Who is ultimately responsible for internal control?

The governing body, such as the board of directors, is ultimately responsible for internal control within an organization. This responsibility encompasses the establishment of an effective internal control environment that minimizes risks and enhances the reliability of financial reporting. The governing body sets the tone at the top, emphasizing the importance of internal controls and ensuring that they are integrated into the organization’s overall governance structure.

While management plays a significant role in implementing and maintaining internal controls, and the internal auditor assesses their effectiveness, it is the governing body that has the overarching responsibility to oversee these processes and ensure that adequate controls are in place. Furthermore, independent auditors evaluate the effectiveness of internal controls during their audits, but they do not hold responsibility for their establishment or operation—this responsibility lies with the governing body.

The involvement of the governing body in internal controls ensures accountability and encourages a culture of compliance, risk management, and ethical behavior across the organization.