UNDERSTAND THE CONCEPT
Accounting controls help transactions reflect real, authorized activity and support reliable reporting. Preventive controls act before an error occurs, such as approval limits or restricted access. Detective controls identify problems after the event, such as reconciliations and exception reviews. Both need named owners, evidence of operation and a route for resolving findings. A control that exists only in a policy document provides little practical assurance.
Separate incompatible responsibilities where practical, especially supplier changes, payment approval and payment release. Where a small team cannot fully separate duties, design a documented compensating review appropriate to the risk. Reconcile operational records with financial balances and investigate differences instead of repeatedly carrying them forward. Keep access and approval limits current when roles change. Controls provide reasonable assurance rather than a guarantee, and their effectiveness depends on people following them and management responding when exceptions reveal a weakness.
Questions to take back to your team
- Which person owns and evidences each key control?
- Are incompatible transaction responsibilities separated or independently reviewed?
- Are reconciliation differences investigated to closure?
Further reading
Explore the primary references below. Requirements and applicability depend on your organization and jurisdiction.
