The title is misleading: the internal controller does not control employees, and is neither an internal auditor nor a statutory auditor. Their job is to design, document and keep alive the controls that allow a company to manage its risks: making sure an invoice is not paid twice, that inventory does not disappear without being recorded, that an employee cannot both create a supplier and approve its payment. They work in a finance department, a risk department or a compliance department, alongside operational staff. This article describes who does what between internal control and audit, the processes reviewed, the deliverables of the job, the COSO framework explained simply, the profiles recruited and the words that count on a CV.
Internal control, internal audit, external audit: who does what
Three functions are concerned with a company’s internal control, each in its place. The IFACI, the French institute of internal audit and control, presents them through the three lines model.
The first line: operational staff. Purchasing, sales, logistics, payroll or treasury teams carry out controls day to day: matching an invoice with a purchase order, approving a payment, counting inventory.
The second line: risk and control oversight functions. This is where the internal controller sits, alongside risk management and compliance. They design controls, help operational staff apply them, check that they work and manage action plans.
The third line: internal audit. Reporting to the highest level, often to the audit committee, internal audit independently assesses the whole system, through one-off engagements, and makes recommendations.
Outside: the statutory auditor. They certify the accounts and, in doing so, assess the internal control that contributes to financial information. They communicate their findings in a management letter, but are not part of the system.
In short: the internal controller builds and runs; the internal auditor assesses; the external auditor relies on the system to certify the accounts.
The processes reviewed
The internal controller works by process. The most common in an industrial or retail company:
- purchasing and payments: supplier creation, orders, receipt, matching invoices with orders, payment approval;
- sales and collections: customer creation, pricing terms, invoicing, credit notes, collection;
- inventory: receipts and issues, stock counts, differences, impairments;
- payroll and HR: joiners and leavers, payroll variables, access to data;
- treasury: bank mandates, reconciliations, transfers;
- accounting close: manual entries, analytical reviews, account reconciliations;
- information systems: access management, segregation of duties in the ERP, change management.
In a bank or an insurer, the processes and risks are sector-specific (credit granting, anti-money laundering, underwriting) and the regulatory framework is more demanding.
Control matrices and testing: the heart of the job
An internal controller’s day-to-day work is organised around a few deliverables, which make up the substance of their CV.
The risk map. With the departments concerned, the internal controller identifies the risks of each process and rates them, generally by impact and likelihood. The risk map is updated every year and presented to senior management or the audit committee.
Process narratives and flowcharts. They describe who does what, with which tool, and when. This is the basis for spotting where a control is missing.
The risk and control matrix. For each risk, it shows the control that covers it, its owner, its frequency, whether it is manual or automated, and the evidence expected. A well-made matrix can be used by an operational employee who sees it for the first time.
Design and operating effectiveness tests. The design test checks that the control, as described, would indeed cover the risk; the operating effectiveness test checks, on a sample of real cases, that it was actually applied. For example: on a sample of payments, checking that each was approved by an authorised person other than the one who entered the invoice.
Self-assessment campaigns. In groups, subsidiaries assess their own controls using a questionnaire, and the internal controller then checks some of the answers against supporting documents.
Action plans. Each weakness identified leads to an action, with an owner and a deadline. The internal controller monitors implementation and reports on progress.
The COSO framework explained simply
The most widely used internal control framework in the world is COSO’s, which the IFACI has published in French. It defines internal control as a process carried out by governance, management and staff to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.
COSO describes five components, which form a simple analysis grid:
- the control environment: culture, integrity, organisation and responsibilities;
- risk assessment: identifying and analysing what could prevent objectives from being achieved, including fraud;
- control activities: the controls themselves, manual or automated;
- information and communication: getting the right information to the right people;
- monitoring activities: continuously assessing the system and correcting deficiencies.
In France, the financial markets authority (Autorité des marchés financiers, AMF) has published a reference framework on risk management and internal control systems, recommended to listed companies, which is consistent with these principles. Subsidiaries of US-listed groups also apply the requirements of the Sarbanes-Oxley Act on internal control over financial reporting.
Profiles recruited and career moves
The most common profiles:
- former external auditors, after two to five years in a firm, who know how to assess the internal control of cycles and write recommendations;
- graduates of master’s programmes in audit, accounting-control-audit or business schools with a specialisation in audit and control, for junior positions;
- accountants or management controllers who know the company’s processes well.
Career moves:
- head of internal control for a group, then director of internal control or risk;
- moving to internal audit, for a more cross-cutting and independent approach: the corresponding profile is presented on the internal auditor CV example 🔗 page, which describes conducting engagements under IIA standards;
- returning to operational finance (financial control, a head of accounting role) with a strong process culture.
The words that count on an internal controller’s CV
A recruiter reading an internal controller’s CV looks for deliverables, a scope and a framework. The terms that recur in job adverts are fairly stable:
- risk map, risk and control matrix, key controls;
- design and operating effectiveness tests, self-assessment, action plans;
- segregation of duties, access management, ERP;
- COSO, the AMF reference framework, Sarbanes-Oxley for subsidiaries of US groups;
- second line, audit committee, reporting.
But these words are only worth something if they are backed by facts. Compare:
- Before: “Implemented and monitored internal control.”
- After: “Built the risk and control matrices for 9 processes (135 key controls documented) and ran two self-assessment campaigns a year across 14 European subsidiaries.”
The internal controller CV example applies these principles to a profile who came from external audit. To prepare for the next step, our article on internal control interview questions groups questions by theme, and the audit CV method recalls how to showcase firm experience. For formatting, the CV editor structures this information and produces a PDF readable by recruiters’ screening software, which often filters on these precise terms.
Sources
- IFACI, internal control: everything you need to know 🔗 and summary of the COSO internal control integrated framework 🔗.
- Autorité des marchés financiers, reference framework for risk management and internal control systems 🔗.
- Onisep, internal auditor job profile 🔗.
Frequently asked questions
What is the difference between an internal controller and a management controller?
The management controller steers performance (budgets, variances, profitability); the internal controller makes sure processes are under control and risks are covered by controls. Both often work in the same finance department.
Do you need a certification to be an internal controller?
It is not compulsory. IFACI training and IIA certifications are valued, especially for moving towards internal audit or a head of function role.
Does internal control exist in SMEs?
Yes, but often without a dedicated position: the finance manager or head of accounting plays the role. Internal controller positions are mainly found in mid-market companies, groups and regulated sectors.
Can a junior start directly in internal control?
It is possible, especially after a specialised master’s and an internship in an internal control department. Many employers nevertheless prefer a first stint in external audit.