Internal Controls Against Corruption

Internal controls form the third of the ten components in the Queensland Crime and Corruption Commission's Fraud and Corruption Control Framework. AS 8001:2008 describes internal controls as the "first line of defence" against fraud and corruption, the day-to-day operational safeguards that make wrongdoing harder to commit and easier to detect, as distinct from the higher-level governance and cultural components addressed elsewhere in the framework.

1 Legislative basis

In Queensland, the requirement to maintain adequate internal controls is not merely a matter of good practice but a statutory obligation for public sector entities. The Financial Accountability Act 2009 (FA Act), at section 61, requires accountable officers to establish and maintain appropriate systems of internal control and risk management. The Financial and Performance Management Standard 2009 (FPMS) elaborates on this obligation in several places: section 8 addresses the general internal control framework, section 65 addresses internal audit arrangements, and section 29 addresses risk management, which links directly to the process described in Corruption Risk Management. Section 77 of the FA Act, read with section 57 of the FPMS, deals specifically with the prevention, detection, and reporting of fraud and corruption, making internal control failures in this area a matter of direct legislative non-compliance rather than a purely internal governance shortfall.

2 The control environment

The guide describes the "control environment" as the foundation on which specific controls operate, comprising several interlocking elements. Leadership tone sets the expectations that flow down through the organisation; a leadership team seen to cut corners undermines even well-designed formal controls. Organisational culture, addressed in depth in Organisational Culture Change, determines whether staff feel safe raising concerns and whether informal norms reinforce or subvert formal rules. Reporting structures determine how quickly control weaknesses or suspected wrongdoing reach a level of authority capable of acting on them. Delegations and approval processes fix who may authorise what, at what value threshold, and with what secondary sign-off. Finally, audit and risk oversight, exercised through the structures described in Coordination Mechanisms, provides an independent check on whether the control environment as a whole is functioning as designed.

3 Employment screening

Because many fraud and corruption schemes depend on the trust placed in an individual employee, pre-employment and ongoing screening is treated as a distinct internal control. Queensland's Public Service Directive 07/11 sets out requirements around referee checks and criminal history checks for prospective public service employees, and Chapter 5, Part 6 of the Public Service Act 2008 provides the statutory framework for suitability checks, particularly for positions involving access to vulnerable people, sensitive information, or significant financial delegation. Screening is not a one-off gate at recruitment; agencies are encouraged to consider periodic re-screening for staff who move into higher-risk roles over the course of their career.

4 Types of controls

The guide catalogues several recurring categories of internal control relevant to fraud and corruption. Separation of duties ensures that no single individual controls an entire transaction cycle, from initiation through authorisation to reconciliation, without independent check. Contractor and supplier screening extends the logic of employment screening to third parties who may have access to systems, sites, or funds. Contract management controls, including probity oversight during tendering and active monitoring of contract performance, address the elevated risk identified in procurement functions. Information security controls, aligned in Queensland with the Queensland Government Information Standards, particularly IS18 (Information Security), IS40 (Recordkeeping), and IS31 (Retention and Disposal of Public Records), protect against the misuse or destruction of records that might otherwise evidence wrongdoing.

5 Reference frameworks

The guide anchors its treatment of internal controls in two widely used external frameworks. The Committee of Sponsoring Organizations of the Treadway Commission's Internal Control: Integrated Framework (2004, subsequently updated) provides the conceptual architecture of control environment, risk assessment, control activities, information and communication, and monitoring activities that underlies much of the guide's own structure. Auditing Standard ASA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report, sets out the profession's expectations of external and internal auditors in specifically considering fraud risk during audit planning and fieldwork, reinforcing the link between internal controls and the assurance functions described under Coordination Mechanisms.

6 Limitations of controls

The guide is explicit that internal controls, however well designed, have inherent limitations. Collusion between two or more staff members can defeat separation-of-duties controls that assume a single dishonest actor. Controls are also subject to a cost-benefit calculus: an organisation cannot economically control every conceivable risk, and some risks are knowingly left less controlled because the cost of tighter control exceeds the expected loss. Finally, controls decay over time as systems change, staff turn over, and informal workarounds accumulate, meaning a control that was effective when designed can silently stop functioning as intended.

The Queensland Audit Office's Fraud Risk Management report (Report 9, 2013) responded to this decay problem by recommending that agencies adopt regular, ongoing data analytics as a complement to static manual controls, using techniques capable of detecting anomalous transaction patterns that point-in-time control testing would miss. This recommendation prefigures the more recent adoption of automated and machine-assisted detection tools discussed in AI and Machine Learning in Anti-Corruption.

See also: Corruption Risk Management, AI and Machine Learning in Anti-Corruption, E-Procurement Systems.

References

1. Crime and Corruption Commission (Queensland), Fraud and Corruption Control: Best Practice Guide, March 2018, ISBN 978-1-876986-86-5.
2. Standards Australia, AS 8001:2008 Fraud and Corruption Control.
3. Financial Accountability Act 2009 (Qld), s. 61, s. 77.
4. Financial and Performance Management Standard 2009 (Qld), ss. 8, 29, 57, 65.
5. Queensland Public Service Directive 07/11.
6. Public Service Act 2008 (Qld), Ch. 5, Pt. 6.
7. Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control: Integrated Framework, 2004.
8. Auditing and Assurance Standards Board, ASA 240: The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report.
9. Queensland Audit Office, Fraud Risk Management, Report 9, 2013.