Join the waitlist
Glossary/Risk and controls

Internal control over financial reporting

Internal control over financial reporting is the process that management designs and runs to give reasonable assurance that financial statements are reliable and prepared under the applicable framework.

CORAA TeamUpdated November 5, 2026

Definition

Internal control over financial reporting (ICFR) is a process, effected by those charged with governance, management and other personnel, designed to provide reasonable assurance about the reliability of financial reporting and the preparation of financial statements under the applicable framework. It covers records that reflect transactions fairly, authorization, and prevention or timely detection of unauthorized use of assets that could be material.

Why it matters in an audit or review

In a financial statement audit, the auditor obtains an understanding of ICFR to assess risk and plans reliance only where it makes sense. An audit of ICFR performed together with the financial statement audit, under AU-C 940, adds an opinion on whether controls are effective. For issuers, the auditor's ICFR audit is required for accelerated and large accelerated filers under Section 404(b) of the Sarbanes-Oxley Act and is performed under PCAOB AS 2201. Most private company audits do not include it.

Example

Illustrative: during a private manufacturer's financial statement audit, the team notes that bank reconciliations are not reviewed. The audit gives no opinion on ICFR. Under AU-C 265 the auditor communicates the deficiency in writing if it is a significant deficiency or material weakness, and may mention lesser ones.

Common mistakes

Describing a financial statement audit as an audit of internal control. The financial statement opinion says nothing about whether controls are effective.

Sources

  • AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145)
  • AICPA, AU-C Section 940, An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of Financial Statements
  • AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
  • Sarbanes-Oxley Act of 2002, Section 404(b)
  • PCAOB, AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 315AU-C 940

Related terms

  • COSO framework
    The COSO Internal Control Integrated Framework is the widely used US framework for designing and assessing internal control. It has five components and 17 principles.
  • Control deficiency
    A control deficiency exists when the design or operation of a control does not let management or employees prevent, or detect and correct, misstatements on a timely basis.
  • Material weakness
    A material weakness is a deficiency, or combination of deficiencies, in internal control where there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected on a timely basis.
  • Control environment
    The control environment is the foundation of internal control: the attitudes, awareness and actions of management and those charged with governance about controls and why they matter. The other components rest on it.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required