Importance, objectives and types of internal control

Two companies have the same sales of ₦5 billion. In the first, every invoice is approved by one person, entered by another and banked by a third, and a manager reviews exceptions every week. In the second, the owner's brother does all three tasks and nobody reviews anything.

An auditor who tests the second company's transactions as thoroughly as the first's will waste time, and an auditor who relies on the second company's records as much as the first's will be wrong. Internal control is what allows the auditor to tell the two apart and to plan the audit around the difference.

This topic covers the meaning and objectives of internal control, who is responsible for it, how the auditor uses it, the difference between an internal control system and internal controls, the types of control and the choice between a systems-based and a transactions-based audit. The next two topics cover the components of control and the control activities.

Key terms in plain English

Syllabus check

This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:

• the meaning, objectives and nature of internal control
• the types of internal control and who is responsible for them
• the main components of internal control

CAMA 2020 and internal control

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

The auditor's assessment of internal controls

International Standard on Auditing (ISA) 315 requires the auditor to assess risk at the financial statement level and at the assertion level. ISA 330 then requires a response. The overall responses were covered in the topic on audit risk. At the assertion level the response is the choice of audit procedures, which depends on the assessment of both inherent risk and control risk.

The auditor's assessment of internal controls therefore decides the approach to the audit.

The meaning of internal control

COSO describes internal control as a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in three categories:

1. effectiveness and efficiency of operations;
2. reliability of reporting; and
3. compliance with applicable laws and regulations.

Three points follow. Management must design and put in place a suitable system. The controls deal with financial, operational and compliance risks. And because management sets the controls, the auditor must accept what controls exist. The auditor can assess and evaluate them and plan the audit on that assessment.

Responsibility for internal control

The board and management are responsible for designing, implementing and maintaining internal control, which includes preventing and detecting fraud and error. The directors identify the risks to the business and design controls to deal with them. Those charged with governance, in a public company the audit committee, review whether the system works. Internal audit helps by monitoring, as an earlier topic explained.

The external auditor does not design or operate the controls. The auditor obtains an understanding of the controls that are relevant to the audit, evaluates their design and whether they have been implemented, tests them where the auditor wants to rely on them, and reports significant deficiencies to management and those charged with governance.

Under section 404(7)(d) of the Companies and Allied Matters Act 2020 (CAMA 2020), the audit committee of a public company keeps the effectiveness of the system of accounting and internal control under review.

The May 2026 examination described New Breath Bank Plc where an internal audit department existed but did only compliance reviews, there were no strong risk management processes, and the auditors found irregular loan approvals and significant non-performing loans. Candidates were asked to assess the control weaknesses and explain the responsibilities of management and auditors in instituting and assessing internal control under ISA 315 (Revised).

The answer is that management and those charged with governance are responsible for designing and operating the controls and for risk management, while the auditor is responsible for understanding the controls relevant to the audit, assessing the risk of material misstatement and responding to it.

Weaknesses in the example are the narrow scope of internal audit, the lack of a risk management process, poor control over loan approvals (an authorisation and credit control weakness), weak monitoring of non-performing loans and a weak control environment around regulatory compliance.

How the auditor uses internal controls

Modern auditing is, wherever possible, systems-based. The auditor relies on the accounting systems and related controls to make sure that transactions are properly recorded. The assumption is that if the systems and controls are adequate, transactions will be processed correctly, so the emphasis is, as far as possible, on the system and not on the individual transactions.

Before relying on the controls the auditor must establish what they are and evaluate their effectiveness, and first test them to check that this approach is valid. The effectiveness of a control system depends on two things:

• Design: is the system able to prevent material misstatement, or to detect and correct it if it occurs?
• Implementation: are the controls operated properly by management and staff?

The result of the evaluation helps the auditor to assess control risk, a key element of the audit risk model.

Tests of controls or substantive tests?

All internal control systems have inherent limits, and controls can never be perfect. The Turnbull Report on Internal Control in the United Kingdom says that a sound system reduces, but cannot eliminate, the possibility of poor judgement in decision-making, human error, processes being deliberately circumvented by employees and others, management overriding controls, and unforeseeable circumstances. The auditor therefore cannot rely on controls completely.

The auditor must test the underlying control systems with tests of controls and also carry out some substantive procedures on transactions and balances.

The overall flow is: planning and risk assessment, then assess the controls. If they are assessed as strong, test them and perform reduced substantive testing. If weak, perform extensive testing. Either way, finish with an overall review of the financial statements and issue the report.

The internal control system and internal controls

The Turnbull Report defines an internal control system as the policies, processes, tasks, behaviours and other aspects of a company that, taken together:

• help it to operate effectively and efficiently by responding appropriately to significant business, operational, financial, compliance and other risks to its objectives, including safeguarding assets from inappropriate use, loss and fraud, and making sure liabilities are identified and managed;
• help ensure the quality of internal and external reporting, through proper records and processes that produce a flow of timely, relevant and reliable information from within and outside the organisation; and
• help ensure compliance with applicable laws and regulations and with internal policies on the conduct of business.

Internal controls are part of the system, but the system is more than the controls. It includes culture, attitudes and the way the board and management behave.

Types of control by purpose

Controls can also be manual or automated, and may be pervasive (such as the control environment) or specific to a transaction type (such as matching an invoice with a goods received note).

Why internal control matters to every party

For the entity, good control protects assets, improves the reliability of reports, reduces fraud and keeps the business within the law. For the shareholders and lenders, it increases confidence in the reported figures. For the regulator, it is evidence of sound governance. For the auditor, it is the basis for deciding how much substantive testing to do.

This is why an auditor who finds weak controls reports them to management, and why the management letter, covered in a later topic, is one of the most useful products of an audit.

Worked examples

1. Controls are weak, so control risk is high.
2. The auditor cannot rely on them and uses a transactions-based approach with extensive substantive testing.

1. (a) Preventive.
2. (b) Detective.
3. (c) Directive.

1. The design is adequate: the policy would prevent misuse.
2. Implementation fails: the control is not operated.
3. Control risk is high until the practice is corrected.

1. Management and the board are responsible for designing and operating controls.
2. The auditor assesses them and reports significant weaknesses, but does not run the system.

How to score full marks

• Quote the COSO definition with its three objectives.
• State that management is responsible and the auditor evaluates.
• Link the strength of controls to the audit approach.
• Say that controls give reasonable, not absolute, assurance.

Common mistakes in the exam

• Saying the auditor designs or operates the control system.
• Saying strong controls remove the need for substantive testing.
• Confusing design with implementation.
• Saying controls give absolute assurance.

Quick revision

• Control is a process giving reasonable assurance on operations, reporting and compliance.
• Management designs; the auditor assesses.
• Effectiveness = design and implementation.
• Strong controls: systems-based; weak: transactions-based.
• Types: preventive, detective, corrective, directive.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.