Definition
Entity-level controls is a practice term, not an AU-C definition. It refers to controls that apply across the organization, which AU-C 315 describes through the components of the system of internal control. They include the control environment, management's risk assessment process, the process to monitor internal control, the period-end financial reporting process and controls over management override such as board oversight. Some work indirectly through other controls and some work directly at a precise level.
Why it matters in an audit or review
The strength of entity-level controls tells the auditor how much to rely on process-level controls. Strong ones, like a precise monthly management review of variances, can sometimes support a lower risk assessment. Indirect ones, such as ethics policies, usually cannot replace testing of process-level controls. Weak ones raise financial statement level risks and call for overall responses.
Example
A company's CFO reviews a monthly flux analysis of every P&L line against budget and prior year, using a threshold of 5 percent or $20,000 (illustrative), and documents explanations. The auditor tests whether the review is precise enough to detect a material error in operating expenses, and, if it is, may reduce substantive testing of those accounts.
Common mistakes
Calling an entity-level control precise enough to rely on without testing the threshold, follow-up and evidence.
Sources
- AICPA, AU-C Section 315, Identifying and Assessing the Risks of Material Misstatement (as amended by SAS 145): control environment, the entity's risk assessment process, the process to monitor the system of internal control, indirect controls
- COSO, Internal Control-Integrated Framework (2013)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error