The control environment is the foundation of internal control: the standards, processes and structures that set the tone for how seriously an organization takes controls. It covers integrity and ethical values, board or owner oversight, organizational structure and authority, commitment to competence and accountability. The other components of internal control (risk assessment, information and communication, control activities and monitoring) depend on it. A reconciliation process is only as good as the culture that makes people do it honestly.
This guide explains what the auditor must evaluate under AU-C 315, how the evaluation is done in practice, what evidence to look for, a worked example, and what a weak environment does to the audit plan. See also the control environment glossary entry and the COSO framework guide.
What the standard requires
Under AU-C 315, as amended by SAS 145, the auditor obtains an understanding of the control environment relevant to the preparation of the financial statements and evaluates it. The evaluation asks whether:
- management, with the oversight of those charged with governance, has maintained a culture of honesty and ethical behavior;
- the control environment provides an appropriate foundation for the other components of the system of internal control, considering the nature and complexity of the entity; and
- control deficiencies in the control environment undermine the other components.
These evaluations feed the risk assessment. A control environment that is not a sound base can lead the auditor to identify risks of material misstatement at the financial statement level and to plan overall responses. See SAS 145 risk assessment and AU-C 315.
The five principles behind it
The COSO 2013 framework sets five principles for the control environment. They give the auditor a structure for questions.
| COSO principle | What the auditor asks | Evidence |
|---|---|---|
| 1. Integrity and ethical values | Is there a code of conduct, and does management follow it? How are violations handled? | Code, signed acknowledgments, disciplinary history, hotline records, inquiry |
| 2. Board independence and oversight | Does the board or owner oversee financial reporting and controls? | Minutes, audit committee charter, meeting frequency, outside members |
| 3. Structure, reporting lines, authority | Are responsibilities clear? Who can approve what? | Org chart, authority matrix, bank signatory records |
| 4. Commitment to competence | Do finance staff have the skills for the entity's complexity? | Résumés, training, turnover, use of outside accountants |
| 5. Accountability | Are people held to account for control responsibilities? | Performance criteria, review evidence, consequences |
See tone at the top and those charged with governance.
How to evaluate it
- Inquire of management, those charged with governance and internal audit (if any), and of staff at different levels, about how controls are viewed and what happens when they are bypassed.
- Observe and inspect. Read board minutes, policies, delegations of authority and hotline logs. Look at how the entity handled past problems.
- Corroborate. Compare what management says with what the records show. A code of conduct that has never been enforced is a document, not a control.
- Consider incentives. Bonus plans, debt covenants, owner reliance on the numbers and pressure to hit targets bear on fraud risk. See fraud risk factors and the fraud triangle.
- Conclude on each element, and then overall, in the file. State the conclusion and the effect on the audit.
The internal control questionnaire and walkthroughs guide and the fraud inquiry and brainstorming memo support this work.
Positive and negative indicators
| Positive | Negative |
|---|---|
| Management corrects errors openly and promptly | Management dismisses control issues as bureaucracy |
| Board or owner reviews financial results and asks questions | No review of financial results by anyone other than the preparer |
| Clear approval limits that people follow | Overrides of approval limits are routine |
| Stable, qualified finance staff | High turnover in key finance roles; reliance on a single person |
| A channel for reporting concerns that is used | No reporting channel, or a history of retaliation |
| Prior-year adjustments are few and explained | Many late adjustments and repeated findings |
Worked example
Illustrative. A 45-employee manufacturer with $22 million of revenue is owned by two brothers. One brother runs operations and the other is CFO. There is no board and no audit committee. The bookkeeper reports to the CFO and has been there for two years.
| Principle | Rating | Basis |
|---|---|---|
| 1. Integrity and ethical values | Adequate | No written code, but no history of misconduct; owners accept corrections of errors |
| 2. Oversight | Weak | No independent oversight; one brother is both approver and reviewer of the other's work |
| 3. Structure and authority | Adequate | Signing limits are known and observed |
| 4. Competence | Weak | Bookkeeper has no accounting training; year-end close depends on one person |
| 5. Accountability | Adequate | Owners review results monthly and question variances |
Overall conclusion: the environment gives a limited foundation. Oversight and competence are weak, which undermines reliance on manual controls prepared by the bookkeeper.
Effect on the audit:
- Identify a financial statement level risk related to management override and reliance on one person.
- Perform journal entry testing, which is required whatever the risk assessment. See journal entry testing and management override of controls.
- Limit reliance on controls and plan more substantive work, with more testing at year end.
- Staff the engagement with more experienced people and add an element of unpredictability to selection. See element of unpredictability.
- Communicate the deficiencies in writing under AU-C 265. See management letter.
Suggested client remediation, low in cost: an outside CPA or advisor reviews the monthly close and bank reconciliations, a written authority matrix, and a hotline or an outside contact for staff.
Owner-managed entities
An owner-manager can be a strong control environment: close attention, personal knowledge of the business and direct review. It can also be a weak one, because the owner can override everything and no one checks the owner. The auditor evaluates what compensating oversight exists, rather than concluding the environment is absent.
What clients should document
- A code of conduct and conflict-of-interest policy, with annual acknowledgments.
- An authority matrix: who can approve purchases, payments, hires, journal entries and vendor changes.
- Board or owner minutes showing review of financial results.
- Job descriptions and training plans for finance roles.
- A process for reporting concerns and following up.
- The entity's response to prior findings.
Common mistakes
- Concluding "adequate" because the owner says so, without corroboration.
- Treating the control environment as a questionnaire exercise.
- Rating each principle in isolation and missing the overall effect.
- Failing to link a weak environment to the audit plan.
- Ignoring that the person who sets the tone is also the person who can override controls.
FAQ
What is the control environment?
The standards, processes and structures that set the tone for internal control: integrity, oversight, structure, competence and accountability.
Does a small company have a control environment?
Yes. It may be informal, with owner involvement in place of a board. The auditor evaluates what is actually in place.
How does a weak control environment affect the audit?
It can lead to risks at the financial statement level and overall responses such as more experienced staff, more substantive procedures, unpredictability and testing nearer year end.
Is tone at the top the same as the control environment?
Tone at the top is the most visible part of it. The control environment also includes structure, competence and accountability.
Do I communicate control environment weaknesses to the client?
Significant deficiencies and material weaknesses are communicated in writing under AU-C 265. Other matters can be communicated at the auditor's discretion.
Sources
- AICPA, AU-C section 315 (as amended by SAS No. 145), requirements on the control environment; AU-C section 330 on overall responses; AU-C section 265; AU-C section 240
- COSO, Internal Control, Integrated Framework (2013), principles 1 through 5
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error