Accounting technology / Glossary / Internal controls (ICFR)

What are internal controls over financial reporting?

Definition

Internal controls are the policies, procedures and checks a company uses to make its financial reporting reliable, protect its assets and comply with rules. Internal control over financial reporting, or ICFR, covers the controls that prevent or detect material errors in the financial statements, such as approvals, reconciliations, segregation of duties and system access limits.

Also calledICFRinternal control over financial reportingfinancial controls

Compare the softwareBest audit software →All 8 audit vendors →

Framework: COSO 2013: 5 components
US public companies: Sarbanes-Oxley Section 404
UK listed companies: Provision 29 from 2026

How internal controls are designed and assessed

Most companies design controls with the COSO Internal Control framework, updated in 2013, which sets out five components: control environment, risk assessment, control activities, information and communication, and monitoring, supported by 17 principles. Controls are preventive, such as approval before payment, or detective, such as a monthly reconciliation, and manual or automated within systems. In the US, Section 404 of the Sarbanes-Oxley Act requires public company management to assess ICFR every year, and larger companies' auditors to report on it as well. In the UK, Provision 29 of the 2024 Corporate Governance Code asks the boards of companies reporting against the Code to declare whether their material controls were effective at the balance sheet date, for periods beginning on or after 1 January 2026. Workiva, FloQast and BlackLine document controls and evidence; MindBridge tests transactions against them.

Common questions

What is the difference between preventive and detective controls?+

Preventive controls stop an error or fraud happening, such as requiring approval before a payment. Detective controls find it afterwards, such as a reconciliation or a review of unusual journals.

What is a material weakness?+

A deficiency, or combination of deficiencies, in internal control over financial reporting that gives a reasonable possibility that a material misstatement will not be prevented or detected in time. US public companies must disclose material weaknesses.

Do private companies need internal controls?+

They have no SOX requirement, but every company needs controls to produce reliable accounts and prevent fraud. Lenders, investors and buyers expect them, and auditors assess them when planning their work.