What best practices should be followed to strengthen internal controls before an audit?

Establishing and maintaining a strong culture of internal controls resides with leadership. Ethical behavior and integrity should be promoted from the top and should reinforce a culture of compliance and risk awareness throughout the organization. Policies and procedures should address risks that are identified through the risk assessment. Related control activities should be prioritized based on severity and likelihood and should include a mix of preventive and detective controls. Internal controls should be built into ongoing activities and not considered as a checklist item to be performed after routine procedures have been completed. Separating incompatible functions, such as authorization, custody or recording, within a process is a good example of how controls can be woven into a process. At the execution level, look for opportunities to leverage technology by using automation and workflows to improve control execution and segregation of duties. For manual processes and controls, ensure that workpapers cover all significant audit areas and risks by: Clearly documenting steps performed Documenting professional judgment, rationale, and conclusions Reviewing workbook formulas and report parameters Including evidence of supervisory reviews

What is segregation of duties (SOD)?

SOD is a highly complex organization control that’s meant to help ensure responsibilities for essential or consequential business functions are dispersed between more than one person or department. Without this separation, risks ranging from asset theft to fraudulent financial statement manipulation become significantly more difficult to manage.

Article

Five steps to prevent material weaknesses before an independent audit

July 11, 2021 · Updated Nov. 24, 2025 · Authored by Erin Clayville

The stock value of a public company can drop significantly when an independent auditor finds a material weakness. Financial statement disclosures, internal control over financial reporting (ICFR) assessment reports, and independent audit reports all act as indication to stockholders whether management prioritizes a strong control environment.

A material weakness, which requires public disclosure in a public company, can undermine the organization’s reputation for ensuring sound management practices in their control environment as communicated in their public reporting to investors.

What steps can organizations take to prevent material weaknesses before an independent audit?

To protect against a material weakness, there are steps financial teams can take to build confidence in their controls and help avoid adverse financial reporting issues:

Conduct a risk assessment
Let the external auditor’s guidance inform the internal controls process
Monitor changes to compliance landscape
Revisit foundational controls
Align governance with organizational goals

Below, we explore each step in more detail.

Step 1: Conduct a risk assessment

What is a risk assessment?

Once management has established their strategic and operational objectives, they should perform or oversee a risk assessment to identify the barriers to meeting those objectives.

According to Committee of Sponsoring Organizations of the Treadway Commission (COSO), a risk assessment is an interactive process for identifying and assessing those risks that may limit the achievement of enterprise objectives. It should be a structured and disciplined process that is practical, sustainable, and easy to understand and correctly sized to the enterprise’s size, complexity, and geographic reach.

Erin Clayville

Principal

Five steps to prevent material weaknesses before an independent audit

What steps can organizations take to prevent material weaknesses before an independent audit?

Step 1: Conduct a risk assessment

What is a risk assessment?

Erin Clayville

Strategic risk solutions

Consider risk-to-reward potential

Step 2: Let the external auditor’s guidance inform the internal controls process

Ask questions

Questions to ask an auditor

What best practices should be followed to strengthen internal controls before an audit?

Step 3: Monitor changes to compliance landscape

Step 4: Revisit foundational controls

What is segregation of duties (SOD)?

Assess key controls

Step 5: Align governance with organizational goals

Governance and risk management case study results

Independence of board members

Financial expertise

Risk management

Have questions? Baker Tilly can help.