Preventing fraud through internal control

Abstract

In the past decades, companies have come to a better understanding of the risk of fraud. During the same time, appreciation of internal control has increased. The degree of internal control varies, however, between companies. Even though previous research has indicated that internal control offers a tool for fraud prevention, studies have shown that there are companies that use ineffective controls.

The objective of this thesis was to increase the understanding of how companies use internal control to minimise the risk of internal fraud in a European context. In addition, effectiveness of different types of controls was researched; areas for improvement were also considered. Semi-structured interviews were used as the research method. Both internal and external stakeholders were interviewed to obtain a broader understanding of the topic.

The results show that the level of internal control and the types of controls vary based on a company’s size, industry and level of risk. Some basic controls, such as access rights controls and segregation of duties, are, however, found in almost all companies. Automated and built-in controls combined with the right company culture and ‘tone at the top’ were considered the most effective controls. Ignorance and overreliance on ineffective controls and on certain individuals were considered factors that weaken internal control. The results indicate that adaptation of the internal control to each company as well as regular monitoring and assessment of the controls could improve internal control.