TNRC Topic Brief Internal controls and illegal wildlife trade: a systemic approach to corruption prevention and law enforcement integrity

Image representing TNRC's four focus areas: wildlife, fisheries, forests, and finance

Targeting Natural Resource Corruption

Harnessing knowledge, generating evidence, and supporting innovative policy and practice for more effective anti-corruption programming

Internal controls and illegal wildlife trade: A systemic approach to corruption prevention and law enforcement integrity

Key takeaways

  • Agencies tasked with protecting wildlife and the environment must effectively reduce integrity risks, among others, in order to achieve their objectives.
  • Robust internal controls contribute to these objectives by identifying gaps in performance and opportunities to improve, enabling oversight, and fostering accountability.
  • Even in countries where internal controls are used to address a range of technical accounting and budgetary issues, these potentially effective approaches are not always applied to wildlife-related corruption or even wildlife and natural resource management generally. Conservation or anti-corruption partners can help government institutions strengthen their systems of internal controls, building on procedures that already exist.

Key terms

  • Internal control system: The policies, procedures, and practices that help organizations achieve their goals and reduce their risks, including corruption risks. Effective systems include five key components: the control environment, risk assessment, control activities, information and communication, and monitoring (COSO 2013).
  • Internal control units: While responsibility for internal controls is widely shared throughout government, some employees, offices, or divisions are specifically accountable for designing, monitoring, and evaluating aspects of the system. Examples include quality control teams, oversight or integrity committees, internal or external auditors, and special purpose agencies (e.g., public service commissions or anti-corruption offices).
  • Control objectives: A broad statement of what an organization seeks to achieve, e.g., “government employees exercise their roles with integrity” or “legal proceedings are brought based on fully developed investigative cases.”
  • Control activities: The specific steps or activities someone will perform. Control activities can be as simple as signing a receipt for a piece of evidence or as complex as an independent performance audit to determine what accountability mechanisms a police service has in place.
  • Tone at the top: Leaders’ actions demonstrate an organization’s values, philosophy, and attitude toward internal control. A positive tone at the top, where managers uphold ethics and integrity, can drive effective internal control. A negative tone at the top, for example when managers dismiss violations as unimportant, can present a barrier to effectiveness that is difficult to overcome.
  • Implementation gap: The difference between an organization’s aspirations, goals, and objectives, and what actually happens in practice. Where an organization has written procedures that address a particular issue, it can also refer to noncompliance—the difference between written guidance and de facto performance.
  • Illegal wildlife trade (IWT): For the purposes of this document, the phrase IWT includes any illegal activities that result in the commercial exploitation or trade of living organisms or harvested parts, whether they come from wild fauna, flora, timber, or fungi.

Box 1. Exploring internal controls in IWT enforcement - a pilot project

In a three-country study in Sub-Saharan Africa and Latin America, the Basel Institute on Governance used an internal control lens to analyze IWT-related law enforcement. This research built on previously completed political economy analyses (Kassa et al. 2022) and corruption risk assessments (Medina et al. 2022)

Holistically viewing the system of interlinking policies, procedures, and actual practices, the aim of the study was two-fold: examine how internal control systems were working (or not) to address high-priority risks identified in the corruption risk assessment; and identify opportunities to mitigate risks and help achieve the agencies’ objectives through a strengthened system of internal controls. The companion TNRC how-to guide, “Using an internal controls lens to strengthen illegal wildlife trade (IWT) and anti-corruption efforts in a law enforcement context,” provides additional detail and guidance (Batts forthcoming).

Why internal controls? Addressing corruption, achieving objectives

A well-designed system of internal controls can discourage corrupt behavior. For example, knowing that valuable physical evidence (e.g., ivory or pangolin scales) is inventoried, kept under lock and key, and carefully accounted for could discourage an employee from theft. Strong controls can also provide protection to those who want to act with integrity. An effective system for anonymous whistleblowing provides a way for an ethical employee to report a corrupt act and may cause a potential bad actor to think twice before soliciting a bribe.

By bringing a strategic and holistic approach to developing, implementing, evaluating, and improving critical processes in IWT enforcement, internal controls can enhance the functioning of the system as a whole (Batts 2022). Well-designed and implemented systems of internal control can also help mitigate other important risks to wildlife and natural resources including financial risks (e.g., loss of revenue from export permits); risks to economic opportunities (e.g., loss of jobs in eco-tourism or impacts from sanctioning), and risks to national and regional reputation (e.g., as a safe and reliable place to do business or citizen faith in government).

No system can ever completely eliminate the potential for corrupt behavior, and wider systemic challenges such as under-resourcing, unclear values and direction, or adverse socio-economic conditions may also need to be addressed as part of a plan to ensure integrity in public agencies. However, enhancing internal controls is one way to help close the implementation gap between an agency’s objectives and what actually happens in practice.

Internal controls at the national, ministry, and agency levels

Internal controls relevant to IWT enforcement are dispersed among a number of public institutions across different levels of government.

At the highest level of government, many countries have institutions and systems that are designed to be independent from and provide oversight for government departments and actions. Such institutions might be called Supreme Audit Institutions, Offices of the Comptroller General, National Audit Offices, or something similar. The oversight typically extends, at least in theory, to the whole of government, including ministries and departments responsible for wildlife protection and natural resource management, and to law enforcement agencies responsible for investigating and prosecuting corruption and other crimes.

Within individual government agencies, responsibility for internal controls may include development and oversight of:

  • Policies, such as codes of ethics and conduct, data security, and staff hiring.
  • Procedures, such as how to behave (specific steps to take) when faced with an ethical dilemma, how to protect data security in practice, and specific procedures on staff rotation or development.
  • Practices, such as the way in which staff are hired and background checks are conducted, even in the absence of written procedures.

In some government agencies, responsibility for designing and monitoring compliance with internal controls may be delegated to a specific policy and procedures unit. Alternatively, these responsibilities may be dispersed based on functional roles. For instance, the human resources department may be responsible for policies and procedures relating to staffing practices, while creating and implementing information technology (IT) security policies and procedures may be delegated to the IT department.

Five key components to internal controls

Broadly, systems of internal control are made up of the policies, procedures, and practices that help an organization achieve its objectives and respond to risks. The COSO Internal Control – Integrated Framework (2013) describes five necessary components:


Guiding questions

Control environment – The context in which an organization seeks to achieve its objectives.

Political, economic, legal, cultural, and organizational factors will all be relevant. Specific factors will often include the level and prevalence of government corruption, the activities of NGOs and international donors, the involvement of organized criminal elements, and the extent and distribution of natural resources. It is also important (and sometimes challenging) to identify the specific roles of various agencies, ministries, and local authorities in combatting IWT and to understand the overall readiness for change, including level of interest, capacity to implement change, and potential opposition.

What is the “big picture?”

What parts of the overall situation matter most in achieving objectives?

Is responsibility for the system of internal controls clearly assigned? Is there confusion or a lack of clarity about roles and authorities for aspects of internal control related to IWT?

Risk assessment – A systematic evaluation of the risks that an organization faces as it attempts to achieve its objectives.

For example, the identified risk of “deliberate case weakening” by prosecutors relates to the control objective that “legal proceedings in wildlife cases are based on fully developed investigations supported by evidence.”

What can go wrong?

What are the likely ways that corruption could occur and what are the potential impacts?

Control activities – Actions taken to achieve objectives and respond to risks.

Control activities can be preventive (e.g., a lock on an evidence closet or employee background checks) or detective (e.g., reconciliation of ivory stores with official records or comparison of GPS data with scouting reports).

What can be done?

What actions make corruption risks less likely?

Information and communication – Quality information to achieve objectives, and effective internal and external communication.

Examples include understandable guidance for employees; reliable records (e.g., case management systems, searchable asset declarations, or registers of physical evidence); and access to complete and reliable information for transparency and monitoring by civil society and other interested parties.

For employees: What should I do and how should I do it?

For leaders and other stakeholders: What data is needed to support effective oversight and to allow prompt reaction when situations change?

Has the importance of treating wildlife crime as seriously as other crimes been effectively communicated throughout the criminal justice system?

Monitoring – Activities to review and understand how an organization is meeting its control objectives and to identify needed adjustments and enhancements.

Monitoring provides vital information to identify successful practices and give early warning of problems. Knowing that performance will be assessed can incentivize individuals and teams to direct their energy and creativity to achieve organizational objectives.

How well are we doing?

What changes are needed – whether to address shortcomings, respond to changes in the environment, or expand on successful practices?

All five components work together. For example, when a scouting patrol finds evidence of poaching such as a rhino skull…

  • The entire control environment comes into play. This includes the legal framework; the relationship between the wildlife agency, police, prosecutors, and judiciary; the adequacy of available resources; the ease (or difficulty) of selling the skull illegally; attitudes about what constitutes corrupt behavior; and the integrity of the individual scouts.
  • A previous risk assessment may have identified corruption risks relating to the security of physical evidence or undue influence from supervisors.
  • Control activities might include applying an identification tag to the skull and signing receipts to maintain the chain of custody when turning the skull over to the police.
  • Incident reports, with dates, locations, and details of the crime, and storage facility registers that record the receipt or removal of the skull are examples of information and communication.
  • Periodic independent verification of the contents of the evidence storage facility constitutes monitoring. Other examples include supervisory reviews of the actions of the scouting patrol and reports from a biological database to record the results of rhino monitoring, mortalities, and distribution.

Study findings: A need for enhanced controls over IWT and anti-corruption activities

In the countries studied, various internal control units had been assigned responsibility for some aspect of internal control. Frequently, these agencies appeared to be effective in addressing budgetary or accounting issues. However, these units only infrequently conducted performance audits, evaluations, or reviews of IWT-related controls and rarely extended their specialized expertise to wildlife and natural resource management generally. This demonstrated an opportunity to apply some of the effective practices already in place with respect to financial activities to issues associated with IWT-related corruption.

Sometimes written guidance did not function as an internal control, as when guidance merely instructs an employee to “comply with the applicable regulation.” In some of the cases studied, agencies developed elaborate documents that described apparently well-designed approaches to deal with various corruption risks. However, accountability for actually implementing these processes was not effectively designated to anyone and governmental oversight efforts had not addressed the gap between what the documents said and what actually happened.

In other cases, written instructions lacked the level of detail necessary for them to function as an internal control and procedures appeared to have been “copied and pasted” from other documents. For example, an instruction to keep a rhino skull “in a safe place” for a court case did not describe what constituted a “safe place” or establish individual accountability for what could be a key piece of evidence.

Box 2. How much is an elephant worth?

Often overlooked but fundamental is the need to ensure that wildlife and other natural resources are valued appropriately – not only in terms of their “price” on the illicit market but in terms of their value to biodiversity and the country’s reputation and sustainable development.

As a practical matter, some otherwise effective internal controls can be rendered ineffective when applied to environmental crime because of difficulties in valuing natural resources. For example, in one country, as part of an effort to better coordinate their work, various law enforcement agencies developed a strategy that included a prioritization plan – an internal control intended to help ensure that highest priority cases were addressed. However, this prioritization plan evaluated the seriousness of the offense based on “the amount of public funds lost.” Such a gauge tends to assign a lower priority to natural resource crime, since IWT does not always involve a significant loss of public funds.

Sentencing guidelines (a type of internal control) similarly need more comprehensive evidence for the valuation of natural resources. Magistrates have reportedly refused to impose minimum sentences because they were not persuaded of the value of an animal that was poached. Better ways of valuing forest products are also needed, for instance where trees have been illegally cut down to produce charcoal.

Mitigating corruption risks - lessons for practitioners

The three-country study highlighted a significant implementation gap with regard to designing, administering, monitoring, and assessing internal controls related to IWT or natural resource-related anti-corruption enforcement. However, the study also highlighted generalizable ways an internal controls approach can help agencies and ministries in the field of IWT or natural resource management:

  • understand and mitigate corruption risks, and
  • enhance the effectiveness of anti-corruption activities.

Conservation or anti-corruption partners providing technical assistance or funding to government institutions could propose and facilitate these actions as part of a holistic internal controls approach.

  1. Find out what national or ministerial-level internal controls exist and how they work. Have they been/could they be applied to IWT enforcement or another area of interest? Have they been applied to law enforcement agencies and systems relevant to IWT? If not, why not? Are there opportunities to promote their application in these areas, taking into account the control environment?
  2. When possible, seek to build on existing practices and to develop controls in conjunction with those in charge of implementing them.
  3. In the implementation plan, specifically include steps or stages for assessing the level of compliance with the new procedures and their effectiveness, adjusting accordingly, and reporting on successes and shortcomings.
  4. When working with partner agencies to mitigate corruption risks and improve their effectiveness, use an internal controls approach to help move from the aspirational (“do good things”) to the practical (who’s going to do it, how, and how often).
  5. Consider working closely with higher-level internal control units, like national audit institutions or inspectors general, even if those units don’t have a specific remit to deal with IWT or corruption. Develop and share a generalized methodology or audit plan to support accountability professionals who may not have experience in evaluating non-financial activities. (Batts forthcoming). Programs to strengthen IWT enforcement can especially benefit from intentional collaboration with internal control units.
  6. Provide technical assistance to help governments develop solid, defensible methodologies to appropriately valuate natural resources, including wildlife and environmental damage. With such methodologies, audit plans can more easily include natural resource issues and prosecutors can better explain the value of an individual endangered animal or rare plant to a judge accustomed to thinking only in terms of market values.
  7. Encourage partner agencies to ensure adequate internal and external reporting on internal controls. This reporting should go beyond “newsletter” style reports to give accurate and useful information on the functioning and effectiveness of internal controls. If the level of accomplishment is less than desired, the reporting should include details of how the agency plans to do better in the future.
  8. Work with agency staff to identify “low-hanging fruit” – opportunities to make simple adjustments that strengthen the overall control structure. Sometimes, adding a sign-off on a form, a camera in an evidence room, or routinely documenting some aspect of a scouting patrol can have an impact on the integrity of a process.
  9. Consider technological approaches - while sometimes costly, they can also lead to improved internal controls. For example, smart patrol systems can be used to closely monitor ranger patrols and reduce corruption risks. Other innovations including GPS trackers for vehicles and staff and body cameras can be helpful in remote locations where there are few witnesses to potential corrupt behavior. At the same time, the technological solutions themselves require good internal control to avoid becoming tools of corruption or wildlife crime.


Batts, Rebecca. 2022. Internal controls and anti-corruption. Quick Guide 24, Basel Institute on Governance.

Batts, Rebecca, Juhani Grossman, Melinda Gularso. Forthcoming. “Mitigating corruption risks: Using an internal controls lens to strengthen illegal wildlife trade (IWT) and anti-corruption efforts in a law enforcement context.” TNRC Guide.

Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2013. "Internal Control - Integrated Framework." American Institute of Certified Public Accountants.

Kassa, Saba, Jacopo Costa, Cosimo Stahl, and Claudia Baez Camargo. 2022. "How political economy analysis can support corruption risk assessments to strengthen law enforcement against wildlife crimes." TNRC Practice Note.

Medina, Manual, Juhani Grossman, Taradhinta Suryandari, and Monica Guy. 2022. "Where are the weakest links in the illegal wildlife trade enforcement chain? Lessons from corruption risk assessments with agencies in three countries." TNRC Practice Note.