Internal control
Also known as: Control activity, Mitigating control, Safeguard
An internal control is a specific policy, procedure, or technical safeguard designed to mitigate risk and ensure an organization meets its objectives. These controls are used to prevent errors, detect fraud, and protect assets from unauthorized access. They provide reasonable assurance that operations remain consistent and compliant with applicable laws and regulations.
In practice
Auditors verify internal controls by testing their design and operating effectiveness through evidence such as system logs or approval signatures. For example, a practitioner might review a change management log to ensure every software update was approved by a manager before being deployed to production.