Management Review Controls: Precision, Design and the Evidence That Supports Them

Management review controls are the controls auditors and management find hardest to document. "Controller reviewed the flux analysis" is an assertion, not a control description. This post explains what makes a review control precise enough to rely on, using the SEC's interpretive guidance for management, and walks through a complete example.

Why precision matters

The SEC's guidance says that compensating controls have a mitigating effect only if they operate at a level of precision that would prevent or detect a misstatement that could be material. The guidance states that test for compensating controls. The same logic is a sound design test for any control that relies on a review. A review of a $120 million revenue line that investigates only movements over $5 million cannot detect a misstatement of $800,000, even if materiality is $1 million. Precision is the size of misstatement the control would catch, and it must be smaller than the amount that could be material.

The same guidance, in its discussion of the likelihood that a control fails, lists factors that apply directly to review controls: the complexity of the control, the judgment required to operate it, the competence of the personnel who perform it, changes in key personnel, the risk of management override, and the degree to which the control relies on other controls such as IT general controls. It also notes that controls requiring significant judgment carry higher risk of failure than non-complex controls.

Elements of a well-designed review control

1. Who. A named role with the authority and competence to perform the review. The SEC guidance considers whether the person performing the control has the necessary authority and competence.
2. What is reviewed. The specific report or schedule, and where the data comes from. If the report is system-generated, the control depends on its completeness and accuracy and on the IT general controls over the source system. See /us/blog/ipe-and-it-dependent-controls-testing-reports-used-in-key-controls.
3. Expectation. What the reviewer expects the numbers to be, based on a defined source: budget, prior period, a volume driver, a contract.
4. Threshold. The size of variance that triggers investigation, set below the amount that could be material, and stated as a number or a formula.
5. Investigation. What the reviewer does with each variance over the threshold: obtains an explanation, corroborates it with evidence outside the preparer's account, and decides whether an adjustment is needed.
6. Resolution and evidence. How the outcome is recorded: sign-off with date, notes on each investigated item, and the corrections posted.
7. Timing. When in the close the review occurs relative to when statements are issued.

Worked example: monthly revenue flux review

Setting: a company with $180 million of annual revenue. Overall materiality is $1.8 million; performance materiality is $1.2 million.

Control description. Each month, by business day 8, the revenue accounting manager reviews the revenue by product line report from the general ledger against (a) the prior month, (b) the same month last year and (c) the volume-times-price expectation computed from the order system. The manager investigates every product line where the difference between actual and the volume-times-price expectation exceeds the greater of 3 percent of the line or $75,000. For each item, the manager obtains an explanation from sales operations, agrees it to invoices, contracts or shipping records, and records the conclusion in the review workbook. The controller reviews the manager's workbook and signs by business day 10.

Precision. The $75,000 floor is a small fraction of performance materiality, so a single product line misstatement of that size would be flagged. A pattern of understatements just under the threshold across ten lines is a design weakness, so the control also requires the manager to compare the sum of all unflagged differences to $300,000 and investigate if exceeded.

Evidence of the control. A reviewer who writes "reviewed, OK" has left no evidence of the investigation. The evidence package for one month includes: the report with the date it was run and the filters used, the expectation computation, a list of flagged lines with the explanation and corroboration for each, the sum of unflagged differences, the controller's sign-off with date, and any entries posted.

Testing. An auditor or internal tester selects months across the year, reperforms the threshold test on the same data, picks flagged items, and checks the corroboration. Then the tester looks at unflagged lines for items that should have been flagged. A control that never flags anything has either perfect data or a threshold that is too high.

Evidence the SEC guidance accepts

The guidance says management's evaluation can use direct tests of controls, ongoing monitoring, or both. It adds that activities performed for other reasons, such as day-to-day management of operations, may also provide relevant evidence, and that documentation should include the basis for management's assessment and the methods used to gather and evaluate evidence. For a review control, the monthly workbook is the day-to-day evidence. A tester's reperformance is the direct test.

Common failures

• No threshold. The reviewer applies judgment each month, which cannot be reperformed.
• Threshold above materiality. The control cannot detect a material error.
• Investigation stops at the first explanation. "Timing" is accepted without proof.
• Reviewer lacks independent data. The reviewer relies on the preparer's explanation with nothing to corroborate it.
• No evidence of what was considered. A signature alone does not show what was reviewed.
• Reviewer turnover. The SEC guidance lists changes in key personnel as a factor in the likelihood of control failure, so document the handover when reviewers change.

Related reading

• /us/blog/control-testing-guide
• /us/blog/flux-variance-analysis-guide
• /us/blog/icfr-design-vs-operating-effectiveness-and-deficiency-evaluation

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• SEC, Release No. 33-8810, Section II.A.2 (evaluating evidence of operating effectiveness; factors in the likelihood that a control fails) and Section II.B.1 (compensating controls and precision): https://www.sec.gov/rules/interp/2007/33-8810.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error