A company with three warehouses, two sales offices and a shared services center cannot test every control at every site every year. It also cannot assume that a clean result at headquarters covers the field. The SEC's interpretive guidance for management addresses multiple locations directly, and its approach lets a team put its effort where the risk is. This post follows that guidance and shows a scoping table.
What the guidance says
Management's consideration of financial reporting risks generally includes all of its locations or business units. Management may decide, when identifying risks, that some locations are so insignificant that no further evaluation procedures are needed.
Management may determine that financial reporting risks are adequately addressed by controls that operate centrally. In that case the approach is similar to that of a single-location business.
When the controls needed to address the risks operate at more than one location or business unit, management would generally evaluate evidence of operation at the individual locations. Two outcomes follow from the risk of those controls (assessed as described in the guidance's section on ICFR risk):
- If the ICFR risk of the location-level controls is low, evidence from self-assessment or other ongoing monitoring, combined with evidence from a centralized control that monitors results of operations at individual locations, may be sufficient.
- If complexity or judgment in operating the controls at a location makes the risk of failure high, more evidence is needed at that location.
Management should generally consider the risk characteristics of controls for each financial reporting element and not make one judgment for all controls at a location. It should consider location-specific risks that might affect whether a control fails, and pervasive risk factors at a location that cause all or most controls there to be considered higher risk.
Scoping steps
- List locations and the financial statement amounts each contributes (revenue, assets, payroll, inventory).
- Identify insignificant locations. Document the quantitative basis and a qualitative check that no unusual risks sit there.
- Map each key control to where it operates: central, location, or both.
- Rate ICFR risk by control and by location, considering location-specific factors such as new management, a system conversion, a history of errors, or local reporting practices.
- Choose evidence by risk: direct testing at higher-risk locations, ongoing monitoring plus a central control for lower-risk ones.
- Do not rotate controls out of scope. The Commission considered and declined to adopt a rotation concept. In Part III.E of the release it says management cannot include the controls for a particular location or process in scope only once every three years, or exclude controls based on prior-year results. Vary the nature, timing and extent of evidence by risk instead: monitoring plus a central control at lower-risk locations, direct tests where risk is higher.
Worked example: three-site distributor
Revenue $150 million. Sites: Dallas (55 percent of revenue), Atlanta (35 percent), Reno (10 percent). Central finance in Dallas performs payment processing, payroll and the close. Each site performs receiving, inventory counts and customer credit decisions.
| Control | Where it operates | ICFR risk | Evidence plan |
|---|---|---|---|
| Payment approval and release | Central | Medium | Test at central location only |
| Payroll processing | Central | Medium | Test at central location only |
| Month-end close and reconciliations | Central | Medium | Test centrally |
| Inventory cycle counts | Each site | High at Dallas and Atlanta (volume, judgment on obsolescence); medium at Reno | Direct test at Dallas and Atlanta each year; at Reno, evidence from self-assessment and the central monthly inventory variance review, with a smaller direct test sample |
| Receiving and three-way match inputs | Each site | Medium | Sample at Dallas and Atlanta; central match exception report as monitoring |
| Customer credit approvals | Each site | Medium; high at Atlanta (recent change of credit manager, two exceptions in the prior-period review) | Direct test at Atlanta; self-assessment plus central credit report at others |
Reno is 10 percent of revenue but holds inventory of a product line with greater obsolescence risk, so management does not classify it as insignificant. It documents the reasoning and uses the central monitoring control in the plan. Atlanta's credit control is rated higher because of the location-specific factors the guidance names: change in key personnel and prior exceptions.
Pervasive risk factors
If a location has a pervasive problem, such as recent turnover of the whole local finance team or a system migration mid-year, the guidance says such factors can cause all controls, or a majority of controls, at that location to be considered higher risk. In the example, if Reno migrated to a new warehouse system in the fourth quarter, the team would rate its controls higher risk and keep the added direct evidence there that year.
Central controls
The efficiency of central monitoring depends on its precision. A central review of inventory variances by site is useful only if it investigates variances at a level small enough to detect a material misstatement, and if the data it uses is reliable. See /us/blog/entity-level-controls-under-sec-guidance-when-they-address-a-risk-directly and /us/blog/ipe-and-it-dependent-controls-testing-reports-used-in-key-controls.
Shared services and outsourced locations
Where a shared services center or a third-party provider performs controls for several entities, treat the center as a location with its own controls and, for third parties, obtain a service organization report or other evidence. See /us/blog/third-party-and-service-organization-risk-in-icfr-and-internal-audit.
Internal audit coverage
The internal audit plan should reflect the same location view. IIA Standard 13.3 requires the scope of each engagement to specify activities, locations, processes, systems and time period. Internal audit may rotate site audits within a risk-based plan; the implementation considerations for Standard 9.4 list time since last engagement among the reasons for selecting an engagement. That choice belongs to the internal audit plan. It does not reduce the annual evaluation of the controls management relies on for ICFR.
Mistakes to avoid
- Testing only headquarters and calling the result company-wide.
- Excluding a small location without checking the qualitative risk.
- One risk rating per location instead of per control.
- Leaving a location's controls out of the evaluation because they were tested in a prior year.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- SEC, Release No. 33-8810, Section II.A.3, Multiple Location Considerations (including footnote 45), and Section III.E (rotation): https://www.sec.gov/rules/interp/2007/33-8810.pdf
- The IIA, Global Internal Audit Standards (2024), Standards 9.4 and 13.3: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error