Definition
A compensating control is a control that operates at a level of precision that would prevent, or detect and correct, a material misstatement that a deficient control failed to cover. It is considered when evaluating the severity of a deficiency. It does not fix the deficiency, but it can lower the severity.
Why it matters in an audit or review
The auditor treats a compensating control as a control to test, not as a statement from management. To count, it has to be designed precisely enough, operate throughout the period, and be performed by someone with authority and competence. Under AU-C 265 the auditor looks at it when deciding whether a deficiency rises to a significant deficiency or material weakness.
Example
An owner-manager cannot segregate duties between the bookkeeper and the check signer. As a compensating control, the owner reviews the bank statement and each paid check image every month and initials the statement. The auditor tests three months, finds the review evidenced and the owner asking questions on unusual items, and concludes the lack of segregation is a deficiency but not a significant deficiency.
Common mistakes
Accepting a high-level review such as 'owner looks at financials' as a compensating control. It needs enough precision to catch a misstatement of the relevant size.
Sources
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit (evaluating severity; compensating controls)
- AICPA, AU-C Section 315 (as amended by SAS No. 145)
- PCAOB, AS 2201, An Audit of Internal Control Over Financial Reporting (compensating controls, precision), for the issuer-audit source of the precision test
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error