What is the primary purpose of internal controls within an organization?

• A. They compromise the integrity of an organization.
• B. They conclude that employees that steal from a job can go undetected.
• C. They are designed for accounting departments only.
• D. They protect an organization from risk, and therefore, physical controls and IT controls are used.

Answer: (D)

Internal controls are put in place to reduce risk across the organization by safeguarding assets, ensuring reliable financial information, and promoting compliance with laws and policies. The primary purpose is to protect the organization from risk through a mix of physical controls (such as securing access to cash, inventory, and facilities) and IT controls (like user authentication, appropriate access rights, audit logs, data backups, and change management). These controls help prevent errors and fraud, detect problems when they occur, and provide a mechanism to correct them, not just within the accounting function but across operations. Separation of duties and defined approvals further limit opportunities for misuse and improve information accuracy. In short, internal controls are about protecting the organization and its information systems from risk, rather than enabling theft, being limited to accounting, or existing only for the accounting department.