During a compliance review of a company's procurement department, the auditor reviews the policy requiring separate employees to approve purchase orders and authorize payments. What is the primary purpose of embedding these types of internal controls into a compliance program?

Internal controls are the systematic measures (such as reviews, checks and balances, methods, and procedures) instituted by an organization to conduct its business in an orderly and efficient manner, safeguard its assets, and ensure compliance with laws and policies. Option A is correct because the foundational purpose of internal controls in a compliance program is to establish a proactive defense system that works to prevent compliance violations, detect deviations in real-time or post-transaction, and correct weaknesses before they lead to regulatory actions. This three-stage framework (prevent, detect, correct) is standard across COSO and compliance design guidelines. Option B is incorrect because internal controls do not shift ultimate legal responsibility away from corporate management; the board and executive leadership remain responsible for the compliance program. Option C is incorrect because internal controls are designed to integrate and support legal and compliance oversight, not isolate the legal department. Option D is incorrect because while controls can introduce necessary checkpoints, their purpose is risk mitigation and operational integrity, not to intentionally hinder business growth or artificially reduce transaction volumes.