Internal Control and a Process: The Difference

By Charles Hall | Accounting and Auditing

May 08

What is the difference in an internal control and a process? Most accounting directions do not clearly define what a control is. So it can be difficult to sift through a thick accounting manual and identify key controls. Below, I help you distinguish between controls and processes. Why? So you can see the controls that are relevant to your audit.

The Difference in a Control and a Process

Processes and Controls in Risk Assessment

As you perform your annual walkthroughs, you determine if the company's internal controls are designed properly and if they are implemented. But what are internal controls? And how do they differ from processes?

Processes are the primary actions performed by accounting personnel. For example, a cashier receives payments and places them in a cash drawer.

Controls are the actions that ensure accuracy and safety. A business can receive payments without controls. But monies might be stolen or amounts might be recorded incorrectly. In short, accounting controls lessen misstatements in the financial statements.

In performing risk assessment, you consider whether an account balance or transaction might be misstated, whether by error or fraud. And how do you do this? By performing certain procedures such as reviewing the internal control system. This is why it's important to know what the key controls are.

Below I provide examples of cashier processes and internal controls. Why? To help you distinguish between the two.

Cashier Processes

Remember a process is what is being done. The purpose of the process, in this example, is to receive and process payments.

The cashier's work manual might direct the processes as follows:

  • Take your cash drawer from the vault each morning
  • Turn on your computer by 7:50 a.m. to ensure it is working properly
  • Open your station at 8:00 a.m. 
  • Press the f7 key before entering the receipt
  • Ask customers to place their credit cards into the credit card machine at your window
  • Press the f3 key when the receipt entry is complete

Now, let's look at sample internal controls.

Cashier Internal Controls

The accounting manual might spell out the following controls (this list is not comprehensive):

  • No purses or handbags are allowed in the cash collections area
  • Station security cameras record all activity; retain video for at least one month
  • No person receiving cash can write down or eliminate receivables (of if they can, a second person reviews and signs off on all adjustments)
  • The receipts software flags all amounts greater than $1,000 (most receipts are less than $500)
  • Only one cashier can work from a cash drawer; the cashier must lock his or her drawer upon leaving their station and must log out of their computer
  • Cashiers issue a receipt for each payment received
  • The cash supervisor observes the daily closeout count of one cashier at least once per week
  • The cash supervisor creates the daily summary deposit and provides the same to the courier for delivery to the bank

And what risks are lessened with these controls? Errors and theft.

Notice the segregation of duties. And notice the second-person reviews. The design of the system lessens the potential for misstatements.

Some controls may sound like policies such as no purses in the collection area. But what is the purpose of the requirement? To lessen the potential for theft. So I consider this a control. Granted, the distinction can get blurry. 

Also notice that some controls are automated such as the entry flag for amounts greater than $1,000. The purpose of this control is to lessen data entry error.

(By the way, new receipting technology is available to lessen theft, increase accuracy of data entry, and speed the deposit process. See the article How You Can Help Limit Retail Theft and Streamline Daily Accounting.)

Difference in Internal Controls and Processes

In summary, we see that a processes are the actions performed to get something done. Cashiers receive and process payments. By contrast, controls ensure that the resulting numbers are correct and that assets are secure from theft. 

Understanding the differences in controls and processes helps you identify key controls. And why is this important? So you can clearly see key controls while performing audit risk assessment.

Control Risk Assessment

See my article titled Audit Risk Assessment: The Why and How for additional information about control risks. If you desire to test controls for effectiveness, see Test of Controls: The Why, How, and When.

Learn from my CPA Hall Talk newsletter!

Get my free accounting and auditing digest with the latest content.

Powered by ConvertKit

About the Author

Charles Hall is a practicing CPA and Certified Fraud Examiner. For the last thirty years, he has primarily audited governments, nonprofits, and small businesses. He is the author of The Little Book of Local Government Fraud Prevention and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events. Charles is the quality control partner for McNair, McLemore, Middlebrooks & Co. where he provides daily audit and accounting assistance to over 65 CPAs. In addition, he consults with other CPA firms, assisting them with auditing and accounting issues.