Does every control in a company count as ICFR?

No. ICFR is the subset of controls that supports reliable external financial reporting. Many operational, compliance, cybersecurity, or customer-service controls are important, but they are not automatically ICFR unless they materially affect financial-reporting assertions such as completeness, accuracy, cutoff, valuation, or classification.

On the exam, start by asking whether the risk described in the question could distort the financial statements or related disclosures. If yes, the control may fall within ICFR. If the control only improves efficiency or service quality without a reporting impact, it is usually not an ICFR control.