They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets, and segregation of duties. Information systems produce reports, containing operational, financial, and compliance-related information that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities, and conditions necessary for informed business decision-making and external reporting. It includes regular management and supervisory activities, and other actions personnel take when performing their duties.
All components are relevant to each objectives category.
When looking at any one category, all five components must be present and functioning effectively to conclude that internal control over operations is effective. Management establishes the goals for the program or department, and determines the policies and procedures which would achieve those goals. As such, management is responsible for the components of its internal control, i.e., establishes a control environment, assesses risks it wishes to control, specifies information and communication channels and content, designs and implements control activities, and monitors, supervises, and maintains the controls. The auditor should gain an understanding of and evaluate the auditee's internal control relative to the audit objectives. The auditor should review our files to determine if an ICQ exists.