Smaller companies run many controls through the people at the top. The CFO signs every payment run, the owner looks at the bank activity, the controller reviews every journal entry. The SEC's interpretive guidance for management accepts this as evidence in the right circumstances and spells out when it does not work. This post explains the rule, the limits and the documentation that makes it count.
What the guidance says
In smaller companies, management's daily interaction with its controls may provide it with sufficient knowledge about their operation to evaluate the operation of ICFR. That knowledge comes from ongoing direct involvement with, and direct supervision of, the execution of the control by the people responsible for assessing ICFR effectiveness. Management considers its facts and circumstances. Daily interaction may be sufficient when the operation of controls is centralized and the number of personnel involved is limited. Daily interaction in companies with multiple management reporting layers or operating segments would generally not provide sufficient evidence, because those responsible for the assessment would not ordinarily be sufficiently knowledgeable about the operation of the controls. In those situations management ordinarily uses direct testing or ongoing monitoring-type procedures.
The guidance also says that where daily interaction is the evidence, management's documentation would include how the interaction provided sufficient evidence. That documentation may include memoranda, emails and instructions or directions to personnel.
The guidance separately explains that the nature of evidence depends on the ICFR risk of the control. For high-risk controls, evidence ordinarily consists of direct testing or ongoing monitoring by highly objective people. Daily interaction by the person who performs the control carries the least objectivity, so it fits low-risk controls best. See /us/blog/control-testing-evidence-by-risk-direct-tests-versus-ongoing-monitoring.
When it works and when it does not
| Condition | Supports reliance on daily interaction | Weakens reliance |
|---|---|---|
| Structure | One location, one finance team, few layers | Several segments or management layers |
| Control owner | The person assessing ICFR performs or directly supervises the control | A delegate several levels down performs it |
| Risk | Low or moderate ICFR risk | High-risk estimates, related parties, complex judgments |
| Change | Stable processes and systems | New system, acquisition, staff turnover |
| Objectivity | A second person sees the result | The same person performs and judges effectiveness |
Worked example
A 40-person manufacturer with $35 million of revenue has a CFO, a controller and three accountants. Controls over disbursements include: the controller prepares the weekly payment run; the CFO reviews the payment list against approved invoices and releases it in the bank portal; the CFO reviews vendor setup changes monthly.
What the CFO can rely on. The CFO personally releases each payment run and personally reviews vendor changes. That is direct involvement with and supervision of execution. For payment release, the CFO's direct knowledge is strong evidence of operation.
What the CFO cannot rely on without more. The CFO assesses ICFR and also performs the review. Independence of evaluation is weak, since the person judging effectiveness is the person operating the control. For a high-risk control such as vendor master changes, the guidance suggests adding a more objective source. A reasonable step is for an outside CPA or the board chair to reperform the monthly vendor review for two months and to compare the vendor list to employee addresses.
Documentation. A one-page memo for each control states who performs it, how often, what the CFO personally observed or did during the year, the evidence retained (signed payment lists, bank portal approval logs, review notes), and the conclusion. Retain the portal log exports, which show who approved each release and when.
What not to claim
- That daily interaction proves a control operated in months the CFO was absent. Cover absences with a backup and evidence.
- That a strong control environment replaces evidence. The guidance says a strong control environment does not eliminate the need to evaluate operation of the control in some manner.
- That daily interaction is enough in a company that has added a second location or segment.
Smaller-company relief elsewhere in the guidance
Documentation can be tailored to size and complexity, and does not need to include every control that exists in a process. Entity-level controls may in some cases address a risk at a level of precision that makes additional lower-level controls unnecessary. See /us/blog/entity-level-controls-under-sec-guidance-when-they-address-a-risk-directly.
A short documentation template
For each control that relies on daily interaction, one page is enough. The headings that match the guidance are: the control and the risk it addresses; who performs it and who assesses it; how often it operates; what the assessor personally did, saw or reviewed during the year, with dates; what documents remain, such as signed lists, portal logs, review emails and instructions to staff; any periods the assessor was absent and who covered them; and the conclusion. Keep the one-pagers in a single folder indexed by control ID so the year-end conclusion memo can point to them.
Add a line on objectivity. The guidance recognizes that personnel have varying degrees of objectivity depending on their job function, their relationship to the control being evaluated and their level of authority, and that people whose core function is permanently serving as a testing or compliance authority, such as internal auditors, are normally expected to be the most objective. In a company with no such function, a periodic reperformance by an outside accountant is a practical substitute for the controls rated higher risk.
For auditors and advisors
A CPA firm assisting such a client should help the company build the evidence trail rather than rely on interviews. Typical deliverables: control narratives of one page each, an evidence checklist per control, a monthly sign-off log, and a short independent test cycle by someone other than the control performer. Where the firm audits the company, independence limits apply to management functions, so the firm should keep its advisory role clearly separate from management's decisions.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- SEC, Release No. 33-8810, Section II.A.2.b (Implementing procedures to evaluate evidence of the operation of ICFR) and Section II.A.2.c (evidential matter): https://www.sec.gov/rules/interp/2007/33-8810.pdf
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error