What internal control is: the main components

The words "internal control" remind many people of a security department or an inspector. In fact it is the set of rules and habits inside a company that prevent errors, spot them quickly when they happen and correct them. In a warehouse with well-run internal control, trusting the storekeeper's honesty is not enough on its own, because the system is built so that an error or abuse cannot stay hidden. In international practice internal control is usually divided into five components (the COSO model). Let us look at them as they apply to a warehouse.

1. The control environment

This is the tone set by management. If the owner takes goods without documents, telling staff "do not release anything without documents" is pointless. The environment includes: authority and responsibility set down in writing (who answers for what), staff made familiar with the rules, and consequences when rules are broken. Job descriptions and a financial liability agreement belong in this layer. In practice it looks like this: the warehouse manager presents a variance report to the owner every month, the rule is the same for everyone including the owner, and no one may move goods without documents.

2. Risk assessment

What can go wrong in the warehouse and how much damage it would cause: a delivery not counted at receiving, expired goods, abuse in write-offs, unauthorised access. The risk list is refreshed at least once a year, especially when a new product group, a new warehouse or a new program appears. If the flow of online orders doubles, for example, the risk of picking errors grows too. The assessment itself is not a big job: a sheet of paper and two questions ("what could happen?" and "how much would it cost?") are enough to begin.

3. Control activities

These are concrete actions against errors. They fall into three kinds:

• Preventive: two people at receiving, restricted permissions in 1C, a separate zone for valuable goods, a key log.
• Detective: cycle counts, a weekly variance report, a monthly review of stock adjustments.
• Corrective: what happens when a discrepancy is found, meaning investigation, documentation and removal of the cause.

Relying on detective controls alone can be too late: the error has already happened. The best results come from all three kinds working together. Follow one item through: at receiving two people sign (preventive), a different employee enters it in 1C (segregation of duties), one pallet is recounted every week (detective), and if a gap appears the cause is written down within 24 hours and an owner is named (corrective). If every link does its job, the error is stopped halfway. Even a small Telegram-shop warehouse run by one person can have controls: a camera, a short weekly count and the owner looking at the 1C report.

4. Information and communication

Employees must know exactly what to do, when and with which document. That requires written instructions, data entered into 1C or Excel correctly and on time, and an open route for reporting problems. Important messages should not get lost in a Telegram group: a non-conformity is logged and assigned to a responsible person. A new employee goes through a short briefing on receiving, issuing and stock adjustment on day one and signs it, so there is no room left for "nobody told me".

5. Monitoring

Is the control working? That is shown by the monthly variance report, internal or external audit, and follow-up on earlier recommendations. A control can go out of date within a year: the range has changed, staff have turned over, and the rules are still the old ones. Monitoring catches that gap in time.

Five questions for a quick self-check:

1. Is there a written instruction for every position?
2. Can you name your three biggest risks?
3. Is at least one control assigned to each of them?
4. Do staff know these rules and follow them in practice?
5. When was the control itself last tested?

Conclusion

The five components depend on one another: the environment sets the tone, risk assessment says what to protect, control activities how to protect it, information makes sure everyone understands, and monitoring checks it all works. In a review, OmborAudit helps examine the warehouse's current position against exactly these five layers and find where the gap lies.