Pages Menu
Categories Menu

Posted by on Jul 13, 2020

The Five Components of Internal Control

The Five Components of Internal Control

5 stars on a red background

Believe it or not, internal control is your job, too! In fact, it is mandated by the Budget and Accounting Procedures Act of 1950, which required agencies to establish systems of internal control. The Federal Managers Financial Integrity Act of 1982 strengthened this system by requiring agency heads to report annually according to prescribed internal control standards and guidance of the Government Accountability Office (GAO) and Office of Management and Budget (OMB). There are five components of internal control, 17 associated principles, and 47 attributes. This article will focus primarily on the five components.

Control Environment
The first component, the control environment, is probably the most important of the five standards because it impacts all the others. In fact, the control environment is the foundation. It has five principles pertaining to setting the tone at the top, demonstrating a commitment to competence, and establishing oversight, structure, responsibility, and enforcing accountability. Think of the difference between parents who set and enforce ‘house rules’ on things like homework, social media access, bedtime, etc., and those that do not. Generally, the former produces better outcomes.

Risk Assessment
The second component, risk assessment, has four principles that address defining objectives, identifying, analyzing, and responding to all types of risk and change. Managers have a responsibility for not only identifying risk but establishing the level of risk they are willing to accept. For example, if the agency goal is an 85 percent customer satisfaction rate, the agency is willing to accept 15 percent of customers being unsatisfied — the risk tolerance level.

Control Activities
The third component is control activities. As the name suggests, the three associated principles pertain to designing and implementing control activities. Think of control activities as the policies, procedures, and mechanisms put in place to accomplish agency objectives. For example, if your objective is to keep your home and family safe, locking the doors and installing a security system would be examples of control activities.

Information and Communication
The fourth component, information and communication, has three principles of which processing data into quality information and communicating to both internal and external audiences are hallmarks. “Seven times, seven ways” is sometimes used to describe how management must continually understand their audience and communicate both internally and externally to stakeholders. Townhall meetings, intranet, email, focus groups, and surveys are examples of how this might be accomplished.

The final component, monitoring, has two principles outlining responsibilities for monitoring and correcting deficiencies. Think of the start of a new year and new year’s resolutions. Many people set goals to get in shape and lose weight. Let’s say you start the year off at 174 pounds and have a goal to get to 150. That means you need to lose 24 pounds or about 2 pounds a month on average. Suppose you set this goal but never weigh yourself at the start of the year, or during the year for that matter. You could likely end the year weighing more than 174 pounds. An effective monitoring system requires one to establish a baseline (identify your starting point) as well as periodic and recurring monitoring (daily, weekly, monthly, quarterly, etc.) so that adjustments can be made along the way to reach the established milestones and goals.

Where should I begin?
Here are a few resources that you can go to right now to get closer to meeting your professional objectives related to internal control.

Joe Ward is a Management Concepts instructor and the President and CEO of Ward Management Group LLC. He is a retired USAF officer and retired member of the Senior Executive Service. In addition, Joe was an officer with two different global audit and management consulting firms. During his 26 years of service in the Air Force, and for more than a decade since he has provided high-profile leadership in financial management. Joe earned a bachelor of science degree in business administration from Central Connecticut State University and a master of public administration in finance from Troy State University. He is a Certified Defense Financial Manager and Certified Government Financial Manager.


  1. I like your illustrations of how the components of Internal Controls are implemented. They are real and easy to understand. But as a MC Instructor, I have also used the application of employee building passes or system cards as a method of “control activities”. Students may be aware of “passes” but may not understand that these applications are associated with the overall concept of Internal Controls.

Post a Reply

Your email address will not be published.