Which of the following options best represents a comprehensive set of internal controls to prevent fraud?

• A. Segregation of duties, authorization controls, reconciliations, and access controls
• B. Segregation of duties, authorization controls, reconciliations, physical safeguards
• C. Segregation of duties, authorization controls, reconciliations, physical safeguards, access controls, and audits
• D. Segregation of duties only

Answer: (C)

Internal controls are designed to prevent, detect, and correct fraud by layering defenses across people, processes, and technology. A comprehensive set includes segregation of duties so no single person can initiate and complete a transaction alone; authorization controls requiring proper approvals; reconciliations that compare records to identify discrepancies; physical safeguards that protect assets from theft or damage; access controls that restrict system and data access to authorized individuals; and audits that provide independent verification and uncover gaps. Together, these elements create multiple barriers and detection points, addressing prevention, detection, and correction. Other sets miss one or more essential components—lacking some safeguards or oversight—leaving gaps where fraud can slip through.