These distinct but overlapping categories address different needs and allow a directed focus to meet the separate needs. Internal control systems operate at different levels of effectiveness. Published financial statements are being prepared reliably. Applicable laws and regulations are being complied with. While internal control is a process, its effectiveness is a state or condition of the process at one or more points in time.
Internal control consists of five interrelated components.
These are derived from the way management runs a business, and are integrated with the management process. Although the components apply to all entities, small and mid-size companies may implement them differently than large ones. Its controls may be less formal and less structured, yet a small company can still have effective internal control. It is the foundation for all other components of internal control, providing discipline and structure. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent.