Behavior-Based Internal Control: Designing for Real Human Behavior

Traditional internal control design operates under an ideal assumption: that people will behave rationally, predictably, and ethically—as long as controls are clearly defined. But in the real world, people are not algorithms. We make emotional decisions, take shortcuts, and often act in ways that defy logic.

This article invites a deeper reflection:
Are we designing controls based on how people should behave, or how they actually behave?

Incorporating behavioral insight into internal control design means acknowledging the role of cognitive biases, habits, social dynamics, and hidden motivations in control effectiveness. This perspective is especially useful when strengthening key COSO 2013 principles, including ethics, communication, and control activities.

What Is the Behavioral Approach to Internal Control?

It’s the practice of designing or adjusting controls based on how people behave in practice, not just how they’re expected to behave in theory. This involves analyzing:

• Cognitive biases (e.g., overconfidence, loss aversion)
• Social or hierarchical pressure
• Organizational inertia and habits
• Decision fatigue or task overload
• Hidden preferences or rationalizations for errors

Real-World Behavioral Failures in Control Design

Designed Control	Actual Behavior	Consequence
Mandatory dual signature for payments	Automatic signing without review	Symbolic control, no real check
Annual signed Code of Ethics	Signed without reading or internalizing	Formal compliance, unethical behavior
Anonymous whistleblower hotline	Low usage due to fear or apathy	Hidden risks, no early warnings
Long inspection checklists	Filled out routinely without verification	False positives, unreliable data

Behavior and the COSO Framework

While COSO 2013 doesn’t explicitly mention “organizational behavior,” many of its principles rely on it implicitly. Key examples include:

• Principle 1: Control environment must reflect ethical values and organizational culture
• Principle 4: Control responsibilities should be understood and accepted, not just imposed
• Principle 10: Controls must be tailored to real operating conditions and personnel
• Principles 16 & 17: Monitoring must consider perceptions, reactions, and actual usage of controls

How to Redesign Controls Using Behavioral Insights

1. Make Controls Visible and Easy to Use
Effective controls should fit naturally into daily work. If they interrupt without clear value, users will bypass or ignore them.

2. Include Clear Incentives and Consequences
People respond better when they understand why a control exists and its impact—both positive and negative.

3. Simplify the Experience
Cognitive overload causes people to skip steps. Use simple formats, automation, and behavioral cues that guide actions.

4. Observe and Interview Users
Before redesigning, understand how people actually use controls. Ask: What helps? What hinders? What do they ignore?

5. Diagnose Common Biases in Your Organization
Is there excessive trust in certain individuals? Is there underreporting of errors? Do people justify policy violations? Adjust your controls to limit these patterns.

Case Study: Behavior-Based Access Control Redesign

Original Situation
The system required monthly renewal of complex passwords. Many users wrote them on sticky notes or reused simple patterns.

Behavioral Redesign
Biometric authentication was introduced, along with short behavioral prompts (“Your access protects critical data”) and after-hours access tracking.

Result
A 70% reduction in repeated passwords and significant improvement in access traceability.

Incorporating This Perspective into Internal Auditing

• Conduct organizational behavior audits: go beyond documents—observe, interview, analyze
• In audit reports, include questions such as: Is this control used as intended? Is it understood? Is it helpful?
• Involve experts in organizational behavior or workplace psychology when redesigning critical controls

Conclusion: From What Should Be to What Actually Is

Internal control is not just a technical structure—it is a social and behavioral construct.
Designing controls that reflect real behavior—not just idealized behavior—is essential to closing the gap between policy and effectiveness.

COSO provides the framework.
Human nature sets the tempo.

Jorge Gutierrez Guillen

Sources

• COSO Internal Control–Integrated Framework (2013 Edition)
• Kahneman, D. (2011). Thinking, Fast and Slow
• Thaler, R. & Sunstein, C. (2008). Nudge: Improving Decisions About Health, Wealth, and Happiness
• Audittool.org articles on behavioral auditing
• Reports from the Behavioral Insights Team (UK)

#InternalControl #BehavioralRisk #COSOFramework #AuditInnovation #OrganizationalPsychology