Skip to main content

【Business Case】Internal control review – the practical approach

This case is authored by Dr. Sammy FUNG and Mr. Matthew LEE.


Dr. Sammy Fung is the Principal Lecturer of the Faculty of Business and Economics and Mr. Matthew Lee obtained his Postgraduate Certificate in Laws with distinction, Bachelor of Laws with first class honours and Bachelor of Business Administration (Law) with first class honours from the University of Hong Kong in 2015.


A series of corporate accounting scandals in the 2000s, notably the Enron scandal where there were instances of fraud and inflation of earnings reports, have enlightened organizations on the importance of an effective internal control system. The authors of this case would like students who will become future auditors, consultants or managers to understand their roles in the internal control review process and develop a thorough understanding of the following: (1) why is internal control significant to an organisation’s financial sustainability and the achievement of its missions and visions; (2) when should internal control review take place; (3) who should consultants approach in the internal review process; (4) what is the information that should be obtained to assess an organization’s internal controls; and (5) how can the design and operating effectiveness of internal controls be measured and deficiencies be rectified.


In this case, students are introduced to the integrated framework developed by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO Framework”), which has been developed to help organizations design and implement internal control, broaden the application of internal control in addressing operation and reporting objectives, and clarify the requirements for determining what constituted effective internal control. Students are provided examples on how the COSO Framework is applied in real world by consultants, and are guided to apply the COSO Framework to advise a toy seller on its internal control issues.


The teaching of this case does not only provide insights to students on the theoretical foundations of internal controls. Through application of the theories into the case facts, students will develop practical experience in the whole internal control process. In the end, students will appreciate that as organizations vary in their size, legal and ownership form and industry, there is no one-size-fits-all approach or framework for internal control assessment and as consultants, they have to be dynamic and flexible enough in asking for the right information, adopting the best available tools, and making the judgment after rounds of evaluations.


In writing this case, the authors have consulted experienced consultants of Protiviti Hong Kong Co. Limited (Protiviti HK), a member of Protiviti Inc. (Protiviti). Protiviti HK is a prominent consulting firm that offers business solutions in technology, business process, risk, compliance and internal audit. Its mission is to team with clients to protect and enhance enterprise values by identifying, anticipating and solving critical business issues. As of December 2018, Protiviti had more than 70 offices in over 20 countries. It had more than 3,600 professionals worldwide and served over 60% of the Fortune 1000® companies and 35% of the Fortune Global 500® companies.


For more information about the case details, please visit