Carnegie works according to the principle that the line organization is responsible for internal control in the first instance. Responsibility for risk control thus rests where it originates. In the second instance, there are control functions that are responsible for verifying that the business areas manage risk control in a competent and satisfactory manner. Internal and external auditors comprise the third and final level and are responsible for verifying that the line organization and the control functions perform their duties.

Control functions
Carnegie has three control functions that have divided control based on the risk that they monitor. To be able to control activities, these bodies must understand the risks, see where they arise and have the right resources to manage them.

 Risk Control
 Compliance
 Internal Audit