What is a system of internal control?

Section 16 of the PGPA Act requires accountable authorities to establish, implement and maintain appropriate systems of risk oversight and management, and internal control, for their entity.

Internal controls are governance arrangements, processes, policies, practices, systems, and other measures that provide reasonable assurance that the entity will:

• achieve its purposes and intended outcomes
• comply with relevant obligations, including the finance law
• use and manage public resources properly (that is, effectively, efficiently, economically and ethically), and
• sustain and improve performance.

Internal controls are the practical mechanisms through which an entity manages risk, shapes expected behaviours and embeds accountability into day-to-day operations to enable the achievement of the entity’s purposes.

Operating together as a system of internal control, these arrangements provide reasonable – but not absolute – assurance to the accountable authority that the entity is well governed, managing its risks, achieving its purposes, delivering intended outcomes, complying with relevant obligations and using public resources properly. An effective system of internal control also supports:

• efficient and effective delivery of programs and functions
• sound decision-making
• compliance with law, and
• evaluation and continuous improvement.

In practice, an effective system of internal control is the foundation of resilient organisations and a strategic asset. It helps an entity anticipate and respond to risk, maintain public trust, support informed decision-making and demonstrate the highest standards of integrity. Mature systems appropriate to the size and context of the entity, provide:

• strong governance structures and accountability arrangements, including clear and independent challenge and oversight mechanisms
• effective escalation pathways so emerging issues, control failures and integrity concerns are identified early and acted on promptly, supporting a culture of integrity and stewardship in which concerns can be raised safely, assessed objectively and addressed before they affect outcomes or trust
• risk management frameworks that translate strategic and operational risks into practical controls, assurance activity and management action underpinned by clear communication of risk appetite and tolerance that guides decision-making, escalation and organisational behaviours
• a reasonable basis of assurance that officials are acting consistently with relevant legislative, regulatory and policy frameworks under which the agency functions,
• transparent reporting that provides insight into performance, risk, control effectiveness and areas requiring attention.

Risk management and oversight and internal control

Section 16 of the PGPA Act requires an accountable authority to establish and maintain:

• an appropriate system of risk oversight and management, and
• an appropriate system of internal control.

These are distinct but inseparable obligations. A system of risk oversight and management helps an entity understand and respond to uncertainty that may affect achievement of its purposes and outcomes. A system of internal control encompasses the broader set of governance arrangements, processes and controls that provide reasonable assurance the entity will achieve its objectives, manage risks appropriately, comply with its obligations and use public resources properly. Together, the two systems form an integrated framework for governance, performance, risk management and accountability.

The diagram below shows how risk management and internal controls work together as part of an entity’s system of internal control.

Links to other PGPA obligations

The system of internal control is also closely linked to other requirements of the PGPA framework – including requirements for accountable authorities to:

• govern their entity in a way that promotes the proper use and management of public resources, the achievement of the purposes of the entity and its financial sustainability (section 15 of the PGPA Act)
  • for non-corporate Commonwealth entities, this includes ensuring that the entity operates in a way that is not inconsistent with government policy (section 21 of the PGPA Act)
• establish an audit committee (section 45 of the PGPA Act; section 17 of the PGPA Rule)
• measure and assess performance against purposes (section 38 of the PGPA Act; section 16F of the PGPA Rule)
• implement a fraud and corruption control framework (section 10 of the PGPA Rule).

Accountable authorities should regularly evaluate and continuously improve the entity’s governance, risk and control frameworks, including ensuring appropriate processes are in place to monitor and respond to recommendations from internal audit, the audit committee, the ANAO, parliamentary processes and other external oversight bodies.

Accountable authorities have a duty under section 17 of the PGPA Act to work collaboratively and support the proper use and management of public resources across government, rather than creating unnecessary burdens on others. This means accountability does not require an entity to deliver everything in-house; entities can rely on shared services and portfolio arrangements, provided responsibilities, oversight and assurance mechanisms are clearly understood and maintained.

The PGPA Act gives accountable authorities flexibility to establish a system of internal control that is appropriate for their entity, having regard to the entity’s operating context, environment, size and risk profile. As a result, there is no single approach to establishing an effective system of internal control. Entities should draw on a range of relevant guidance, frameworks and better practice approaches to design and maintain a system of internal control that is appropriate to their circumstances.

A system of internal control refers to a group of controls within an entity rather than a single control. Controls rarely operate on their own. Instead, they work together as a system that more effectively mitigates risks.

One illustrative model is the Internal Control – Integrated Framework (Committee of Sponsoring Organisations of the Treadway Commission, 2013), which describes 5 integrated and interconnected elements that work together to provide reasonable assurance that an entity will achieve its objectives and intended outcomes. While not intended to be prescriptive, the framework provides a useful illustration of the key elements commonly found in an effective system of internal control.

1. The control environment
2. Risk assessment
3. Control activities
4. Reporting and accountability mechanisms, and
5. Monitoring activities, including audit, assurance and oversight.

The control environment establishes the foundation for effective internal control. It includes leadership, governance arrangements, organisational culture, accountability, ethical standards, integrity arrangements and the way responsibilities and authority are assigned. A strong control environment sets the tone from the top, establishes expectations about behaviour and decision making, and promotes a culture that supports compliance, stewardship and integrity.

Risk assessment involves identifying and analysing risks that may affect the achievement of objectives and intended outcomes. It enables the entity to understand the nature and significance of risks and determine what controls are needed to manage them within its risk appetite and tolerance.

Control activities (individual internal controls) are the policies, procedures and practices implemented to manage risk and support the achievement of objectives. They may be preventative, detective or corrective in nature and can include approvals, delegations, reconciliations, system controls, segregation of duties, monitoring activities and quality assurance processes. The PGPA Act requires that these include measures directed at ensuring officials of the entity comply with the finance law.

Reporting and accountability mechanisms ensure that relevant, reliable and timely information is available to support decision-making and accountability. This includes communicating responsibilities, expectations and control requirements, as well as reporting information about risks, performance and control effectiveness to the appropriate people.

Monitoring and assurance activities assess whether the system of internal control continues to operate effectively. This includes ongoing management oversight, periodic reviews, assurance activities undertaken by audit committees and internal audit, and external oversight including through external audit or parliamentary processes. These activities provide entities with an opportunity to identify strengths and weaknesses to inform the balancing of resources for controls, respond to changes in the operating environment and continuously improve their system of internal control to ensure they remain fit for purpose.

Common internal controls include:

• delegations, authorisations and directions (such as accountable authority instructions)
• governance structures and committees
• risk management frameworks
• policies and procedures
• record keeping and reporting requirements
• review and oversight processes
• integrity arrangements, such as conflict-of-interest processes, gifts and benefits frameworks, fraud and corruption control measures, and avenues for reporting concerns
• controls embedded within the entity’s information technology (IT) systems, including business process rules, security settings and access controls.

As better practice, accountable authorities may also consider:

• establishing an internal audit function to support the audit committee
• issuing accountable authority instructions
• maintaining a clear authorising environment, including delegations and approvals
• prescribing officials where required under the PGPA framework
• fostering a culture that promotes integrity, ethical conduct and accountability that supports the effective operation of the entity’s system of internal control.

The relevance and form of these controls will depend on the entity’s context.

Commonwealth entity internal control systems should also consider accountability to the Parliament and external oversight bodies that help maintain public trust. This includes recommendations from parliamentary committees, the Australian National Audit Office (ANAO) and integrity agencies such as the Commonwealth Ombudsman and the National Anti-Corruption Commission (NACC). Entities should have appropriate arrangements in place to monitor the implementation of agreed recommendations directed at the entity, as well as broader recommendations that may be relevant to their operating context. Audit committees and internal audit programs also play an important role in providing assurance over an entity's response to external oversight and the implementation of agreed recommendations (RMG-202 Audit Committees provides further guidance, as well as a model charter for audit committees).

The PGPA Act provides flexibility for accountable authorities to implement a system of internal control that they consider to be appropriate in the context of their entity. This involves forming a holistic, evidence‑based judgement about whether the system is fit-for-purpose, risk-based and proportionate to the entity’s operating environment and provides the accountable authority with reasonable - not absolute - assurance that the entity will achieve its objectives.

An appropriate system of internal control:

• aligns with the entity’s purposes and functions
• reflects the entity’s size, structure and operating environment
• manages key risks in a way that is consistent with the entity’s risk appetite
• supports compliance with finance law and other legislative obligations
• promotes integrity, accountability and ethical behaviour throughout the entity
• is clearly documented and understood
• operates as intended (or includes escalation pathways where controls are not operating as intended), and
• is regularly reviewed and improvements made as needed.

There is no single model that suits all entities and the presence of a policy, framework, committee or process does not, by itself, demonstrate effective control. To confirm the system of internal control remains appropriate, the accountable authority could consider:

• testing whether controls are clearly linked to key risks and whether there is reliable evidence that they operate as intended in practice
• drawing on internal audit findings and management reporting
• reviewing incidents or control failures, and
• conducting periodic reviews.

A practical test is whether the entity can clearly explain:

• which key risks each major control addresses, and
• how the entity knows the control is fit for purpose and is operating effectively.

Internal controls should be reviewed regularly to ensure they remain fit for purpose and operate effectively. Audit committees and internal audit functions play an important role by:

• reviewing systems of risk oversight, management and internal control
• assessing whether controls have been implemented and are operating as intended
• identifying areas for improvement.