Despite the growing interest in research on the topic of internal control, there is confusion about the concept in both theory and practice. This study addresses this lack of clarity by systematically structuring the literature that uses the concept by investigating what we know from previous studies about the practice of internal control and how it is institutionalized. To examine the existing literature in this field, the paper utilizes the theoretical lens of ‘institutional work’. The review finds that the understanding of internal control is currently divided: one part of the literature understands the concept as internal control over financial reporting, while the other part has a more global and strategic understanding of the term. Internal control is institutionalized by different organizational actors at the micro level in an attempt to implement internal control systems that are not a simple act of compliance but present an added value for the organization. At the same time, it is noteworthy that not all categories of institutional work could be identified in the internal control literature, indicating that the actors are largely limited by their institutional embeddedness. The paper also presents an aggregated understanding of the term internal control, which can therefore significantly supplement the efforts of practitioners and regulators to implement internal control procedures that add value for the corporate governance of organizations.