In Summary
- Internal controls are formal systems, processes, and policies, based on models like the COSO Framework, that help organizations of all sizes protect assets, ensure financial accuracy, and, most importantly, catch fraud and errors sooner, with global data showing that a lack of controls leads to a large percentage of fraud cases.
- The most effective internal controls involve segregation of duties (dividing transaction responsibilities), approval processes, fraud reporting systems (which account for 43% of detections), and employee training, all of which must be consistently monitored and applied to prevent fraud, the median loss of which is substantial for private companies.
─────────────────────────────────────────────────────────────────
Denver businesses lose billions each year to fraud, waste, and avoidable mistakes. In many cases, stronger internal controls could have made a difference. These safeguards help organizations protect assets, keep financial reporting accurate, and catch problems early, before they lead to larger issues. Internal controls aren’t just for large corporations. They’re a practical tool for organizations of all sizes. Still, many small and mid-sized businesses operate without a clear framework in place, leaving gaps that can be costly. The Association of Certified Fraud Examiners (ACFE) estimates that organizations lose about 5% of revenue to occupational fraud every year. In its 2024 Report to the Nations, that loss totaled more than $3.1 trillion worldwide. For a smaller business, even one incident can have a serious financial and reputational impact. To help clients, prospects, and others, Hanson & Co has summarized the key details below.What Are Internal Controls?
Internal controls are the systems, processes, and policies an organization uses to reduce risk. They help ensure that information is accurate, resources are used appropriately, and day-to-day activities align with broader goals. These controls can be as straightforward as requiring two signatures on a check or as sophisticated as using real-time data monitoring software. A widely used model for understanding internal controls comes from the COSO Framework, which groups controls into five key categories:- Control environment — The ethical tone set by leadership.
- Risk assessment — Identifying where the organization is most vulnerable.
- Control activities — Policies and procedures that mitigate those risks.
- Information and communication — Ensuring data flows to the right people.
- Monitoring — Ongoing evaluation to confirm controls are working as intended.
Why Internal Controls Are Important
Internal controls are only effective when they’re actively applied and monitored. Without consistent follow-through, even well-designed systems lose the ability to reduce risk. Global fraud data shows the impact of weak or missing controls. According to the 2024 report, 32% of fraud cases stemmed from a lack of internal controls, while another 19% involved someone overriding the controls that were in place. In both situations, breakdowns in oversight allowed problems to escalate undetected. When controls are functioning as intended, they help organizations catch issues early and limit financial damage. On average, fraud cases lasted 12 months before detection, but companies with stronger internal controls were able to identify problems sooner and experienced lower losses. Beyond fraud prevention, a strong internal control environment supports accurate financial reporting, streamlines operations, and builds trust with key stakeholders, including board members, investors, and lenders.Examples of Internal Controls
Internal controls can be scaled to fit any organization. Some of the most effective and commonly used include:- Segregation of duties — Dividing responsibilities so that no one person controls a full transaction helps reduce the risk of error and fraud.
- Approval processes — Requiring documented sign-off for expenses, vendor setup, or payroll changes adds oversight.
- Bank reconciliations — Comparing internal records to bank statements helps catch discrepancies early.
- Fraud reporting systems — Hotlines or web-based tools give employees a way to speak up. In 43% of cases, fraud is detected through tips.
- Employee training — Organizations without fraud awareness training experience nearly twice the losses of those with it.
- Surprise audits and reviews — Regular checks of payments, inventory, or financial activity help deter fraud and uncover issues.
- Conflict-of-interest policies — Requiring disclosure of outside business relationships can reduce the risk of corruption.
- Risk assessments — Evaluating where the business is most vulnerable helps prioritize controls.
Risks of Operating Without Internal Controls
Weak or missing internal controls can result in significant financial and operational losses. According to the data, privately held companies account for a large share of reported fraud cases, with median losses around $150,000. Nonprofit organizations tend to see smaller losses on average but still face meaningful exposure. Executives have been responsible for the highest losses, more than seven times greater than those caused by employees. In many cases, the damage goes unrecovered. A majority of victim organizations (57%) are unable to recoup any of the stolen funds. Fraud often affects multiple areas of the business. The most common sources include operations, accounting, sales, customer service, and upper management. In 38% of cases, multiple types of fraud occur at once, often combining asset misappropriation with corruption or financial statement manipulation. Most fraudsters (84%) display at least one behavioral red flag, such as financial pressure, a desire to control processes, or signs of living beyond means. Without strong internal controls and a culture of accountability, these red flags are much more likely to be missed.Practical Next Steps for Business Leaders
Business owners and executives can take several practical steps to strengthen internal controls and reduce risk:- Evaluate current risk areas — Begin by reviewing who has access to financial systems and how key transactions are authorized, recorded, and reviewed.
- Implement or strengthen basic controls — Simple steps such as setting approval thresholds, conducting regular financial reviews, and providing employee training can help reduce exposure to fraud and error.
- Establish a confidential reporting process — A hotline, email address, or web-based reporting tool gives employees a safe way to raise concerns and plays a key role in early detection.
- Monitor for red flags — Behavioral cues, signs of favoritism, or unusual transactions should be taken seriously and addressed promptly.
- Benchmark the internal control program — Tools such as heat maps and industry case profiles can help assess whether current controls are effective and aligned with emerging risks.