Internal control, the integrated audit and the response to assessed risks

Once the auditor has assessed the risks of material misstatement, it must decide how to respond. A central choice is whether to rely on the client's internal controls. If controls are well designed and operate effectively, they reduce the risk that misstatements occur in the first place, and the auditor can do less substantive testing. If they are weak, or if testing them would cost more than it saves, the auditor relies on substantive procedures alone. ACCT-240 explained how controls are designed; this lesson looks at them from the auditor's side: how to understand them, how to test them, how to evaluate deficiencies, and how the results shape the nature, timing and extent of the rest of the audit. It also covers the integrated audit, in which the auditor of a larger public company reports on internal control over financial reporting as well as on the financial statements.

The components of internal control

Most frameworks, including the COSO Internal Control – Integrated Framework (2013) used by most North American public companies, describe internal control in five components. The control environment is the foundation: the integrity and ethical values of management, the oversight provided by the board and audit committee, the organizational structure, commitment to competence and accountability. The entity's risk assessment process identifies and analyzes risks to reliable financial reporting, including fraud risk and the effect of significant changes. The information system and communication capture, process and report transactions and communicate responsibilities. Control activities are the policies and procedures that address specific risks, such as authorizations, reconciliations, segregation of duties and IT application controls. Monitoring activities, such as internal audit and management review, assess whether controls continue to operate.

AS 2110 and AS 2201 require the auditor of an issuer to understand each component of internal control over financial reporting, with particular attention to entity-level controls such as the control environment and the period-end financial reporting process. AU-C 315 sets similar requirements for non-issuer audits.

The auditor documents its understanding through narratives, flowcharts and control matrices, and confirms it by performing a walkthrough: following one transaction from initiation to its recording in the general ledger, asking questions and inspecting documents and system records along the way. A walkthrough provides evidence that a control is designed appropriately and has been implemented, that is, put in place. It does not by itself show that the control operated effectively throughout the year.

IT general controls and application controls

Most of Fairhaven's transactions are processed by its enterprise resource planning (ERP) system, its point-of-sale system and the warehouse management system installed in July. Automated application controls in those systems, such as a three-way match of purchase order, receiving report and invoice, or a check that blocks a sales order above a customer's credit limit, can be highly reliable, because a computer applies the same logic every time. But they are only reliable if IT general controls (ITGCs) protect the systems: controls over access to programs and data, program changes, program development and computer operations. If anyone can change the credit limit table, the credit check means little.

For the new warehouse system, the team plans to test the data conversion in July: whether opening quantities and costs in the new system agreed with the old system's closing balances, and whether the client investigated and resolved differences. Because the system changed during the year, the auditor must consider controls in both the old and the new systems for the periods each was in use. Data analytics now let auditors test entire populations of system data; CISSP-115 and other security courses cover the technical side of access controls, while this course stays with what the auditor must conclude about them.

Deciding whether to rely on controls

The auditor tests controls when it intends to rely on them to reduce substantive testing, or when substantive procedures alone cannot provide sufficient appropriate evidence, which is common where transactions are processed electronically with little or no paper trail. For high-volume, routine transactions such as retail sales through the point-of-sale system, relying on controls is usually efficient. For non-routine, judgmental items such as inventory obsolescence, substantive procedures are usually more effective.

Tests of controls provide evidence about operating effectiveness: whether the control operated as designed, consistently, throughout the period of reliance, and by people with the authority and competence to perform it. They include inquiry combined with other procedures, observation, inspection of documents for evidence of performance, and reperformance. Inquiry alone is never enough.

Sampling a control and evaluating the results

Controls that operate many times a year are usually tested on a sample. The required sample size depends on the confidence the auditor wants, the tolerable deviation rate (the maximum rate at which the control can fail and still be relied on), and the expected deviation rate. At 95 percent confidence, a tolerable rate of 5 percent and no expected deviations, the sample size is 59; lesson 8 shows where that figure comes from. The program below selects 59 of Fairhaven's 4,820 wholesale orders at random and evaluates two deviations found in credit approval.

# Evaluating a test of controls: credit approval on Fairhaven wholesale orders
import random
random.seed(331)
population = 4_820                     # wholesale orders in the year
n = 59                                 # sample size for 95% confidence, 5% tolerable rate, zero expected deviations
sample = sorted(random.sample(range(1, population + 1), n))
deviations = {sample[17]: "approved by sales rep, not credit manager", sample[44]: "no approval evidence"}
print(f"Sample of {n} orders from {population}; first ten order numbers: {sample[:10]}")
print(f"Deviations found: {len(deviations)}")
for k, why in deviations.items():
    print(f"  order {k}: {why}")
rate = len(deviations) / n
# Upper deviation limits at 95% confidence for n = 59 (from attribute sampling tables)
udl = {0: 0.050, 1: 0.079, 2: 0.104, 3: 0.127}
print(f"Sample deviation rate: {rate:.1%}")
print(f"Upper deviation limit at 95% confidence: {udl[len(deviations)]:.1%}")
print("Control can be relied on" if udl[len(deviations)] <= 0.05 else "Control cannot be relied on as planned; increase substantive testing")

Sample of 59 orders from 4820; first ten order numbers: [185, 269, 284, 296, 298, 331, 332, 406, 667, 839]
Deviations found: 2
  order 1410: approved by sales rep, not credit manager
  order 3898: no approval evidence
Sample deviation rate: 3.4%
Upper deviation limit at 95% confidence: 10.4%
Control cannot be relied on as planned; increase substantive testing

With two deviations, the upper deviation limit, the highest rate the auditor can say with 95 percent confidence the population might contain, is about 10.4 percent, above the tolerable rate of 5 percent. The auditor cannot rely on the credit approval control as planned. It must assess control risk higher, increase substantive testing of receivables (more confirmations and more work on the allowance), and consider whether the deviations indicate a deficiency to communicate to management.

Not every control needs a large sample. Controls that operate less often require smaller samples: commonly 2 for a quarterly control, 2 to 5 for a monthly control, 5 to 15 for a weekly control and 20 to 40 for a daily control. Automated application controls may need testing only once, provided ITGCs operated effectively throughout the period, because a computer performs them identically each time.

Deficiencies in internal control

A deficiency exists when a control is designed, implemented or operated in a way that does not allow management or employees to prevent, or detect and correct, misstatements on a timely basis, or when a necessary control is missing. Deficiencies are graded by severity, considering the likelihood and magnitude of the misstatement that could result.

Under AS 2201, a deficiency is a material weakness if there is a reasonable possibility that a material misstatement of the annual or interim statements will not be prevented or detected on a timely basis. A significant deficiency is less severe than a material weakness but important enough to merit the attention of those overseeing financial reporting. The auditor communicates material weaknesses and significant deficiencies in writing to management and the audit committee. For non-issuer audits, AU-C 265 requires written communication of significant deficiencies and material weaknesses.

The integrated audit under AS 2201

Fairhaven is an accelerated filer, with a public float above $75 million, so Section 404(b) of Sarbanes-Oxley requires Bramble Shaw to express an opinion on the effectiveness of its internal control over financial reporting (ICFR) as of December 31, 2026. Management must first assess ICFR under Section 404(a), using a suitable framework such as COSO 2013. The auditor then performs an integrated audit under AS 2201, designed to achieve the objectives of both the ICFR audit and the financial statement audit. Non-accelerated filers, including smaller reporting companies with revenue under $100 million, are exempt from 404(b), though management's 404(a) assessment still applies.

AS 2201 uses a top-down approach. The auditor begins at the financial statement level with an understanding of overall risks to ICFR, then evaluates entity-level controls, such as the control environment, the period-end financial reporting process and controls over management override, then identifies significant accounts and disclosures and their relevant assertions, and finally selects for testing the controls that address the risk of misstatement in each relevant assertion. Because the opinion is as of year end, controls must be tested over a period sufficient to conclude they operate effectively at that date. If a material weakness exists at year end, the auditor must express an adverse opinion on ICFR, though the financial statement opinion may still be unmodified if the auditor's substantive work shows the statements are fairly presented.

Nature, timing and extent of further procedures

The response to assessed risks is described in three dimensions. Nature is the type of procedure: tests of controls or substantive procedures, and among substantive procedures, analytics or tests of details, and which techniques (confirmation, inspection, recalculation). Timing is when procedures are performed: at an interim date or at year end; higher risks call for work at or near the year end. Extent is how much: sample sizes, the number of locations, the precision of analytics. As assessed risk rises, the auditor obtains more persuasive evidence by changing one or more of these: more reliable procedures, closer to year end, on larger samples.

Two further requirements apply regardless of the assessed risk. Every audit must include substantive procedures for each material class of transactions, account balance and disclosure, because the risk assessment is judgmental and controls have inherent limitations. And the auditor must agree the statements to the underlying records and examine material journal entries and adjustments made in preparing them.