Internal control and the response to assessed risks

Once the auditor has assessed the risks of material misstatement, it must decide how to respond. A central choice is whether to rely on the client's internal controls. If controls are well designed and operate effectively, they reduce the risk that misstatements occur in the first place, and the auditor can do less substantive testing. If they are weak, or if testing them would cost more than it saves, the auditor relies on substantive procedures alone. ACCT-240 explained how controls are designed; this lesson looks at them from the auditor's side: how to understand them, how to test them, how to evaluate deficiencies, and how the results shape the nature, timing and extent of the rest of the audit.

The components of internal control

Most frameworks, including the COSO Internal Control – Integrated Framework (2013) used by most North American public companies, describe internal control in five components. The control environment is the foundation: the integrity and ethical values of management, the oversight provided by the board and audit committee, the organizational structure, commitment to competence and accountability. The entity's risk assessment process identifies and analyzes risks to reliable financial reporting, including fraud risk and the effect of significant changes. The information system and communication capture, process and report transactions and communicate responsibilities. Control activities are the policies and procedures that address specific risks, such as authorizations, reconciliations, segregation of duties and IT application controls. Monitoring activities, such as internal audit and management review, assess whether controls continue to operate.

CAS 315 (Revised 2019) requires the auditor to understand each component. For the control environment, risk assessment process, monitoring, and information system, the auditor evaluates whether they provide an appropriate foundation; for control activities, the auditor identifies the controls that address risks at the assertion level and evaluates their design and implementation.

The auditor documents its understanding through narratives, flowcharts and control matrices, and confirms it by performing a walkthrough: following one transaction from initiation to its recording in the general ledger, asking questions and inspecting documents and system records along the way. A walkthrough provides evidence that a control is designed appropriately and has been implemented, that is, put in place. It does not by itself show that the control operated effectively throughout the year.

IT general controls and application controls

Most of Fairhaven's transactions are processed by its enterprise resource planning (ERP) system, its point-of-sale system and the warehouse management system installed in July. Automated application controls in those systems, such as a three-way match of purchase order, receiving report and invoice, or a check that blocks a sales order above a customer's credit limit, can be highly reliable, because a computer applies the same logic every time. But they are only reliable if IT general controls (ITGCs) protect the systems: controls over access to programs and data, program changes, program development and computer operations. If anyone can change the credit limit table, the credit check means little.

For the new warehouse system, the team plans to test the data conversion in July: whether opening quantities and costs in the new system agreed with the old system's closing balances, and whether the client investigated and resolved differences. Because the system changed during the year, the auditor must consider controls in both the old and the new systems for the periods each was in use. Data analytics now let auditors test entire populations of system data; CISSP-115 and other security courses cover the technical side of access controls, while this course stays with what the auditor must conclude about them.

Deciding whether to rely on controls

The auditor tests controls when it intends to rely on them to reduce substantive testing, or when substantive procedures alone cannot provide sufficient appropriate evidence, which is common where transactions are processed electronically with little or no paper trail. For high-volume, routine transactions such as retail sales through the point-of-sale system, relying on controls is usually efficient. For non-routine, judgmental items such as inventory obsolescence, substantive procedures are usually more effective.

Tests of controls provide evidence about operating effectiveness: whether the control operated as designed, consistently, throughout the period of reliance, and by people with the authority and competence to perform it. They include inquiry combined with other procedures, observation, inspection of documents for evidence of performance, and reperformance. Inquiry alone is never enough.

Sampling a control and evaluating the results

Controls that operate many times a year are usually tested on a sample. The required sample size depends on the confidence the auditor wants, the tolerable deviation rate (the maximum rate at which the control can fail and still be relied on), and the expected deviation rate. At 95 per cent confidence, a tolerable rate of 5 per cent and no expected deviations, the sample size is 59; lesson 8 shows where that figure comes from. The program below selects 59 of Fairhaven's 4,820 wholesale orders at random and evaluates two deviations found in credit approval.

# Evaluating a test of controls: credit approval on Fairhaven wholesale orders
import random
random.seed(331)
population = 4_820                     # wholesale orders in the year
n = 59                                 # sample size for 95% confidence, 5% tolerable rate, zero expected deviations
sample = sorted(random.sample(range(1, population + 1), n))
deviations = {sample[17]: "approved by sales rep, not credit manager", sample[44]: "no approval evidence"}
print(f"Sample of {n} orders from {population}; first ten order numbers: {sample[:10]}")
print(f"Deviations found: {len(deviations)}")
for k, why in deviations.items():
    print(f"  order {k}: {why}")
rate = len(deviations) / n
# Upper deviation limits at 95% confidence for n = 59 (from attribute sampling tables)
udl = {0: 0.050, 1: 0.079, 2: 0.104, 3: 0.127}
print(f"Sample deviation rate: {rate:.1%}")
print(f"Upper deviation limit at 95% confidence: {udl[len(deviations)]:.1%}")
print("Control can be relied on" if udl[len(deviations)] <= 0.05 else "Control cannot be relied on as planned; increase substantive testing")

Sample of 59 orders from 4820; first ten order numbers: [185, 269, 284, 296, 298, 331, 332, 406, 667, 839]
Deviations found: 2
  order 1410: approved by sales rep, not credit manager
  order 3898: no approval evidence
Sample deviation rate: 3.4%
Upper deviation limit at 95% confidence: 10.4%
Control cannot be relied on as planned; increase substantive testing

With two deviations, the upper deviation limit, the highest rate the auditor can say with 95 per cent confidence the population might contain, is about 10.4 per cent, above the tolerable rate of 5 per cent. The auditor cannot rely on the credit approval control as planned. It must assess control risk higher, increase substantive testing of receivables (more confirmations and more work on the allowance), and consider whether the deviations indicate a deficiency to communicate to management.

Not every control needs a large sample. Controls that operate less often require smaller samples: commonly 2 for a quarterly control, 2 to 5 for a monthly control, 5 to 15 for a weekly control and 20 to 40 for a daily control. Automated application controls may need testing only once, provided ITGCs operated effectively throughout the period, because a computer performs them identically each time.

Deficiencies in internal control

A deficiency exists when a control is designed, implemented or operated in a way that does not allow management or employees to prevent, or detect and correct, misstatements on a timely basis, or when a necessary control is missing. Deficiencies are graded by severity, considering the likelihood and magnitude of the misstatement that could result.

Under CAS 265, the auditor communicates significant deficiencies in internal control in writing to those charged with governance on a timely basis, and other deficiencies of sufficient importance to management. In addition, NI 52-109 requires the CEO and CFO of a reporting issuer to certify the design (and, for non-venture issuers, the operating effectiveness) of disclosure controls and procedures and internal control over financial reporting, and to disclose material weaknesses in the MD&A. Unlike the United States, Canada does not require an auditor's attestation on internal control; NI 52-109 certifications are management's alone (as of October 2026).

Internal control reporting in Canada and the United States

For comparison: in the United States, Section 404(b) of the Sarbanes-Oxley Act requires the auditor of a larger public company to express an opinion on the effectiveness of internal control over financial reporting, in an integrated audit performed with the financial statement audit under PCAOB AS 2201. Canada chose not to adopt an equivalent requirement. Canadian companies that are also SEC registrants, cross-listed in the United States and above the size thresholds, must obtain a 404(b) audit for their US filings. For a purely Canadian listed company such as Fairhaven, the auditor's work on controls supports the financial statement opinion, and management's certifications under NI 52-109 stand alone.

The top-down approach used in a US integrated audit is still a useful way to think about controls in any audit: start at the financial statement level and entity-level controls, identify significant accounts and their relevant assertions, and test the controls that address the risks to those assertions. Where a controls-reliance strategy is efficient, Bramble Shaw follows the same logic for Fairhaven.

Nature, timing and extent of further procedures

The response to assessed risks is described in three dimensions. Nature is the type of procedure: tests of controls or substantive procedures, and among substantive procedures, analytics or tests of details, and which techniques (confirmation, inspection, recalculation). Timing is when procedures are performed: at an interim date or at year end; higher risks call for work at or near the year end. Extent is how much: sample sizes, the number of locations, the precision of analytics. As assessed risk rises, the auditor obtains more persuasive evidence by changing one or more of these: more reliable procedures, closer to year end, on larger samples.

Two further requirements apply regardless of the assessed risk. Every audit must include substantive procedures for each material class of transactions, account balance and disclosure, because the risk assessment is judgmental and controls have inherent limitations. And the auditor must agree the statements to the underlying records and examine material journal entries and adjustments made in preparing them.