Limitations of Internal Control

Every company or business around the world operates in a risky environment. These risks can be internal, such as risks of operations or processes not going according to plan. Similarly, these risks can also be external and caused by several factors. Some of these which dictate risk are political, environmental, technological, economic, social, or legal factors. While most internal risks are in the control of a company, some external ones may not be. For companies to be profitable, they must ensure there is a proper system to manage these risks.

The main reason why companies would want to manage their risks is for their operations to run smoothly. It is one of the reasons why companies are profitable. However, risks always exist that some obstacle or problem may arise which disrupts their operations. Through these, companies may suffer adverse financial performance or losses to their assets. Overall, companies must have systems in place to detect, prevent, or control these risks.

The system that allows companies to do this and achieve much more is known as internal controls.

What is Internal Control?

Internal controls refer to systems, rules, or procedures that companies implement to ensure proper risk management. Through internal controls, companies can ascertain the integrity of their financial and accounting information, prevent fraud, safeguard their assets, promote accountability, ensure compliance with laws and regulations, and much more. The internal control systems that a company puts in place can be the differentiating factor between its success and failure.

Internal control systems are crucial for several reasons. Firstly, a proper internal controls system facilitates an effective or increase the effectiveness of the operations of a company. It achieves that by allowing the company to respond to any risks promptly to achieve its objectives. Through this, internal controls can help safeguard the company’s assets and identify and manage liabilities.

Similarly, internal controls can improve or maintain a standard for the quality of external and internal reporting within a company. It does so by helping companies maintain proper records and processes that can help in the smooth flow of timely, relevant, and reliable information from both external and internal sources.

READ:  The Audit Procedures for Loan and Advances: Practical Guides

Apart from these, internal controls can also ensure that companies comply with relevant laws and regulations. In the absence of such internal control systems, companies may not identify these regulations on time and be subject to fines and penalties.

What are the inherent limitations of internal control?

Internal control systems can help companies prevent losses promptly. Apart from these, a proper system of internal controls can provide them with many more benefits. However, internal controls aren’t perfect and can’t always work. There are several limitations of internal controls of which companies and users must be aware.

Some of the most common limitations of internal control are as below. While these include a few top problems with internal control, they do not represent an exclusive list of all its limitations.

1. Reasonable Assurance

First and foremost, the biggest limitation of internal control is that it does not provide reasonable assurance. Internal controls are effective in preventing, detecting, and rectifying problems. However, they do not detect and prevent all the cases in which problems may exist. Some companies may expect internal controls to work almost all the time. However, that cannot be true.

Due to this reason, internal controls can have more limitations. There are always going to be unforeseen circumstances that internal controls for which internal controls compensate. In contrast, if internal controls provided absolute assurance, then most of the other limitations of internal controls would not exist.

2. Collusion by Two or More Employee

One of the most common internal controls that companies utilize is the segregation of duties. It allows them to use various employees in a process to ensure an individual employee cannot commit fraud. However, employees may still go around this type of control by teaming with others in the process and concealing their frauds. By colluding with others, employees can easily render segregation of duties ineffective.

Collusion in the workplace isn’t uncommon. There have been instances in the past where employees have committed fraud by cooperating with others in committing fraud. While companies may introduce internal controls at several steps, they cannot prevent employees from pairing up and committing fraud together.

READ:  Audit Procedures for Testing Impairment of Investment

3. Human Error

Another limitation of internal controls is that it depends on human input. Due to this, internal controls may be prone to human error. While some internal controls may validate human input, they cannot possibly detect every instance when a human error may occur. Therefore, internal control does not work well when there is a chance of a human error occurring during the process.

Even the most well-designed and well-thought-out internal control can succumb due to human error. It is why internal control systems that limit human control or automate the process are more successful in the long run.

4. Inappropriate Management Override of Controls

Similarly, internal controls have an inherent limitation when it comes to overriding control. The control environment of a company dictates how its management and employees see internal controls. If the management of a company overrides the internal control systems in place, then having these systems is futile.

Furthermore, it creates a ripple effect where employees also see internal controls as unnecessary and forego these controls. Some companies even allow their top-management to neglect these internal controls, which limits its effectiveness severely.

5. Poor or Improper Judgment from Management

Poor judgment can also be a critical limitation of internal controls. Usually, the management of a company makes decisions based on the information provided to them. However, if the information is not adequate, it may end up in the wrong decisions from the management. Judgment is a vital part of internal control systems.

Many companies base their internal controls on professional judgment. If these judgments are compromised, they may end up in a company using the wrong internal control systems, which results in an ineffective process.

6. Cost and Benefit Consideration

Full implementation of control as well as properly segregation of duties require high cost to carry out. Thus, sometimes the costs may outweigh the benefits; especially for small companies.

Therefore, by considering this cost and benefit, some control or proper segregation of duties might not be properly carried out.

7. Improper Communication or Training

Sometimes, employees may circumvent the internal control process. It may occur due to several reasons, for instance, inappropriate control environment. Similarly, it may occur due to improper communication with employees about their roles in the internal control systems. Furthermore, improper training to employees about internal control systems may also limit its effectiveness.

READ:  What is Planning Materiality and Tolerable Misstatement?

The effectiveness of internal controls relies heavily on the competence of the employees of a company. If the employees do not know their roles or do not deem internal controls are necessary, they will never follow the controls put in place for them.

8. Unforeseen Circumstances

The process of internal controls depends on the management of a company forecasting all the risks that may occur and introducing systems to prevent or control them. However, the management cannot foresee all possible problems or circumstances. There will always be random variables or events that can render internal controls futile.

These circumstances may come from different sources, either internal or external. However, when these events take place, internal controls cannot prevent them. Similarly, making controls for these circumstances can also be costly if they rarely occur. Therefore, in unforeseen circumstances, internal controls may have limited use.


Internal controls consist of processes, mechanisms, and procedures put in place to safeguard a company’s assets, ensure the integrity of its financial statements, help in risk management, and much more. While internal controls are necessary for every company, they might have some limitations. Some of the most common limitations of internal controls include providing reasonable assurance, collusion, human error, control override, poor judgment, cost and benefit consideration, improper communication to or training of employees, and unforeseen circumstances.

You can also read the book on “Executive’s Guide to COSO Internal Controls, 1st Edition” to get to understand more about the COSO framework of internal controls.

The book will give you a better understanding of the step-by-step guide on installing and implementing effective internal controls.

Executive's Guide to COSO Internal Controls
Scroll to Top
Scroll to Top