The Five Components of Internal Control

Believe it or not, internal control is your job, too! In fact, it is mandated by the Budget and Accounting Procedures Act of 1950, which required agencies to establish systems of internal control. The Federal Managers Financial Integrity Act of 1982 strengthened this system by requiring agency heads to report annually according to prescribed internal control standards and guidance of the Government Accountability Office (GAO) and Office of Management and Budget (OMB). There are five components of internal control, 17 associated principles, and 47 attributes. This article will focus primarily on the five components.

Control Environment

The first component, the control environment, is probably the most important of the five standards because it impacts all the others. In fact, the control environment is the foundation. It has five principles pertaining to setting the tone at the top, demonstrating a commitment to competence, and establishing oversight, structure, responsibility, and enforcing accountability. Think of the difference between parents who set and enforce ‘house rules’ on things like homework, social media access, bedtime, etc., and those that do not. Generally, the former produces better outcomes.

Risk Assessment

The second component, risk assessment, has four principles that address defining objectives, identifying, analyzing, and responding to all types of risk and change. Managers have a responsibility for not only identifying risk but establishing the level of risk they are willing to accept. For example, if the agency goal is an 85 percent customer satisfaction rate, the agency is willing to accept 15 percent of customers being unsatisfied — the risk tolerance level.

Control Activities

The third component is control activities. As the name suggests, the three associated principles pertain to designing and implementing control activities. Think of control activities as the policies, procedures, and mechanisms put in place to accomplish agency objectives. For example, if your objective is to keep your home and family safe, locking the doors and installing a security system would be examples of control activities.

Information and Communication

The fourth component, information and communication, has three principles of which processing data into quality information and communicating to both internal and external audiences are hallmarks. “Seven times, seven ways” is sometimes used to describe how management must continually understand their audience and communicate both internally and externally to stakeholders. Townhall meetings, intranet, email, focus groups, and surveys are examples of how this might be accomplished.


The final component, monitoring, has two principles outlining responsibilities for monitoring and correcting deficiencies. Think of the start of a new year and new year’s resolutions. Many people set goals to get in shape and lose weight. Let’s say you start the year off at 174 pounds and have a goal to get to 150. That means you need to lose 24 pounds or about 2 pounds a month on average. Suppose you set this goal but never weigh yourself at the start of the year, or during the year for that matter. You could likely end the year weighing more than 174 pounds. An effective monitoring system requires one to establish a baseline (identify your starting point) as well as periodic and recurring monitoring (daily, weekly, monthly, quarterly, etc.) so that adjustments can be made along the way to reach the established milestones and goals.

Where should I begin?

Here are a few resources that you can go to right now to get closer to meeting your professional objectives related to internal control.

Written by:
Joe Ward
Financial Management



Media Type:
Internal Control  

Free eBook: What You Need to Know About Evaluating Federal Candidates
Lead with Hope and Optimism During COVID-19