The system of internal control and its five components

In this lesson you will

Name the five components of the system of internal control.
Describe what AU-C 315.21-.26 require for each component.
Evaluate whether a control deficiency exists in an indirect component.

Five components

AU-C 315.12 defines the system of internal control as the system designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable assurance about achieving objectives for reliable financial reporting, effective and efficient operations, and compliance with laws and regulations. For GAAS it has five components:

Control environment
The entity's risk assessment process
The entity's process to monitor the system of internal control
The information system and communication
Control activities

These track the COSO framework many entities use; see the COSO framework guide.

The first three are often called indirect components. They set the foundation and affect the likelihood that direct controls work, but they rarely address an assertion-level risk on their own. The information system and control activities contain the direct controls.

What you must do for each

Control environment (AU-C 315.21). Understand the controls, processes and structures that address management's oversight, culture and commitment to integrity; the independence and oversight of those charged with governance; assignment of authority and responsibility; how the entity attracts, develops and retains competent people; and accountability. Then evaluate whether management, with governance oversight, has created a culture of honesty and ethical behavior, whether the environment is an appropriate foundation for the other components, and whether deficiencies undermine the other components.

Risk assessment process (AU-C 315.22-.23). Understand how the entity identifies business risks relevant to financial reporting, including fraud, assesses their significance and likelihood, and addresses them. Evaluate whether the process is appropriate for the entity's nature and complexity. If you find risks management missed, AU-C 315.23 requires you to determine whether the process should have caught them and why it did not.

Monitoring (AU-C 315.24). Understand ongoing and separate evaluations, how deficiencies are identified and remediated, the internal audit function if any, and the sources of information used and why management considers them reliable. Then evaluate whether the process is appropriate.

Information system and communication (AU-C 315.25). For significant classes, balances and disclosures, understand how transactions are initiated, recorded, processed, corrected, posted to the general ledger and reported; the accounting records; the financial reporting process including disclosures; and the IT and other resources involved. Understand how significant matters are communicated internally and externally. Evaluate whether the system appropriately supports preparation of the statements.

Control activities (AU-C 315.26-.30). Identify the controls listed in AU-C 315.27, the related IT applications and GITCs, and evaluate design and implementation. That is the subject of the next lesson.

Scaling

For a small owner-managed entity, the control environment may rest heavily on the owner's direct involvement, the risk assessment process may be informal, and monitoring may be the owner's review of monthly results. Those can be appropriate in the circumstances. Document what exists and your evaluation. "Not applicable, small entity" does not meet the requirement.

Deficiencies

AU-C 315.31 requires you to determine, based on your understanding and evaluation of the components, whether control deficiencies have been identified. A weak control environment, such as an owner who overrides approvals routinely, is a deficiency and often a financial statement level risk. Evaluate severity and communicate significant deficiencies and material weaknesses under AU-C 265.

Common findings

Generic control environment questionnaires with no evaluation conclusion.
Information system understanding limited to the name of the accounting system, with no transaction flows.
No evaluation of the risk assessment or monitoring processes.
Deficiencies noted in the understanding but not evaluated under AU-C 265.

Worked example

Indirect component deficiency at a family business

Westbrook Floor Coverings, Inc. has revenue of $11 million. The owner approves all payments and reviews the monthly P&L. During inquiries, the bookkeeper says that in slow years the owner tells her to hold December vendor invoices until January so profit looks steady to the bank.

Control environment evaluation: the owner's instruction to defer expenses shows a lack of commitment to accurate reporting. The team concludes the control environment does not provide an appropriate foundation for the other components and identifies a control deficiency under AU-C 315.31.

Effect on the risk assessment: a financial statement level risk of management bias affecting cutoff and accruals. The team assesses inherent risk for completeness of accrued expenses as close to the upper end of the spectrum and designates a significant risk.

Response: an expanded search for unrecorded liabilities covering January and February disbursements over $5,000, versus the usual $15,000 threshold. Results: $86,000 of December expenses recorded in January; materiality is $55,000. Management records the adjustment. The team evaluates the deficiency as a material weakness and communicates it in writing under AU-C 265.

Self-check

Answer each question before you open the answer.

List the five components of the system of internal control in AU-C 315.12.
Show answer
Control environment, the entity’s risk assessment process, the entity’s process to monitor the system of internal control, the information system and communication, and control activities.
For the control environment, what must the auditor evaluate under AU-C 315.21(b)?
Show answer
Whether management, with governance oversight, has created a culture of honesty and ethical behavior, whether the environment is an appropriate foundation for the other components, and whether deficiencies in it undermine the other components.
You identify a risk that the entity’s risk assessment process missed. What does AU-C 315.23 require?
Show answer
Determine whether it is a risk the process should have identified, understand why it did not, and consider the implications for your evaluation of the process.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error