Internal controls: Hard-won lessons from annual reviews

Each year, SEC-reporting companies are required under SOX Section 404(a) to evaluate and report on the effectiveness of internal control over financial reporting (ICFR). As SOX testing, operational internal audits, and external audit efforts conclude, a familiar question emerges: What did we actually learn and how should that change the way we approach the year ahead?

Many organizations operate with overly complex or misaligned control frameworks, and annual control reviews are where those design decisions are tested in practice against the current risk profile.

Late winter into early spring typically marks the end of the control testing cycle for the prior year. Testing is complete, findings are issued, and attention shifts toward the next annual risk assessment. This moment is one of the most valuable opportunities to step back and reassess how well controls align with today’s risk environment, not last year’s.

Across industries, annual reviews continue to surface the same lessons. The difference between those that improve year after year and those that repeat the same issues often comes down to how seriously those lessons are addressed.

What Annual Reviews Consistently Reveal

While the specifics vary by industry and organization size, annual control testing tends to surface recurring themes. Manual controls, spreadsheet-based reconciliations, and approvals occurring outside of core systems continue to drive audit findings and increased scrutiny.

Over-Controlled vs. Under-Controlled Areas

Is effort aligned to risk, or are resources misallocated?

Control issues are often symptoms, not root causes. Breakdowns frequently stem from upstream process design issues, unclear roles and responsibilities, or reliance on compensating controls within the same process stream. When an early control fails, downstream checks are often relied on to catch errors rather than addressing the underlying risk.

As a result, annual testing frequently reveals environments with too many controls addressing low-risk activities, while higher-risk or rapidly changing processes receive insufficient attention. Across industries, this imbalance shows up through:

• Redundant controls addressing the same risk
• Control fatigue in low-risk areas
• Gaps in high-risk or rapidly changing processes

One of the most effective outcomes of annual testing is identifying opportunities for control rationalization, validating whether the structure itself is still appropriate for the current risk profile. Control rationalization helps focus effort on key risk drivers, eliminating low-value activities, and improving overall effectiveness.

Design vs. Operating Effectiveness

Are the right controls designed and operating as intended?

A common surprise for management is discovering that controls that exist on paper are not consistently executed in practice. This often shows up as:

• Reliance on informal processes rather than clearly defined procedures
• Manual controls that depend on individual judgment or spreadsheets
• Variability in how controls are performed across departments

These gaps almost always trace back to risk alignment, with too many controls concentrated in low-risk areas and insufficient focus where risk is highest or actively changing.

Documentation and Evidence Challenges

Are controls provable and auditable, even when performed?

In many cases, controls are performed but not documented in a way that supports audit reliance. Inconsistent evidence standards across departments create unnecessary friction during audits and erode confidence in the control environment, even when underlying processes are otherwise sound.

Why the Same Control Issues Persist Year After Year

More often, repeat issues signal deeper challenges, such as:

• Lack of clear ownership or accountability
• Limited follow-through on remediation efforts
• Weak risk culture or inconsistent tone at the top

As boards and regulators place greater emphasis on transparency and timely insight, these gaps become more visible. Control environments increasingly struggle when performance is only evaluated after the fact rather than monitored in real time. Without timely reporting and clear escalation, issues persist unnoticed until annual testing resurfaces the same findings again.

Ultimately, the first line of defense is the individual performing the activity. When those responsible do not understand why a control exists or how it ties too overall risk, it becomes easier for execution to slip, especially during periods of change.

Change Is the Biggest Underestimated Risk Driver

Growth, mergers, restructuring, system implementations, and regulatory shifts all materially change an organization’s risk profile. Yet many annual risk assessments still rely on prior-year structures, assumptions, and conversations with the same stakeholders.

Emerging technology, particularly AI introduced in isolated pockets, adds new dimensions of operational, compliance, and data risk that not all control frameworks have absorbed yet.

A “rinse and repeat” approach to risk assessment year over year often creates a growing disconnect between where controls exist and where risk is creeping up.

Refreshing the Risk Assessment for the Year Ahead

Annual testing should feed directly into an updated risk assessment that considers both internal and external change. An effective reassessment typically revisits:

• Inherent risk, reflecting exposure from business, economic, and regulatory changes
• Control effectiveness, evaluating whether controls prevent, detect, or correct issues in a timely manner
• Residual risk, identifying what remains after controls are applied
• Risk appetite, assessing what level of residual risk is acceptable to management

For many organizations, major events, such as system implementations, regulatory thresholds, rapid growth, or new technologies, should automatically trigger a reassessment. In response, some are moving beyond annual cycles entirely and incorporating quarterly updates to avoid blind spots.

Refreshing the assessment also benefits from broader input. Incorporating additional perspectives, including new stakeholders or external viewpoints, can help identify risks that long-standing processes and assumptions no longer capture.

These efforts directly influence audit outcomes. Auditors are most comfortable relying on internal controls when they see consistency: consistent execution, consistent documentation, and clear linkage between risk, controls, and outcomes. Inefficiency often arises when evidence standards vary or when processes are overly manual and disconnected from systems.

Investing time upfront to align oversight with current risk and clarify expectations for control owners can lead to smoother audits, increased operational efficiency, and improved risk visibility.

We Can Help

What differentiates mature organizations is not the absence of issues, but how effectively those insights inform control design and risk oversight going forward. Annual reviews provide the evidence needed to determine whether controls should be refined, automated, retired, or redesigned altogether.

Strong governance frameworks are necessary for trust, transparency, and long-term success. The most effective environments treat the end of the annual cycle not as a finish line, but as a reset, realigning controls to risk, strengthening accountability, and using lessons learned to build a more resilient and efficient framework.

At Elliott Davis, our team helps organizations prepare for external audit by identifying practical improvement opportunities across governance, processes, and reporting, including the ability to:

• Evaluate the current internal controls framework
• Identify gaps in risk assessment, control activities, and monitoring
• Enhance reporting processes and reduce manual effort
• Align oversight mechanisms with business goals and regulatory expectations
• Support leadership with actionable insights and practical solutions

Contact us today to get started.

‍

The information provided in this communication is of a general nature and should not be considered professional advice. You should not act upon the information provided without obtaining specific professional advice. The information above is subject to change.