must help the organisation meet its objectives. They should ensure
that positive results are achieved, not only that negative results
must save more than they cost: they must add value to the
controls is not risk management: it is risky management.
must be at the right stage. It is better for controls to prevent
problems happening at all, rather than detecting them when the loss
has already occurred.
controls are everyone’s responsibility.
controls rely on people. If people are not motivated to implement
and support controls then the internal controls will fail.
Motivating people is an essential part of controls.
and supervisors cannot delegate away their responsibility for
work best when staff are encouraged to comment on and to help
improve the systems
controls work best when the accountabilities are clear.
are not static. As systems change the internal controls should also