Internal Control

Internal control is the overall system of processes, policies, and activities that help an organization achieve its objectives in operations, reporting, and compliance.

It includes control environment, risk assessment, control activities, information and communication, and monitoring. Frameworks like COSO describe how these pieces fit together.

Security and compliance controls are part of the broader internal control system and should be designed with the organization’s objectives and risks in mind.