CPA Exam AUD: Internal Control Evaluation for Auditors

Internal Control Evaluation: What CPA Candidates Must Know

Internal control evaluation is one of the most heavily tested topics on the AUD section of the CPA exam. Auditors are required under AU-C Section 315 to obtain an understanding of internal control relevant to the audit. The COSO (Committee of Sponsoring Organizations of the Treadway Commission) Internal Control-Integrated Framework provides the standard model for evaluating internal control.

The Five Components of Internal Control (COSO Framework)

The COSO framework identifies five interrelated components of internal control that auditors must understand and evaluate:

1. Control Environment: The control environment sets the tone of the organization and is the foundation for all other components. It encompasses the integrity and ethical values of the entity, the commitment to competence, the board of directors and audit committee participation, management's philosophy and operating style, organizational structure, assignment of authority and responsibility, and human resource policies and practices. A strong control environment does not by itself ensure the effectiveness of internal control, but a weak control environment can undermine all other components.
2. Risk Assessment: This component involves the entity's process for identifying and analyzing risks relevant to the achievement of its objectives. Management must identify risks related to financial reporting and determine how those risks should be managed. Changes in the operating environment, new personnel, new or revamped information systems, rapid growth, new technology, and new accounting pronouncements can all create new risks.
3. Control Activities: These are the policies and procedures that help ensure management's directives are carried out. They include authorizations, approvals, verifications, reconciliations, reviews of operating performance, security of assets, and segregation of duties. Control activities can be preventive (designed to prevent errors or fraud) or detective (designed to detect errors or fraud after they occur).
4. Information and Communication: The information system relevant to financial reporting objectives consists of the procedures and records designed to initiate, record, process, and report entity transactions and maintain accountability for the related assets. Communication involves providing an understanding of individual roles and responsibilities pertaining to internal control over financial reporting.
5. Monitoring Activities: Monitoring assesses the quality of internal control performance over time. It includes ongoing monitoring activities built into normal operations and separate evaluations. Internal audit functions often play a key role in monitoring. Deficiencies identified through monitoring should be reported to the appropriate level of management and the board.

Obtaining an Understanding of Internal Control

The auditor is required to obtain an understanding of each of the five components of internal control sufficient to assess the risks of material misstatement and design further audit procedures. This understanding is obtained through risk assessment procedures such as inquiries of management and others, observation of the application of specific controls, inspection of documents and reports, and tracing transactions through the information system (a walkthrough).

Importantly, obtaining an understanding of internal control is required regardless of the audit strategy. Even if the auditor does not plan to rely on controls (a substantive approach), the auditor must still understand internal control to identify risks of material misstatement.

Testing the Operating Effectiveness of Controls

If the auditor plans to rely on the operating effectiveness of controls to reduce substantive testing, the auditor must test those controls. Tests of controls are designed to evaluate whether controls are operating effectively. Common tests of controls include inquiry combined with other procedures, observation of the control being performed, inspection of evidence that the control was performed, and reperformance of the control by the auditor.

Inquiry alone is generally not sufficient to test the operating effectiveness of controls. The auditor must corroborate inquiry with other procedures. The nature, timing, and extent of tests of controls depend on the degree of reliance the auditor plans to place on the controls and the assessed risk of material misstatement.

Control Deficiencies, Significant Deficiencies, and Material Weaknesses

A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit the attention of those charged with governance. A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented or detected on a timely basis.

Auditors are required to communicate in writing to those charged with governance all significant deficiencies and material weaknesses identified during the audit. This communication should be made no later than 60 days following the report release date.

Integrated Audits Under PCAOB Standards

For public companies, auditors perform an integrated audit that includes both the audit of financial statements and the audit of internal control over financial reporting (ICFR) under PCAOB AS 2201. In an integrated audit, the auditor must express an opinion on the effectiveness of ICFR. A material weakness results in an adverse opinion on ICFR. The auditor uses a top-down approach, starting with entity-level controls and working down to significant accounts, relevant assertions, and individual controls to test.

Exam Tips for Internal Control Evaluation

• Memorize the five COSO components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring.
• The control environment is the foundation but does not guarantee effectiveness.
• Inquiry alone is never sufficient to test the operating effectiveness of controls.
• Know the distinctions between control deficiency, significant deficiency, and material weakness.
• In an integrated audit, a material weakness means an adverse opinion on ICFR.