The contemporary challenge of internal control lies in the quality of its management. Some organizations suffer from insufficient internal control, which prevents effective risk management. Others—particularly in the public sector—face excessive internal control, where bureaucracy, an overabundance of procedures, or their misuse become evident symptoms.

These management flaws generate massive hidden costs that can threaten the organization’s survival and development. What, then, are the keys to effective internal control system management? Two are essential:

• The quality of risk identification through relevant and dynamic risk mapping, for which AI and cost-performance analysis can be valuable tools.
• The quality of the integration of standards in the broad sense—both imposed (such as laws) and created (such as procedures) to manage risks—by the human resources responsible for implementing them, ultimately pointing to human behavior.