2022 Edition

Financial Management (CP-FIN) 1: Internal Control Environment

An internal control system includes mechanisms for:
  1. senior management reviews and approvals;
  2. assuring that management directives are carried out;
  3. prevention of error, mismanagement, or fraud; and
  4. safeguarding and verification of assets.


Internal controls include "preventive" controls that address the question, "What could go wrong?” and "detective" controls which address the question, "What did go wrong?" As such, detective controls should be part of the public authority/agency's performance improvement system.




Public authority/agency viability and positive financial outcomes are achieved through diligent application of sound financial management practices that accord with applicable requirements. 
Full Implementation, Outstanding Performance
A rating of (1) indicates that the agency's practices fully meet the standard and reflect a high level of capacity.  
  • All elements or requirements outlined in the standard are evident in practice, with rare or no exceptions: exceptions do not impact service quality or agency performance. 
Substantial Implementation, Good Performance
A rating of (2) indicates that an agency's infrastructure and practices are basically sound but there is room for improvement.
  • The majority of the standards requirements have been met and the basic framework required by the standard has been implemented. 
  • Minor inconsistencies and not yet fully developed practices are noted; however, these do not significantly impact service quality or agency performance.

Partial Implementation, Concerning Performance
A rating of (3) indicates that the agency's observed infrastructure and/or practices require significant improvement.  

  • The agency has not implemented the basic framework of the standard but instead has in place only part of this framework.  
  • Omissions or exceptions to the practices outlined in the standard occur regularly, or practices are implemented in a cursory or haphazard manner.  
  • Service quality or agency functioning may be compromised.  
  • Capacity is at a basic level.
Unsatisfactory Implementation or Performance
A rating of (4) indicates that implementation of the standard is minimal or there is no evidence of implementation at all.  
  • The agency’s observed administration and management infrastructure and practices are weak or non-existent; or show signs of neglect, stagnation, or deterioration.
Self-Study EvidenceOn-Site EvidenceOn-Site Activities
  • Internal financial control manual that includes policies and procedures
No On-Site Evidence
  • Interviews may include:
    1. Fiscal authority
    2. Agency senior management
    3. CFO or equivalent
    4. Financial personnel