What are internal controls?

‘Internal controls’ are the processes, systems, records and activities that entities design, implement and maintain to provide reasonable assurance they are achieving their organisational objectives regarding:

• reliability of financial reporting
• effectiveness and efficiency of operations
• compliance with applicable laws and regulations.

Collectively, each entities' governing body and executive management is responsible for preparing reliable financial statements in accordance with generally accepted accounting principles. They are similarly responsible for maintaining effective internal controls over financial reporting.

QAO's assessment of internal controls

The auditing standards require us to understand and assess the aspects of entities' internal controls that relate to our financial statement audit objectives. We firstly seek to understand and evaluate how entities have designed and implemented their controls. We communicate our results to each entity in their external audit plan.

If we decide we can rely on an entity's controls, we must then test them to confirm they operated effectively. The results may highlight deficiencies, which we assess to determine if they constitute, individually or in combination, a significant deficiency in internal control.

Limitations of our reporting on internal control deficiencies

No system of internal control can provide absolute assurance about the absence of error or compliance. Even in the absence of identified control weaknesses, inherent limitations in an entity's internal controls over financial reporting may not prevent or detect material misstatements.

Internal control assessments

Our assessment tool for internal controls is available on our website for entities to use. The assessment tool is scalable to an entity's size and complexity, is principle-based, and will help entities identify opportunities to improve the efficiency and/or effectiveness of their controls. For more information, please see our detailed fact sheet.