Improving control design and execution with frameworks, matrices, and checklists

Maintaining effective internal controls in your organization requires discipline and consistency. When done well, the resulting control environment supports informed decision-making, financial integrity, and overall operational resilience. For teams already fluent in the basics of internal controls, such as internal auditors, risk managers, control assurance teams, and SOX practitioners, this article provides a more in-depth exploration of the practical application of the tools we use to design and assess controls. We’ll discuss best practices for selecting a control framework, building an internal risk and control matrix, and properly using an internal control checklist. The article also includes real-world internal control examples across finance and operations, sample internal control checklists for control owners, and a guide for strengthening controls as the organization matures.

• Choosing an internal control framework
• Internal controls examples in finance, operations, and IT  
• Appropriate use of internal controls checklists  
• Components of a mature internal controls environment
• Building a mature control environment

Just like working with a framework, building an effective internal control matrix should incorporate your organization’s specific needs. While you can find static libraries for risks and controls, you should always update these to reflect your environment.

Appropriate use of internal controls checklists

For control owners and operators, internal controls checklists are a critical tool for consistency. Often, they are expected to run the same report with the same parameters, or generate a list of users, capture specific screenshots, and perform these tasks for multiple controls simultaneously. They rely on internal controls checklists to ensure they complete these tasks completely and accurately. In practice, the control owners may have both high-level and detailed internal controls checklists to help track monthly, quarterly, and annual control activities. Below are several internal control checklist examples.

Components of a mature internal controls environment

An effective internal controls environment matures over time when we use tools like frameworks, matrices, and checklists consistently. At first, we should take care to balance expected results with feasibility for the control owners and operators. If the controls are over-designed or constructed in a way that makes the execution too burdensome, then the owners will lose patience and the process could fail. Implementing the internal controls best practices listed below as a playbook for improvement will help you build a sustainable, mature controls environment.

• Tone at the top and middle. As PWC points out, “Your organization’s decision makers define the [internal control] culture.” Leaders should consistently advocate for effective internal controls, with managers reinforcing this message through their daily actions, like bringing the controls team into conversations early when processes are likely to change.
• Organizational accountability. Responsibilities should be documented, with control ownership assigned at the role level, not to individuals, with back-up coverage defined. Performance goals should also be linked to control performance.
• Transparency and training. Team members should be educated to understand why the controls exist and receive training on both the policy and the practical steps to execute and evidence the control performance.
• Policies and procedures. Policies should be concise, current, and accessible, with version control and effective dates. Standard operating procedures (SOPs) can include screenshots, decision criteria, and examples of acceptable evidence.
• Monitoring and remediation discipline. Organizations should conduct regular self-assessments, internal audits, and review analytics to surface issues early. Then, any remediation actions are tracked to completion, validated, and shared so other teams can learn from these corrective actions as well.

As these internal controls best practices are applied consistently, we are setting clear expectations with the control owners. Then, we can push for further improvements for more effective internal controls. For example, we might start by developing a manual process for quarterly user access reviews for critical applications. If we introduce automation that improves accuracy and reduces the workload for control owners, we can also expand the scope of the evaluation to include additional applications. While making this change, we would ensure buy-in from management, train the team on the new process, update the procedures, and review the new process for any corrective actions that are needed. In this example, we expand the scope of an existing control while refining its execution, and we follow our playbook for consistent, continuous improvement.

Building a mature control environment

Internal controls best practices include using the tools we have to design better controls, linking our objectives, risks, and controls together, and providing actionable guidance to the business. For professionals who manage internal controls, the differentiator is consistency in control design, gathering evidence, and in how we learn from exceptions. When you align the business objectives with a thoughtfully designed control environment that is attainable by the control owners, and then apply continuous improvement over time, you create a control environment that matures naturally and stands up under scrutiny.