Top-down, risk-based scoping and entity-level controls

• Apply the top-down approach in AS 2201.21 to select controls to test
• Identify the categories of entity-level controls listed in AS 2201.24
• Distinguish indirect, monitoring and precise entity-level controls
• Scope multiple locations using consolidated risk and entity-level evidence

Start at the top

AS 2201.21 requires the auditor to use a top-down approach to select the controls to test. It begins at the financial statement level, with the auditor’s understanding of the overall risks to ICFR, then focuses on entity-level controls and works down to significant accounts and disclosures and their relevant assertions. The approach directs attention to accounts, disclosures and assertions that present a reasonable possibility of material misstatement.

Release 33-8810 gives management the same idea: identify financial reporting risks, then the controls that address them, and use entity-level controls in that assessment. Management is not required to identify every control in a process.

Scoping steps

1. Materiality. AS 2201.20 says the auditor uses the same materiality considerations as in the financial statement audit. Management sets its own scoping materiality and documents it.
2. Significant accounts and disclosures. Use quantitative size and qualitative factors such as susceptibility to fraud, complexity, judgment and volume of activity. AS 2201.33 requires identification based on the consolidated financial statements.
3. Relevant assertions. For each significant account, identify the assertions with a reasonable possibility of material misstatement.
4. Likely sources of misstatement. Walkthroughs and process understanding (next lesson).
5. Controls to test. AS 2201.39 says test the controls important to the conclusion on each relevant assertion. AS 2201.40 says it is not necessary to test all controls related to an assertion or redundant controls.

Entity-level controls

AS 2201.22 requires the auditor to test entity-level controls that are important to the conclusion on ICFR. The evaluation of entity-level controls can increase or decrease testing of other controls. AS 2201.24 lists them:

• controls related to the control environment;
• controls over management override;
• the company’s risk assessment process;
• centralized processing and controls, including shared service environments;
• controls to monitor results of operations;
• controls to monitor other controls, including internal audit, the audit committee and self-assessment programs;
• controls over the period-end financial reporting process;
• policies that address significant business control and risk management practices.

AS 2201.25 requires the auditor to evaluate the control environment, including management’s philosophy and operating style.

Precision decides what an entity-level control can do

AS 2201.23 describes three kinds of entity-level controls:

• Indirect: some, such as certain control environment controls, have an important but indirect effect on whether a misstatement is prevented or detected. They affect what else you test and how much.
• Monitoring: some monitor other controls and may identify breakdowns, but not at a precision that alone addresses the risk to an assertion. Operating effectively, they may allow reduced testing of other controls.
• Precise: some operate at a level of precision that would adequately prevent or detect misstatements to one or more relevant assertions on a timely basis. These can be the key control for that risk without testing lower-level controls.

The common error is to label a high-level analytic review as a precise entity-level control. Ask: what threshold triggers investigation, what does the reviewer do with an outlier, and would that catch a misstatement smaller than materiality?

Multiple locations

AS 2201.B11 tells the auditor to test controls over specific risks that present a reasonable possibility of material misstatement to the consolidated statements. In lower-risk locations, the auditor first might evaluate whether entity-level controls, including controls that provide assurance that appropriate controls exist throughout the organization, give sufficient evidence. AS 2201.B12 lets the auditor take into account work performed by others for management, such as internal audit visits, in choosing locations.

Fraud and override

AS 2201.14 requires the auditor to evaluate, while testing entity-level and other controls, whether controls address the risks of material misstatement due to fraud and the risk of management override. Put controls over journal entries, significant unusual transactions and the period-end process at the top of the entity-level list.

Scoping memo for Kestrel Home Products, Inc.