitive data.
- Technical controls. Unique user names and passwords, and multi-factor authentication such as a one-time code sent to a phone.
Five objectives of internal control
- Efficient conduct of business. Processes run smoothly without disruption.
- Safeguarding assets. Tangible and intangible assets are used for proper purposes and protected from misuse or theft.
- Preventing and detecting fraud and other unlawful acts. Larger organisations face more varied fraud, so controls must match.
- Complete and accurate financial records. Reliable statements need reliable records.
- Timely preparation of financial statements. Legal deadlines and shareholders’ needs must be met.
Types of internal audit
| Type | What it does |
|---|---|
| Compliance audit | Checks that internal rules, procedures and policies are followed. |
| Financial audit | Reviews financial processes, for example payroll audits that confirm staff are paid correctly. |
| Environmental audit | Assesses the environmental performance and impact of the business. |
| Technology or IT audit | Assesses IT infrastructure for weaknesses and good practice. |
| Operational audit | Reviews processes and procedures to find ways to improve operations. |
| Performance audit | Assesses whether the business meets the performance measures set by management. |
Formal objectives of internal audit
Review of accounting and internal control systems; of financial and operating information; of economy, efficiency and effectiveness (the three Es); of compliance with laws and regulations; of arrangements to safeguard assets; of the implementation of corporate goals and objectives; and the identification and monitoring of significant risks and risk management strategies.
Key roles of internal audit
- Improving operations. It evaluates risk management, controls and governance and recommends improvements.
- Identifying weaknesses. It finds weak areas before they grow into material loss.
- Ensuring compliance. It reduces the risk of legal penalties and reputational damage.
- Protecting assets. It reviews activities to guard assets against misuse, theft and waste.
- Enhancing decision-making. It gives management independent information for better strategic choices.
Common mistakes in the exam
- Listing weaknesses with no explanation of the risk each one creates.
- Recommending a control that does not fix the stated weakness.
- Confusing preventive controls with detective ones. A reconciliation detects. A password prevents.
- Saying internal control removes all fraud. It gives reasonable assurance only.
- Mixing internal and external audit, especially who appoints the auditor and who receives the report.
- Saying internal audit is responsible for internal control. Management is responsible. Internal audit evaluates it.
Quick revision
- Objectives: safeguard assets, reliable records, efficiency, compliance, prevent and detect fraud and error.
- Syllabus: internal control is a process, driven by people, giving reasonable assurance. Seven essential controls, internal check, five types of internal audit, and audit versus assurance.
- COSO components: control environment, risk assessment, control activities, information and communication, monitoring.
- Controls prevent, detect or correct. Learn an example of each.
- Segregation of duties separates authorising, custody, recording and reconciling.
- Limitations: error, collusion, management override, cost, routine focus and change.
- Internal audit is independent, reports to the audit committee and has wide scope. External audit reports to shareholders on the financial statements.
Practice questions
These are original questions written in the style of the ICAN exam. Try each one before you open the answer.
Section A style: multiple choice
Question 1. Which of the following is an example of segregation of duties?
- The same person orders goods and receives them
- One person approves payments and a different person records them
- One clerk handles cash and writes up the cash book
- Managers review their own policies
Show the answer
B. Approval and recording are split between two people. In the other options, one person controls two steps.
Question 2. A bank reconciliation is best described as:
- A preventive control
- A detective control
- A corrective control
- A physical control
Show the answer
B. A detective control. It finds differences between the books and the bank after the transactions have happened.
Question 3. Which COSO component is often described as the ‘tone at the top’?
- Risk assessment
- Control environment
- Monitoring
- Information and communication
Show the answer
B. Control environment. It reflects the attitude and example of the board and management.
Question 4. Which of the following is a limitation of internal control?
- Segregation of duties
- Collusion between employees
- Authorisation limits
- Supervision of staff
Show the answer
B. Collusion. Two or more people working together can defeat controls that depend on separation. The other options are controls.
Question 5. Internal audit differs from external audit because internal audit:
- Gives an opinion on the financial statements to shareholders
- Is always required by law
- Reports to management or the audit committee and has a wider scope
- Is appointed by the shareholders
Show the answer
C. Internal audit reports inside the organisation and can cover any area. The other options describe external audit.
Question 6. Requiring a password to open the accounting system is an example of a:
- Corrective control
- Preventive control
- Detective control
- Management override
Show the answer
B. Preventive control. It stops unauthorised access before it happens.
Question 7. Which of the following is one of the seven essential controls described in the syllabus?
- Periodic reconciliations
- Dividend policy
- Share buy-back
- Capital budgeting
Show the answer
A. The seven are separation of duties, access controls, physical audits, standardised documents, periodic trial balances, periodic reconciliations and approval workflows.
Question 8. An internal audit that assesses whether the business meets the performance measures set by management is a:
- Compliance audit
- Performance audit
- IT audit
- Financial audit
Show the answer
B. Performance audit. A compliance audit checks adherence to rules, and an IT audit assesses technology.
Question 9. Which of these is a detective control?
- Approval limits
- Bank reconciliation
- Passwords
- Separation of duties
Show the answer
B. Reconciliations find errors after they occur.
Question 10. The four functions that should be separated are authorisation, custody, recording and:
- Reconciliation
- Marketing
- Hiring
- Printing
Show the answer
A. Different people should check records against reality.
Question 11. A goods received note should be signed by someone who is:
- The person who ordered the goods
- Independent of ordering
- The supplier
- The cashier
Show the answer
B. Independence prevents collusion.
Question 12. Internal control gives only reasonable assurance mainly because it:
- Is illegal
- Depends on people and has limits
- Is never tested
- Is always too costly
Show the answer
B. Human error, collusion and management override can defeat it.
Section B style: written questions
Question 13 (10 marks). State and explain five objectives of internal control.
Show the marking guide
Award 1 mark for each objective stated and 1 mark for its explanation, up to 10. Objectives: to safeguard assets from theft, loss and misuse; to keep complete and accurate records so that financial statements are reliable; to promote efficient and effective operations; to ensure compliance with laws, regulations and policies; and to prevent and detect fraud and error.
Question 14 (20 marks). At Adaeze Supplies, one clerk raises purchase orders, receives the goods, records supplier invoices and signs cheques. The owner never checks the bank statements.
(a) Identify and explain five weaknesses in the internal controls and recommend a control for each. (10 marks)
(b) Distinguish between internal audit and external audit. (6 marks)
(c) Explain why internal audit must be independent. (4 marks)
Show the marking guide
(a) 10 marks. For each of five weaknesses, 1 mark for the weakness with its risk and 1 mark for a matching control. For example: one clerk performs all the steps, so fraud could be hidden, so segregate the duties. Cheques are signed by one person, so require a second signatory. No bank reconciliation, so errors go undetected, so reconcile monthly and review.
No matching of documents, so match the invoice, order and goods received note before payment. Weak owner supervision, so review reports and make surprise checks.
(b) 6 marks. Three differences, 2 marks each, covering purpose, who appoints and receives the report, scope, and legal requirement.
(c) 4 marks. Independence lets auditors report without fear or favour (1). It stops managers from influencing findings about their own areas (1). It makes the reports credible to the board and the audit committee (1). Internal audit should therefore report to the audit committee and have no operating duties in the areas it audits (1).
A further written question
Question 15 (10 marks). Explain the importance of ethics to a professional accountant.
Model answers
Show the model answer to Question 13
Five objectives of internal control. Efficient conduct of business: processes run smoothly and without disruption. Safeguarding assets: tangible and intangible assets are used for proper purposes and protected from loss, theft and misuse. Preventing and detecting fraud and other unlawful acts: even small firms can be victims. Completeness and accuracy of the financial records: accurate statements need reliable records of the transactions that took place.
Timely preparation of financial statements: so that the firm can meet its legal duty to file accounts and give management useful information.
Show the model answer to Question 14
(a) Weaknesses and controls. (1) One clerk raises orders, receives goods, records invoices and signs cheques: no separation of duties. Control: split the functions among different people. (2) Orders are raised without independent approval. Control: numbered orders approved by a manager, with limits. (3) The person receiving goods is also the one who ordered and records them. Control: a goods received note signed by an independent person.
(4) A single person signs cheques. Control: two signatories or dual authorisation for payments above a limit. (5) The owner never checks bank statements, so errors or fraud go unnoticed. Control: regular bank and supplier statement reconciliations, prepared by someone other than the cheque signatory and reviewed by the owner.
(b) Internal and external audit. Internal audit is performed by or for the organisation, reports to management or the audit committee. Aims to improve controls, risk management and efficiency across the business. External audit is carried out by an independent auditor appointed by the shareholders, reports to them, and aims to give an opinion on whether the financial statements are true and fair, as required by law.
(c) Independence. Internal auditors review other people’s work, including management’s. If they were under the control of the managers they review, or audited their own work, their findings could be biased or suppressed. Independence, secured by reporting to the audit committee and having no operational duties, lets them report honestly, and gives the board confidence in the assurance.
Show the model answer to Question 15
Ethics matters to the professional accountant in four ways. First, accurate financial reports: ethical accountants do not manipulate figures to make the position look better than it is. Second, accountability and trust: investors, lenders and the public rely on accounts being transparent and accurate, and a firm known for manipulation loses trust and may face legal penalties.
Third, prevention of fraud and financial crime: trained accountants who act ethically spot and report suspicious activity. Fourth, integrity and professionalism: ethical firms attract and keep honest, skilled staff, which brings stability and better performance.
Pathfinder on internal control and internal audit
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
Tests internal audit: five types, five formal objectives and five key roles. Revise the types table, the objectives and the roles in the Exam focus section.
Revise first: Exam focus: internal control and internal audit answers
Tests internal control: five areas it strengthens, four fundamental concepts, three examples of access control and five objectives. Revise the Exam focus section.
Revise first: Exam focus: internal control and internal audit answers
Tested the audit committee and access controls. Revise the audit committee in the board topic and the access control examples.
Revise first: Exam focus: internal control and internal audit answers
Multiple-choice questions can test types of control, segregation of duties and the difference between internal and external audit. Check Section A of every diet you practise for items on these points.
Revise first: Types of control
Source: ICAN Pathfinder, Business Environment. Diets covered: May Diet, 2021 to May Diet, 2026. November Diet, 2024 is not yet mapped.
Spotted a mistake? Tell us and we will check it.
