Companion Guide to Video August 2012

www.fhwa.dot.gov/federal-aidessentials

Internal controls are a series of 

processes and procedures that can 

help your agency ensure that its 

activities comply with all laws, 

regulations and accepted practices.

Internal controls are essential to the proper 

management and operation of any organization.

All personnel in your organization play important 

roles in supporting internal controls, but 

management is responsible for designing and 

implementing the controls based on related cost 

and benefits. Management also sets the 

objectives, puts the control mechanisms and 

activities in place, and monitors and evaluates the 

controls.

The principal objectives of internal controls are to 

ensure the effectiveness and efficiency of 

operations, reliability of financial reporting, and 

compliance with applicable laws and regulations. 

In addition, Federal-aid recipients, whether 

grantees or sub-grantees, should ensure that 

transactions are properly recorded and accounted 

for; transactions are executed in compliance with 

the provisions of the grant – and that those funds, 

property, and other assets are safeguarded against 

loss from unauthorized use, transfer, exchange, 

sale, or disposal.

The Committee of Sponsoring Organizations of the 

Treadway Commission developed the most widely 

used Internal Control-Integrated Framework in the 

United States, known as the COSO Framework. 

Public and private organizations use this 

framework to design, implement, and evaluate 

controls that facilitate management and 

compliance with regulations.

The five components of the COSO 

Framework include the Control 

Environment, Risk Assessment, 

Control Activities, Information and 

Communication, and Monitoring.

These five components provide a clear and 

effective means to implement and analyze the 

internal controls of an organization.

Let us look at each component, starting with the 

Control Environment. Management and

Finance

Internal control

Introduction to Internal control

Certain processes and procedures can help your agency ensure 

its activities comply will all laws, regulations, and accepted 

practices
Federal-aid Essentials for Local Public Agencies

employees should have a positive and supportive 

attitude toward internal controls.

Management should convey integrity and ethical 

values and ensure they are not compromised;

have a commitment to the competence of its

staffs by improving their skills, knowledge and 

experience; have a philosophy and operating style 

appropriate to the development and maintenance 

of effective internal control; ensure the 

organizational structure and assignments of 

authority and responsibility contribute to 

effective internal control; and monitor oversight 

groups to ensure all audit reports and 

communications are received and all findings and 

recommendations are adequately addressed.

All organizations and agencies have a purpose or 

goal, and they achieve these goals by fulfilling 

specific objectives. However, a risk can endanger 

achieving an objective. Risk Assessment 

is the process used to identify, 

analyze, and manage potential 

risks. Risk identification methods may include 

qualitative and quantitative ranking activities, 

management conferences, forecasting and 

strategic planning, and consideration of previous 

audit findings.

Risk analysis methods may include prioritizing the 

probability and rate of occurrence, evaluating the 

vulnerability of assets to any threats, and 

estimating the quantitative and qualitative costs 

of those potential threats on assets or operations. 

Risk management methods may include 

monitoring the situation, minimizing the risk, 

taking preventive or corrective action, and 

continually or periodically reassessing the risk.

Control Activities include policies, procedures, 

techniques, and control mechanisms developed 

and implemented to ensure that your 

organization's directives are followed. Specific 

Control Activities should be 

established in every area and 

department to ensure these 

directives are applied consistently.

Some examples of Control Activities are: 

Access Control provides the access a person may 

have to an asset or resource. Examples are 

permission or controls to limit access to records 

and documents, buildings and offices, and 

information systems.

Segregation of Duties reduces the risk of error or 

fraud by one person. Your organization should 

have adequate segregation of duties in review and 

authorization of transactions. 

Authorization Control allows only authorized 

employees to execute and review specific 

transactions. For example, a clerk may have 

reviewer authority while a supervisor would have 

sole approval authority.

Completeness Control verifies that all pertinent 

transactions are processed. 
Federal-aid Essentials for Local Public Agencies

Accuracy Control verifies that transactions are 

accurate and calculated using acceptable 

methodologies.

An organization’s information and communication 

systems must convey information clearly, 

completely and in a timely manner. Information 

may be shared formally, such as reporting to 

management or other agencies, or it may be 

shared informally, perhaps as a communication 

with a supplier, customer or internal employees. 

Whatever the form, the information should be 

identified, captured, and communicated in a way 

and time that give people the means to fulfill their 

duties.

Monitoring is a continuous process that assesses 

the performance quality of the five internal 

control components over time. Monitoring 

determines if internal controls are present, 

sufficient and effective.

External audits, reviews and internal assessments 

are forms of Monitoring. Any findings, 

observations or recommendations from 

monitoring activities should be addressed 

promptly. One of the most important 

concepts to remember is that 

internal control is a process, not a 

single event, regulation or form.

Internal controls are an ongoing process that 

involves everyone in an organization and provides 

reasonable assurance that all objectives are met. 

Because factors outside the control or influence of 

management can affect the agency's ability to 

achieve all of its goals, no matter how well 

designed and operated, internal control cannot 

provide absolute assurance that all objectives will 

be met.

Your agency and staff are responsible for 

understanding and implementing internal control. 

Your agency will benefit from implementing 

internal controls that allow for effective and 

efficient operations, increase the reliability of 

financial reporting, and ensure compliance with 

applicable laws and regulations.

For more information about internal controls, 

contact your State department of transportation.
Federal-aid Essentials for Local Public Agencies

The content of this 

document is not a 

substitute for 

information obtained 

from State departments 

of transportation, 

appropriate FHWA 

Division Offices, and 

applicable laws. 

Scenarios have been 

simplified for emphasis 

and do not necessarily 

reflect the actual range of 

requirements applicable 

to the scenario or this 

topic. This document

was created under 

contract number 

DTFH63-11-F-00026 by 

the Federal Highway 

Administration, U.S. 

Department of 

Transportation, and is 

offered to the public to 

heighten and focus 

awareness of Federal-aid 

requirements within the 

local public agencies 

community and 

reinforces the 

importance of these 

necessary policies, 

procedures, and 

practices.

This Companion Resource 

is the script content for 

the video production of 

the same name. 

Additional Resources

• GAO standards for internal control 

http://www.gao.gov/products/AIMD-00-21.3.1

• OMB Circular A-133 Compliance Supplement, Part 6, describes 

characteristics of internal control

http://www.whitehouse.gov/omb/circulars_default