Understanding the Entity & Internal Control

Five components (Committee of Sponsoring Organizations of the Treadway Commission (COSO))

1. Control environment — tone at the top, the foundation.
2. Entity's risk assessment process.
3. Process to monitor internal control.
4. Information system and communication.
5. Control activities — approvals, reconciliations, physical controls, segregation.

Evaluate design and implementation for

Significant-risk controls · journal entry controls · controls the auditor will test · related general information technology (IT) controls. Inquiry plus observation, inspection, or walkthrough.

Segregation of duties

Separate Authorization, Recording, Custody (memory aid: ARC).

Limitations

Human error, collusion, management override, cost-benefit → reasonable assurance only.

Deficiencies

• Material weakness: reasonable possibility of material misstatement not prevented or detected.
• Significant deficiency: less severe, merits governance attention.
• Both → in writing to management and those charged with governance, within 60 days of report release.
• Never state "no significant deficiencies were identified".

Exam traps

• A walkthrough gives evidence about design and implementation — not operating effectiveness.
• The auditor isn't required to search for control deficiencies, only to communicate the significant ones identified.
• Weaknesses in the control environment are pervasive — they undermine the whole audit, even if individual controls look fine.