Internal Control Analysis

Internal control analysis asks two questions. Was a control designed to stop the problem at issue? And did it actually operate when it mattered? In litigation, the answers often decide who bears a loss, whether an insurer pays, and how much a fraud cost the business.

What internal controls are meant to do

Internal controls are the policies and procedures that protect assets, keep records accurate and support compliance. Most analyses use the COSO framework, which groups controls into five components: the control environment, risk assessment, control activities, information and communication, and monitoring.

For public companies, the stakes are formal. Exchange Act Rule 13a-15 requires management to maintain and evaluate internal control over financial reporting. Private companies have no such rule. Still, the same concepts guide any review of what went wrong.

How an internal control analysis works

A sound review follows a clear sequence:

1. Map the process. Document how a transaction starts, who approves it, how it is recorded and how it is paid.
2. Identify the key controls. These are the points where an error or theft should be caught.
3. Test the design. Ask whether each control, if performed, would prevent or detect the problem.
4. Test the operation. Pull samples and check whether the control was actually performed, by the right person, on time.
5. Assess the gaps. Decide which failures matter and how they connect to the loss.

The difference between design and operation matters. For example, a policy requiring two signatures is well designed. However, if one person routinely signed both lines, the control did not operate.

Internal control analysis in litigation

Control failures appear in many disputes. Common settings include employee theft and embezzlement, claims under fidelity or crime insurance policies, professional negligence claims against accountants, and disputes among business owners. In each, the analysis links specific control gaps to specific transactions.

That link is essential. A general finding that controls were weak proves little. Instead, the report should show which control failed, which transactions passed through the gap, and how much those transactions cost. Our article on fraud prevention and detection covers the investigative side.

Common control weaknesses

Several weaknesses recur across industries:

• One employee who can create vendors, approve invoices and release payments.
• Bank reconciliations prepared by the person who handles cash.
• Payroll changes with no independent review.
• Journal entries posted without approval or support.
• Reviews that are signed off but not actually performed.

From findings to better procedures

After a loss, clients also want to know what to fix. Therefore, a useful internal control analysis ends with practical steps. Typical remediation includes separating incompatible duties, adding independent review of vendor and payroll changes, and monitoring exceptions through routine data tests. Then, management should retest the new controls after a few months to confirm they operate.

These steps also help in negotiation. A defendant company that shows prompt remediation may limit exposure. Similarly, a plaintiff can point to gaps that the other side left open for years.

Next step

If a case turns on how a loss went undetected, we can review the records and outline the testing. Learn more about our forensic accounting work, or read how we approach fraud risk reduction. To begin, send your case file for a preliminary review. We run conflict checks the same business day.