Internal Control Concepts

Definition of Internal Control

Internal Control is a process effected by a college or university's governing board, administration, faculty, and staff designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

  • Effectiveness and efficiency of operations.
  • Reliability of financial reporting.
  • Compliance with applicable laws and regulations.

This definition reflects certain fundamental concepts:

  • Internal control is a process. It is a means to an end, not an end in itself.
  • Internal control is effected by people. It's not merely policy manuals and forms, but people functioning at every level of the institution.
  • Internal control is geared to the achievement of objectives in several overlapping categories.
  • Internal control can be expected to provide only reasonable assurance to an institution's leaders regarding achievement of operational, financial reporting, and compliance objectives.

Effective administration involves planning, executing, and monitoring. Internal control is a tool used by administrators to accomplish these processes.

Components of Internal Control

Internal control consists of five interrelated components derived from basic college and university operations and administrative processes as follows:


  • Control Environment - The core of any educational institution is its people. They are the engine that drives the organization. Their individual attributes (integrity, ethical values, and competence) and the environment in which they operate determine the success of the institution.
  • Risk Assessment - Colleges and universities must be aware of and deal with the risks they face. They must set objectives that integrate key activities so the total organization operates in concert. They also must establish mechanisms to identify, analyze, and manage the related risks.
  • Control Activities - Control policies and procedures must be established and executed to help ensure that actions necessary to achieve the institution's objectives are effectively carried out.
  • Information and Communication - Surrounding these activities are information and communication systems. These enable the organization's people to capture and exchange the information needed to conduct, manage, and control its operations.
  • Monitoring - The entire process must be monitored and modified as necessary. Thus, the system can react dynamically to changing conditions.

Effective I/C or ERM means:

  • That management has a “flow of reliable information” about each component of control for all the objectives, from all areas of the organization.
  • “Soft Controls” relate to the people performing the work to meet the objectives of the organization; “hard control” relates to the processes and activities those people do.