What is Internal Control?

Internal control is the process by which institutions reach their goals and realize their mission, with the ultimate goal of reducing the uncertainties that may arise during their journey. Internal control empowers management to ensure that institutions are able to cope with ever-changing environmental conditions, demands and priorities of service areas and the risks that may arise in the future or that may create opportunities. In other words, internal control is an integrated process designed to provide reasonable assurance that the organization, management, and staff are alive and well in fulfilling their mission and achieving the specified goals.



Some of the important elements in the definition of internal control are:

1. Internal control is a process. This means that internal control is not an attempted goal. Internal control is a process, not a result. This process is the tool used to achieve the result. Internal control is affected by people. This process is not just policy rules, manuals and instructional texts. People at all levels of the institution are part of the internal control and are responsible for their implementation

2. In achieving the objectives of the internal control institution, it only provides reasonable assurance to the senior management and administrators. The institution is exposed to internal and external factors while moving towards its goal. Employees, who are part of the institution, are examples of internal factors. Personality traits, moral values and competencies of persons are directly related to the effectiveness of internal control. With internal control, it is not possible to completely control the internal characteristics of people. Some of the risks that can be shown as external factors, such as the economic crisis, are impossible to control completely. Internal control therefore provides reasonable assurance, not absolute assurance, for the institution.

  3. Internal control refers not only to financial transactions and reporting, but also to all controls that are applied to compliance and performance measures, including management, administrative processes, strategy and other activities and operations of the institution. In this sense, the internal control is much broader than the previous understanding of only financing control. Internal control should be appropriate to the nature and needs of the institution. This process is the most effective way of realizing the mission of the institutions.


However, the internal control system of each institution is not the same. The institutions and their controls differ according to the sector, organizational structure, corporate culture and management philosophy. Each institution should adapt its internal control structure as a single model. The management should make its own decisions regarding the establishment of the controls to be installed and take into account the specific needs of the institution in the process of adaptation.

Internal control concerns the public sector as well as the private sector. In the private sector, the primary goal of the company is to increase the shareholder value. In the public sector, the goal is usually to achieve a service or achieve a public benefit.

The responsibility of management in the public sector is to use resources and achieve results.

Institutions use an internal control system to achieve their goals. Institutions have four main objectives:

1. Efficiency and productivity of activities

2. The reliability of financial reports

3. Compliance with current legislation


4. Preservation of assets

Efficiency and productivity of activities is related to the basic operational objectives such as the level of achievement of aims, performance, and cost-benefit structure. The reliability of account reports includes temporary and summarized reports, the clear and comprehensible receipt and publication of financial data, and the availability of other relevant information. Compliance with current legislation concerns the harmonization studies that must be carried out to ensure that the activities carried out in order to achieve the institution's objectives are in accordance with the legal procedure. Preservation of assets involves securing all assets that the institution has.

In order for the internal control system to be implemented effectively, internal control should not be viewed as a burden but as a means of preventing losses and assessing opportunities when unexpected events occur. However, the internal control system needs to be understood correctly; the system is not the main activity of the institution and does not perform the functions of the management. First of all, internal control can support the acquisition of institutional objectives and cannot determine which targets will be put in place, even if it is an early warning system against risks that would prevent them from achieving these objectives. Internal control, in the decision-making process, supports the manager with the right information and ensures that the decisions are conveyed, but it cannot take the place of the management about which decisions will be taken. The internal control system operates at different efficiency levels.

How effectively internal control activities are carried out depends on:

* the senior management and administrators’ understanding of the institution, the scope of the activities carried out in order to achieve the objectives, the environment in which the activities take place and the risks to be encountered,


* the responsibility for employees to implement internal control depends on having the necessary knowledge, ability and authority, ensuring that published financial reports are prepared reliably, and ensuring compliance with laws and regulations.

Management takes the greatest role in the effectiveness of internal control. Administrators must establish appropriate policies and provide assurance in order that the internal control system is functioning effectively. When internal control is implemented, uncertainties that affect the achievement of the targets should be foreseen and precautions should be taken; that is, managers are also responsible for risk management.



All staff of the institution aim to fulfill certain activities when performing their duties. These activities combine with other activities of the unit to achieve the unit targets and as a whole, the institutional targets. Personnel is the person who has the most detailed information about the task that he fulfills. He is also responsible for ensuring that this task is carried out in the most efficient manner, as well as for conveying both business-related problems and other problems that the company recognizes to the management. When employees perform their duties, they produce information that will be used in the internal control system and are found in activities that affect controls. For this reason, internal control is everyone's responsibility. Internal audit plays a role in assessing the effectiveness of the internal control system and contributing to the effectiveness of the system.