"Entity-level controls" covers a wide range: the tone set by the board, the code of conduct, the company's risk assessment, the monthly review of results, the period-end close. Some of them only influence other controls. Others are precise enough to stand in for process-level controls and shorten the testing plan. The SEC's interpretive guidance for management distinguishes between them, and getting the distinction right drives how much control work a company performs.
What the guidance says
The guidance has management consider entity-level controls when identifying financial reporting risks and related controls. The nature of the entity-level control and how it relates to the financial reporting element matters: the more indirect the relationship, the less effective the control may be in preventing or detecting a misstatement. A footnote distinguishes directly related controls, those designed to have a specific effect on a financial reporting element (controls ensuring personnel properly count and record the annual physical inventory relate directly to the existence of the inventory), from indirect ones.
It describes three kinds.
- Indirect effect. Some, such as certain control environment controls, have an important but indirect effect on the likelihood that a misstatement will be prevented or detected on a timely basis. They might affect the other controls management identifies. It is unlikely that management would rely on only this type to address a financial reporting risk.
- Monitoring controls. Others are designed to identify possible breakdowns in lower-level controls but not, by themselves, to address financial reporting risks adequately. An entity-level control that monitors operating results may detect potential misstatements and trigger investigation of whether lower-level controls broke down. If the amount of potential misstatement that could exist before the monitoring control detects it is too high, the control may not address the risk.
- Precise entity-level controls. Entity-level controls may be designed to operate at the process, application, transaction or account level, and with a level of precision that adequately prevents or detects on a timely basis misstatements in one or more financial reporting elements that could be material. In those cases, management may not need to identify or evaluate additional controls for that risk.
The guidance's own example: if management determines that the risk of misstatement in interest expense is adequately addressed by a control within the period-end financial reporting process, which is an entity-level control, management may not need to identify any additional controls for interest expense.
How entity-level controls affect evidence
The guidance says management's assessment of ICFR risk considers the impact of entity-level controls such as the relative strengths and weaknesses of the control environment, which may influence the judgment about the risk of failure of particular controls. A highly effective control environment can influence the evidence needed, but a strong control environment does not eliminate the need to evaluate the operation of the control in some manner.
Worked example
A company with $240 million of revenue, materiality of $2.4 million.
| Entity-level control | Type | Effect |
|---|---|---|
| Code of conduct with annual acknowledgment and hotline overseen by the audit committee | Indirect (control environment) | Supports other controls; does not address a specific misstatement risk |
| Monthly review of results against budget by the CFO and business unit heads, investigating variances above $150,000 | Monitoring | Can detect a misstatement of $150,000 or more in a line, but one at $100,000 repeated across lines passes; supplements, does not replace, lower-level controls for high-risk accounts |
| Quarterly reconciliation of the debt schedule to lender statements and recomputation of interest by the treasurer, reviewed by the controller | Precise, account level | Addresses interest expense and debt balance directly; no additional controls needed for that risk |
| Period-end close checklist with account reconciliation sign-offs for all balance sheet accounts | Precise for low-judgment accounts | Addresses existence and accuracy for accounts such as prepaid expenses and accrued payroll |
The monitoring control illustrates the threshold issue. Compare $150,000 against performance materiality of $1.8 million (75 percent of materiality). A single line misstatement of $1 million would be flagged. The risk is accumulation of many errors below the threshold. For revenue, a high-risk account with judgment, management does not rely on the monitoring control alone and adds a process-level cutoff review.
The debt interest control shows efficient scoping: instead of documenting and testing separate controls for each loan, the company tests the one reconciliation and recomputation control that operates at the precision needed. See /us/blog/management-review-controls-precision-design-and-evidence.
Documentation
For each entity-level control that management relies on to address a risk, document the risk it addresses, why it operates at sufficient precision (threshold, population and frequency), who performs it, and evidence of operation. For those that have only indirect effect, document how they influence the risk assessment of other controls. The SEC guidance says documentation of entity-level and other pervasive elements is part of the reasonable support for the assessment. See /us/blog/icfr-documentation-what-management-must-keep-under-sec-guidance.
Where internal audit and the audit committee fit
Entity-level controls often sit with the audit committee and the board: oversight of financial reporting, hotline procedures, review of significant estimates. Ineffective audit committee oversight of external financial reporting and ICFR is one of the four indicators of a material weakness in the guidance. See /us/glossary/entity-level-controls and /us/blog/control-environment-assessment-guide.
Mistakes to avoid
- Calling a monthly flux review a complete control over revenue.
- Relying on tone at the top alone as the control over any specific account.
- Skipping documentation of the period-end close because it is "just the process."
- Ignoring the threshold in monitoring controls.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- SEC, Release No. 33-8810, Section II.A.1.c (Consideration of entity-level controls), including footnote 33, and Section II.A.2.a: https://www.sec.gov/rules/interp/2007/33-8810.pdf
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error