Internal Controls
- Myths & Facts

Because there are many misconceptions about internal controls, knowledge sharing is vitally important to an effective control system. Part of the educational process is to dispel the myths about internal controls. Here are a few myths and the corresponding facts:

Myth

Fact

Internal controls result from a
strong set of policies and procedures (i.e., "If a policy doesn't exist, we don't have to do it").

Internal controls are based on a strong control environment and
solid business practices that, in most cases, will be supported by policies; however, lack of formal policies does not preclude good business practices.

Internal controls? That's why we have internal auditors.

Management and departmental
personnel are the owners of internal controls.

Internal controls are all about finance and accounting. We do what the Office of Financial Affairs or the Department of Finance tells us to do.

Internal controls are integral to
every aspect of business.

Internal controls are essentially negative, like a list of "thou shalt nots."

Internal controls make the right thing happen the first time.

Internal controls are a necessary evil. They take time away from our core activities and responsibilities.

Internal controls should be built into, not onto, business processes.

If controls are strong enough, we can be sure that errors and irregularities will always be detected.

Internal controls provide
reasonable, but not absolute, assurance that the organization's objectives will be achieved.