Understanding the Entity & Internal Control

Why this topic matters

Every audit requires an understanding of the entity, its environment, the applicable financial reporting framework, and its system of internal control. Statement on Auditing Standards (SAS) No. 145 rewrote these requirements, and the 2026 Auditing and Attestation (AUD) blueprint added emphasis on entity-level controls. Expect questions on the components of internal control, types of controls, walkthroughs, and how deficiencies are evaluated and communicated.

Understanding the entity and its environment

• Organizational structure, ownership, governance, and business model — including how it uses information technology (IT).
• Industry, regulatory, and other external factors.
• Measures used, internally and externally, to assess financial performance (these can create pressure to manipulate results).
• The applicable financial reporting framework, the entity's accounting policies, and reasons for any changes.
• How inherent risk factors — complexity, subjectivity, change, uncertainty, and susceptibility to management bias or fraud — affect the financial statements.

Risk assessment procedures are: inquiries of management and others (including internal audit and in-house legal counsel), analytical procedures, and observation and inspection.

The components of internal control

Generally accepted auditing standards (GAAS) use the same five components as the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control — Integrated Framework (2013):

Component	What the auditor looks at
Control environment	Integrity and ethical values; board independence and oversight; organizational structure; commitment to competence; accountability. The "tone at the top" — the foundation for all other components.
Entity's risk assessment process	How management identifies business risks relevant to financial reporting, assesses their significance, and decides on actions — including fraud risk.
Entity's process to monitor the system of internal control	Ongoing and separate evaluations (for example, internal audit), and how deficiencies are remediated.
Information system and communication	How transactions are initiated, recorded, processed, corrected, and reported; the IT environment; journal entries; the financial close; how roles and significant matters are communicated.
Control activities	Controls that address risks at the assertion level — authorizations, reconciliations, verifications, physical controls, and segregation of duties — including general IT controls.

SAS No. 145 treats the first four as mostly indirect (entity-level) controls and control activities as mostly direct controls. The auditor must evaluate whether the control environment provides an appropriate foundation, and whether any deficiencies undermine the other components.

The 17 COSO principles (headline view)

• Control environment: principles 1–5 (integrity, board oversight, structure, competence, accountability).
• Risk assessment: 6–9 (objectives, identify risks, fraud risk, significant change).
• Control activities: 10–12 (select controls, general IT controls, deploy through policies).
• Information and communication: 13–15 (quality information, internal and external communication).
• Monitoring: 16–17 (evaluations, communicate deficiencies).

Controls the auditor must evaluate

For controls in the control activities component, the auditor must evaluate design and determine whether they have been implemented for:

• Controls that address a significant risk.
• Controls over journal entries, including nonstandard entries.
• Controls whose operating effectiveness the auditor plans to test.
• Other controls the auditor considers appropriate, plus general IT controls that address risks arising from the use of IT.

Design and implementation are evaluated with inquiry combined with observation, inspection, or a walkthrough (tracing a transaction from origination to the financial statements). Inquiry alone is not sufficient. Evaluating design and implementation is not a test of operating effectiveness.

Types of controls

Classification	Examples
Preventive	Required approvals, segregation of duties, input edit checks, passwords
Detective	Bank reconciliations, reviews of exception reports, physical inventory counts compared with records
Manual versus automated	A supervisor's review versus a system-enforced three-way match
Entity-level versus transaction-level	Code of conduct, board oversight versus a control over individual sales invoices

Segregation of duties

Separate authorization of transactions, recording of transactions, and custody of the related assets (memory aid: ARC). Reconciliation should be done by someone independent of all three. In small entities where segregation is limited, owner-manager oversight can compensate.

Inherent limitations of internal control

• Human judgment can be faulty; breakdowns occur from error or mistakes.
• Controls can be circumvented by collusion or by management override.
• Cost-benefit constraints limit what controls are implemented.

Internal control provides reasonable, not absolute, assurance.

Evaluating and communicating deficiencies

Severity	Definition	Communication
Deficiency	Design or operation does not allow timely prevention, or detection and correction, of misstatements	May be communicated to management (orally or in writing)
Significant deficiency	Less severe than a material weakness, yet important enough to merit attention by those charged with governance	In writing to management and those charged with governance
Material weakness	A reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis	In writing to management and those charged with governance

• Written communication is best made by the report release date and no later than 60 days after it.
• Severity depends on the potential for misstatement, not whether one actually occurred.
• The auditor must not issue a written communication stating that no significant deficiencies were identified.
• Indicators of a material weakness include fraud by senior management, restatement of previously issued statements, a material misstatement the auditor found that controls missed, and ineffective oversight by those charged with governance.

Documentation

Understanding may be documented with narratives, flowcharts, questionnaires, and decision tables. The auditor documents key elements of the understanding, sources of information, risk assessment procedures, and assessed risks.

How it is tested

• Match a control or scenario to its internal control component.
• Classify a control as preventive or detective, or identify incompatible duties.
• Know which controls require design and implementation evaluation.
• Classify and communicate control deficiencies.