Internal control over financial reporting, or ICFR, is the set of controls that makes the financial statements reliable. Auditors meet it in three ways: understanding it to assess risk, testing it when they plan to rely on it, and evaluating the deficiencies they find. Each uses the same two ideas: whether a control is designed to work, and whether it did.
This guide covers the definition, who has to report on ICFR, how design and operating effectiveness differ, and how to evaluate deficiencies. For the framework see the COSO guide, and for test procedures see the control testing guide.
What is ICFR?
The SEC defines internal control over financial reporting in its rules for issuers as a process designed by, or under the supervision of, the principal executive and principal financial officers, effected by the board, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP. It includes policies and procedures that:
- pertain to the maintenance of records that fairly reflect, in reasonable detail, transactions and dispositions of assets
- provide reasonable assurance that transactions are recorded as needed to prepare GAAP financial statements, and that receipts and expenditures are made only in accordance with management and board authorization
- provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of assets that could have a material effect on the financial statements
That wording is in 17 CFR 240.13a-15(f). Private companies are not subject to the SEC rule, but the concept is the same, and COSO's framework is the usual benchmark.
Who has to report on ICFR?
- Issuers. Section 404(a) of the Sarbanes-Oxley Act requires management of an issuer to assess and report on ICFR effectiveness. Section 404(b) requires an auditor attestation for issuers that are accelerated or large accelerated filers. The PCAOB's AS 2201 governs that integrated audit.
- Private companies. No federal law requires a management report or an auditor opinion on ICFR. In a GAAS audit, the auditor obtains an understanding of internal control under AU-C 315, tests controls only if relying on them, and communicates significant deficiencies and material weaknesses under AU-C 265. A client can engage an auditor for an integrated audit of ICFR for a nonissuer under AU-C 940 if a lender, regulator or the board asks for it.
- Federal award recipients. Internal control over compliance for major programs is tested in a single audit. See the compliance audit guide.
Design effectiveness vs operating effectiveness
| Design effectiveness | Operating effectiveness | |
|---|---|---|
| Question | If the control operates as described, can it prevent, or detect and correct, a material misstatement for the relevant assertion? | Did the control operate as designed, consistently, by someone with the authority and competence to perform it? |
| Evidence | Inquiry, inspection of documentation, walkthrough | Tests of the control over the period: inspection, observation, reperformance |
| Typical failure | No control exists for a risk, the control is not precise enough, the reviewer lacks authority | Control skipped, done late, done by an unauthorized person, or not evidenced |
| Needed for | Understanding and, for some controls, evaluating design and implementation | Reliance on the control to reduce substantive testing |
Under AU-C 315 as revised by SAS 145, the auditor evaluates design and determines implementation for certain controls: those addressing significant risks, journal entry controls, and controls where substantive procedures alone cannot provide sufficient appropriate evidence, along with controls the auditor plans to test. The SAS 145 guide covers the list. Operating effectiveness is tested only for controls the auditor will rely on, or where substantive procedures alone are not enough.
A control that is not designed well cannot be operating effectively in any useful sense. A well-designed control that nobody performs fails on operation. Document both conclusions separately.
How are deficiencies evaluated under AU-C 265?
AU-C 265 defines three tiers:
- A deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis.
- A significant deficiency is a deficiency, or combination of deficiencies, less severe than a material weakness yet important enough to merit attention by those charged with governance.
- A material weakness is a deficiency, or combination, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected, on a timely basis.
The severity evaluation turns on the likelihood and the magnitude of a potential misstatement, not on whether a misstatement actually occurred. Steps:
- Describe the deficiency and the risk it leaves open. Which accounts, assertions and transaction flows?
- Assess likelihood. Is a misstatement reasonably possible given the nature of the control gap, the volume of activity and the history of errors?
- Assess magnitude. What is the maximum amount that could be misstated relative to materiality, considering exposure and volume?
- Consider interactions. Do other deficiencies affect the same account or assertion? Evaluate them in combination.
- Consider compensating controls. Only a control that operates at a level of precision to prevent or detect a material misstatement counts, and the auditor needs evidence that it operates.
- Check the material weakness indicators. AU-C 265 lists fraud by senior management, a restatement to correct a material misstatement, the auditor identifying a material misstatement that the entity's controls would not have caught, and ineffective oversight by those charged with governance.
- Conclude, communicate and document. Significant deficiencies and material weaknesses go to those charged with governance and to management in writing, on a timely basis, and no later than 60 days after the report release date. Other deficiencies that merit management's attention are communicated orally or in writing. A template is in the internal control communication letter and the deficiency evaluation worksheet.
The written communication states that the purpose of the audit was to express an opinion on the financial statements, not to give an opinion on internal control. Identifying a material weakness does not by itself mean the financial statements are materially misstated, and it does not change the opinion on them.
Worked example (illustrative)
A client with overall materiality of $300,000 has three findings.
| Finding | Facts | Evaluation | Conclusion |
|---|---|---|---|
| 1. No review of manual journal entries | About 30 manual entries a month; the largest this year was $480,000; no detective control found | A misstatement above materiality is reasonably possible and nothing would catch it; JE controls are tied to management override risk | Material weakness |
| 2. Bank reconciliation prepared by the accounts payable clerk who can also sign checks | Cash disbursements about $9,000,000; the controller reviews the bank statements monthly and the auditor tested that review | The compensating review operated, but the segregation gap in a fraud-susceptible account merits governance attention | Significant deficiency |
| 3. No documented review of the allowance estimate | Potential misstatement of $90,000, below materiality; the auditor proposed a $70,000 adjustment | Below materiality and no interaction with finding 1 or 2 | Deficiency, communicated to management |
Findings 1 and 2 go to those charged with governance in writing; finding 3 goes to management. The opinion on the financial statements is not modified by the material weakness, and the $70,000 adjustment is evaluated as a misstatement.
What to do with the results
- Remediation. Management designs the fix. If it is implemented after year end, document when and whether the auditor can test it.
- Reliance. If a control was ineffective, the auditor cannot reduce substantive testing based on it and expands substantive work for the related assertions.
- Future audits. Carry the finding and its status into the next planning memo.
Mistakes to avoid
- Evaluating severity by whether a misstatement occurred rather than whether one could.
- Counting a compensating control without testing it.
- Evaluating each deficiency alone and never in combination.
- Communicating to management but not to those charged with governance.
- Treating a walkthrough as proof of operating effectiveness.
Frequently asked questions
What is the difference between a deficiency and a material weakness?
Both are control failures. A material weakness is severe enough that there is a reasonable possibility of a material misstatement not being prevented, or detected and corrected, on a timely basis.
Does a private company need an ICFR audit?
No law requires it. A lender, regulator or board may ask for one, and an auditor can perform it under AU-C 940. Otherwise the auditor tests controls only as needed and communicates deficiencies under AU-C 265.
How often must controls be tested?
Only controls the auditor intends to rely on are tested for operating effectiveness, for the period of reliance. Frequency and sample size depend on how often the control operates and the risk.
Is a significant deficiency worse than a deficiency?
Yes. It is important enough to merit the attention of those charged with governance and must be communicated in writing.
Sources
- SEC, 17 CFR 240.13a-15(f), definition of internal control over financial reporting: https://www.ecfr.gov/current/title-17/section-240.13a-15
- SEC, 17 CFR 210.1-02, definitions of material weakness and significant deficiency: https://www.ecfr.gov/current/title-17/section-210.1-02
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
- AICPA, AU-C Section 315, as revised by SAS No. 145; AU-C Section 940
- PCAOB, AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
- COSO, Internal Control: Integrated Framework (2013)
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · SEC reporting and PCAOB audits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error