"How much testing is enough?" is the question every ICFR program and every control-reliance audit has to answer. The SEC's interpretive guidance for management answers it with a risk-based method, not a sample-size table: more evidence for higher risk, less for lower. This post explains the method and builds an evidence plan.
Two risks drive the amount of evidence
The guidance has management evaluate the risk of each control it relies on by looking at two things: the misstatement risk of the financial reporting element the control addresses, and the risk that the control fails. It presents them as a matrix: as either risk rises, more evidence is needed.
Misstatement risk of the account. Considers materiality of the element relative to the amount that would be material, and susceptibility to misstatement. Factors named in the guidance include whether the element involves judgment in determining recorded amounts, is susceptible to fraud, has complex accounting requirements, experiences changes in the nature or volume of underlying transactions, or is sensitive to changes in the environment. Related party transactions, critical accounting policies and critical accounting estimates generally carry higher misstatement risk.
Risk of control failure. Factors include the type of control (manual or automated) and how often it operates, its complexity, the risk of management override, the judgment needed to operate it, the competence of the people performing or monitoring it, changes in key personnel, the nature and materiality of the misstatements it prevents or detects, how much it depends on other controls such as IT general controls, and evidence from prior years.
Two kinds of evidence
The guidance says evidence comes from direct tests of controls, ongoing monitoring, or both.
- Direct tests are ordinarily performed periodically by individuals with a high degree of objectivity relative to the controls tested. They give evidence as of a point in time and can show whether ongoing monitoring is reliable.
- Ongoing monitoring is management's normal, recurring activity: self-assessments and analysis of performance measures designed to track control operation. Self-assessment includes work by the people who operate the control and by managers who do not. The guidance says evidence from self-assessments by the operators is weaker because the evaluator is less objective.
As risk rises, management ordinarily adjusts the nature of the evidence: more objective personnel in monitoring, more direct testing to validate it, or longer periods covered by direct tests. At high risk, evidence ordinarily consists of direct testing or ongoing monitoring by highly objective people. If monitoring relies on people who are not adequately objective, supplement with direct tests by people independent of the control. At low risk, ongoing monitoring may suffice with no direct testing. In all cases, evidence should cover a reasonable period during the year, including year-end.
Evidence plan example
A company with six key controls.
| Control | Misstatement risk | Control failure risk | Evidence plan |
|---|---|---|---|
| Quarterly allowance review (judgment, manual) | High | High | Direct test by internal audit each quarter; reperform and challenge assumptions |
| Revenue cutoff review | High | Medium | Direct test twice a year (interim and year-end); monthly self-assessment by the revenue manager reviewed by the controller |
| Three-way match (automated, stable system, ITGC effective) | Medium | Low | Test configuration once, rely on ITGC testing; track exception report as monitoring |
| Bank reconciliation review | Medium | Medium | Quarterly direct test of one month; monthly sign-off retained |
| Payroll register review | Medium | Low | Ongoing monitoring: HR and payroll supervisors' sign-offs; annual direct test of one pay period |
| Fixed asset additions approval | Low | Low | Ongoing monitoring: capital request log review; no direct test in the period |
The plan is a judgment document. It states what evidence is chosen and why, and the reasons trace to the two risks.
Smaller companies
The guidance says management's daily interaction with controls may provide enough knowledge to evaluate operating effectiveness in smaller companies, specifically knowledge from ongoing direct involvement with and direct supervision of the control's execution by those responsible for assessing ICFR. It says daily interaction may be sufficient when operation is centralized and personnel limited, and generally is not sufficient in companies with multiple management reporting layers or operating segments. The documentation should show how the interaction provided evidence. See /us/blog/smaller-company-icfr-evidence-from-daily-interaction-with-controls.
What counts as sufficient evidence
The guidance asks management to consider whether the control operated as designed, how it was applied, how consistently, and whether the person performing it had the authority and competence. If the control did not operate effectively, a deficiency exists and must be evaluated. It also says that a strong control environment does not eliminate the need to evaluate the operation of the control in some manner.
The guidance does not prescribe sample sizes, and this post does not either. Teams that use sample size tables from firm methodologies or the AICPA's non-authoritative audit sampling guidance should document the table they used and why it fits the control's frequency and risk. The logic runs the same way: more occurrences of a control mean more items tested, and higher risk means more items or more periods.
Mistakes to avoid
- A flat sample for every control regardless of risk.
- Relying on operator self-assessment for high-risk controls.
- Direct testing only at one point in time with no look at the rest of the year.
- No documentation of why lighter evidence was chosen for lower-risk controls.
Related reading
- /us/blog/control-testing-guide
- /us/blog/management-review-controls-precision-design-and-evidence
- /us/blog/risk-register-scoring-likelihood-impact-and-residual-risk
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- SEC, Release No. 33-8810, Section II.A.2, Evaluating Evidence of the Operating Effectiveness of ICFR (sub-sections a to c): https://www.sec.gov/rules/interp/2007/33-8810.pdf
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error