Definition
Control activities are the actions established through policies and procedures that help ensure management's directives to mitigate risks are carried out. Examples include approvals, reconciliations, verifications, physical safeguards, performance reviews and segregation of duties. They can be manual or automated and preventive or detective.
Why it matters in an audit or review
AU-C 315 narrows the auditor's focus to the controls relevant to the audit: those over significant risks, over journal entries, those the auditor plans to test, and others the auditor judges appropriate. For those, the auditor evaluates design and determines implementation. Most reliance on controls in practice sits here, so the quality of the documentation of each control (who, what, how often, what evidence) decides how efficiently they can be tested.
Example
A client's purchasing control: a purchase order above a set amount (illustrative: $5,000) needs a department head's approval in the system, and a three-way match to receipt and invoice must clear before payment. The auditor identifies this as relevant to completeness and accuracy of payables, walks one purchase through, and tests a sample of 25 invoices for approval and match.
Common mistakes
Writing a control as 'management reviews the reconciliation' without saying what the reviewer looks at, how often, and what evidence remains.
Sources
- AICPA, AU-C Section 315 (as amended by SAS No. 145), controls relevant to the audit and control activities
- COSO, Internal Control, Integrated Framework (2013), Principles 10 to 12
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error