The systems-based approach starts from one question. If the client’s systems and controls are good, can the auditor rely on them instead of testing every figure? This topic shows how the auditor answers that question. It covers the components of internal control, how controls are understood, evaluated and tested, and why some substantive testing is always needed.
It ends with the statement of financial position approach and the audit of smaller entities.
Examiners ask you to suggest controls for a given system, to explain how controls are evaluated, to say why controls can never be relied on fully, and to deal with an owner-managed business. The lists in this topic work as checklists, so learn them.
In 30 seconds
A systems-based audit concentrates on the client’s internal control system rather than on the figures themselves. International Standard on Auditing (ISA) 315 identifies five components of internal control: the control environment, the entity’s risk assessment process, the information system, control activities and monitoring of controls. The auditor understands and documents them, confirms the understanding with walk-through tests, and assesses whether the controls are well designed and properly implemented.
If control risk is high, the auditor moves to extensive substantive testing. If controls look good on paper, the auditor tests them, and if they work, reduces substantive testing. Substantive testing is never dropped, because of human error, management override and collusion. The statement of financial position approach is wholly substantive, concentrates on balances, and suits small companies.
Smaller entities have fewer controls and a high risk of management override, so reliance on controls is low.
The nature of the systems-based approach
A systems-based approach focuses on the client’s internal control system and on how adequate its controls are. ISA 315 requires the auditor to obtain an understanding of the entity and its environment, including its internal control, as part of risk assessment.
Management is responsible for putting in place a suitable control system that deals with financial statement risks, operational risks and compliance risks. Effective controls, properly applied, give:
- reliable financial reporting;
- effective and efficient operations; and
- compliance with laws and regulations.
The auditor’s assumption is simple. If the systems and controls are adequate, transactions should be processed correctly, and the financial statements should give a true and fair view. So the emphasis falls on the systems that process transactions and not on the transactions themselves. Before relying on a system, the auditor must find out what the controls are and evaluate how effective they are.
The five components of internal control
ISA 315, as the syllabus presents it, identifies five components that together make up an internal control system:
- the control environment;
- the entity’s risk assessment process;
- the information system;
- control activities (internal controls); and
- the review and monitoring of controls.
Background: The revised ISA 315 (2019) names the five as the control environment, the entity’s risk assessment process, the entity’s process to monitor the system of internal control, the information system and communication, and control activities. The ideas are the same and the list is regrouped. If an exam question uses the newer wording, answer in the same terms.
The control environment
The control environment is the general attitude to internal control among management and staff. The Institute of Internal Auditors describes it as the attitude and actions of the board and management on how much control matters in the organisation. It gives the discipline and structure for the rest of the control system.
Its elements are:
- integrity and ethical values;
- management’s philosophy and operating style;
- organisational structure;
- assignment of authority and responsibility;
- human resource policies and practice; and
- competence of personnel.
A strong control environment cannot guarantee that controls operate. It is, however, a positive factor in the auditor’s risk assessment. Without a strong environment, the control system as a whole is likely to be weak.
Evaluating the control environment
ISA 315 requires the auditor to understand the control environment, and part of that is judging how effective it is. The auditor considers:
- how far management and the board take part in the control process;
- management’s commitment to a control culture;
- whether the structure is appropriate, with clear lines of authority and responsibility;
- whether the culture expects ethical behaviour from managers and staff; and
- whether human resource policies on recruitment, training, development and motivation show a commitment to quality and competence.
The entity’s risk assessment process
In a strong control system, management identifies, assesses and manages business risks continually. Significant business risks are events or omissions that could stop the entity achieving its objectives.
- Identifying risks means recognising that they exist or may exist.
- Assessing them means deciding whether they are significant and, perhaps, ranking them.
- Managing them means putting in place controls and other measures to deal with them.
ISA 315 requires the auditor to understand management’s risk assessment process to the extent that it affects financial reporting. The quality of that process helps the auditor judge the overall level of audit risk. If management has no such process, the auditor needs to do more work at the planning stage.
The information system
The auditor must understand the business information systems, including the accounting systems, to the extent they affect financial reporting. This means identifying and understanding:
- the entity’s principal business transactions;
- how those transactions and other relevant events are captured (identified and recorded);
- the processing methods, manual and electronic;
- the accounting records, manual and electronic, behind the figures in the financial statements;
- the process used to prepare the financial statements; and
- the information technology (IT) risk management processes and how cybersecurity risks are managed.
The information system consists of infrastructure (physical and hardware components), software, people, procedures and data. A manual accounting system has little infrastructure.
The auditor should also understand how the system was developed, because that shows how robust it is. The key question is whether the system can record and keep accounting information from which financial statements reflecting the underlying transactions can be produced. An accepted framework such as Control Objectives for Information and Related Technologies (COBIT) used in developing the system gives extra assurance.
COBIT is a suite of tools that helps a client run IT effectively. Its benefits include better management of IT, compliance with regulations, more reliable IT operations with lower risk (such as hacking), and a more efficient audit, since the auditor has assurance over the systems.
Note. COBIT is covered in the later topic on governance, risk and compliance (GRC) software and COBIT.
Control activities
Control activities are the practices and procedures, apart from the control environment, that are used to make sure the entity’s objectives are achieved. They are the day-to-day application of internal controls. Each is designed either to prevent errors in processing information or to detect and correct them.
Use this list as a checklist when an exam question asks you to suggest controls for a system.
| Category | What it does | Example |
|---|---|---|
| Authorisation | Requires significant transactions to be approved by a manager at the right level | A purchase order above a set limit signed by the finance manager |
| Physical controls over assets | Safeguards assets against unauthorised use, theft or damage | Only authorised staff may enter the inventory store |
| Arithmetic controls | Check the arithmetical accuracy of processing | Re-checking the calculation of a supplier’s invoice before payment |
| Accounting controls | Built into procedures to make records accurate and complete | Control account reconciliations for receivables and payables |
| Management controls | Applied by management through supervision and review | Budgets, variance analysis and review of performance reports |
| Segregation of duties | Splits a task between people so that one person’s work checks another’s | One person orders goods, another receives them, a third pays |
Segregation of duties
Segregation of duties means dividing the work between two or more people so that the work of one acts as a check on the others. It reduces the risk of error and of fraud, for two reasons.
- When several people take part in a task, errors are more likely to be found, because people spot other people’s mistakes more easily than their own.
- Fraud is harder, because a colleague may notice suspicious transactions.
Monitoring of controls
Management should review and monitor the operation of controls on a systematic basis. The aim is to be satisfied that controls remain adequate and are being applied properly. ISA 315 requires the auditor to understand this monitoring process.
Background: Typical monitoring includes supervisory review of reconciliations and exception reports, and the work of an internal audit function that tests controls and reports deficiencies to management.
How the auditor uses internal controls
When a client has an effective control system, the most efficient way to get audit evidence is normally to test the controls rather than the transactions. Systems-based techniques therefore complement the business risk approach, by focusing testing on the higher-risk areas.
Step 1: understand and document the controls
ISA 315 requires an understanding of internal control relevant to the audit. Most relevant controls relate to financial reporting, but not every financial reporting control is relevant to the audit. Whether a control is relevant, alone or with others, is a matter of professional judgement. The auditor must understand each of the five components and document the relevant features.
Step 2: confirm the understanding with a walk-through
The auditor then confirms the understanding with walk-through tests on each major type of transaction, such as sales, purchases and payroll. In a walk-through the auditor takes a small number of transactions and follows them through each stage of processing, to check that the understanding of the process is right.
Step 3: assess how effective the controls are
Effectiveness depends on two things:
- Design. Could the system prevent material misstatements, or detect and correct them if they occur? Do the controls look adequate and effective on paper?
- Implementation. Controls are not effective unless they are applied properly. Are they in fact operated by management and staff?
The result helps the auditor assess control risk, which is the risk that the controls will fail to prevent, or detect and correct, misstatements. That in turn decides how far a systems-based approach can go.
Step 4: decide the approach
- If control risk is assessed as very high, a systems-based approach is not appropriate. The auditor goes straight to detailed testing of transactions and balances.
- Before control risk can be assessed as low, the auditor must be satisfied that the controls are well designed and should be effective on paper. Even then, the auditor cannot rely on them unless confident that they work in practice. The next stage is to carry out tests of controls.
- If the tests show the controls operate effectively, the auditor can use a systems-based approach with reduced substantive testing.
| Assessment from planning and risk assessment | Next step | Substantive testing |
|---|---|---|
| Controls assessed as weak | No reliance. Go to substantive testing | Extensive |
| Controls assessed as strong on paper | Tests of controls | Depends on the results |
| Tests of controls show good control | Rely on controls | Reduced |
| Tests of controls show poor control | No reliance | Extensive |
Background: Tests of controls use four main techniques: inquiry of staff, observation of the control being applied, inspection of documents for evidence such as signatures and approvals, and reperformance of the control by the auditor. Computer-assisted audit techniques are used for programmed controls.
ISA 330 requires tests of controls where the auditor plans to rely on them, and also where substantive procedures alone cannot give sufficient appropriate evidence, for example in a highly automated system.
Why controls are never relied on fully
Even when the control system seems effective, the auditor never relies on it entirely. Some substantive testing is always done before the auditor concludes on the financial statements. The reason is that every control system has inherent limits. Controls can fail because of:
- human error, including failure to apply a control properly;
- management override, which is a deliberate decision to ignore a control; and
- collusion and fraud, where people act together to get round the controls.
The amount of substantive testing depends on how effective the auditor judges the controls to be.
The statement of financial position approach
When control risk is high, the auditor cannot take a systems-based approach and must carry out extensive substantive testing. Substantive tests are procedures to detect material misstatements in the figures reported. They are designed to get evidence about the financial statement assertions and include tests of detail on transactions, account balances and disclosures, and analytical procedures.
The statement of financial position approach is also wholly substantive. The difference is that the auditor concentrates on testing balances rather than balances and transactions. It is often well suited to small companies and to entities whose assets and liabilities are large compared with their transactions, such as investment companies.
The approach rests on the accounting equation:
Opening net assets + profit for the year = closing net assets.
The theory is that if the opening and closing statements of financial position are correct, the profit for the year must also be correct.
Background: The weakness of the approach is that errors in balances can offset each other, and that mistakes in classifying items within profit or loss, or in disclosures, do not change net assets. It is therefore not enough for a large entity with many transactions.
Auditing smaller entities
The ISAs apply to the audit of every entity, whatever its size. Their application material includes extra considerations for smaller entities. These help in applying the requirements. They do not reduce the auditor’s responsibility to comply.
What a smaller entity is
The International Auditing and Assurance Standards Board (IAASB) glossary describes a smaller entity as one that typically has:
- ownership and management concentrated in a few people, often a single owner-manager; and
- one or more of the following: uncomplicated transactions, simple record-keeping, few lines of business or products, few internal controls, few levels of management with responsibility for a broad range of controls, and few staff with many duties each.
Nigerian Auditing Practice Statement (NAPS) 2 adds that such an entity may have few sources of income, unsophisticated record-keeping, and limited internal controls together with the potential for management to override them.
Controls in a smaller entity
Many controls found in a large company would be inappropriate, too costly or impractical for a small one. Segregation of duties is the obvious case, because there are not enough staff. Control often rests on the owner or directors being closely involved in day-to-day work, so authorisation controls and review controls, with the owner approving many transactions personally, are often the key features.
The involvement of the owner-manager can reduce the risk from weak segregation. Even so, the auditor usually sees it as only a partial substitute for normal controls. Problems that arise include:
- little evidence of how systems are meant to work, so more reliance on inquiry than on documents;
- little evidence that controls were applied, for example authorisations that are not documented;
- management may override controls;
- management may lack the expertise to control the entity well; and
- there is unlikely to be any independent person in management, as there would be among those charged with governance in a larger entity.
The attitude and actions of the owner-manager are central to the risk assessment. A written code of conduct is unlikely, so a culture of integrity shown by management’s example is important. The auditor must understand and evaluate whatever controls exist and plan the work accordingly. In practice there will be low reliance on controls and a considerable amount of substantive testing.
The rules in more depth
Why the walk-through comes first
The auditor may have documented the system from enquiries or from the client’s manuals. A walk-through shows whether the process works that way in practice. It is cheap, because only a few transactions are followed, and it exposes gaps early. It is a check on understanding. It is not a test that controls are effective, which is a separate step.
Why design and implementation are separate questions
A control can be well designed and never used. A bank reconciliation procedure is good design, but if nobody performs it, the control does not work. So the auditor first judges the design and then tests whether it is applied. A control that fails either test cannot be relied on.
Why a weak control environment matters most
The control environment is the base for every other component. If management does not value control, procedures may exist on paper but be ignored, risk assessment may be absent and monitoring may not happen. That is why a weak environment raises the risk assessment for the whole audit, not just for one area.
Why override is the main risk in small entities
In a small entity the owner often runs the business and the accounts. There is nobody senior to challenge decisions. Any control the owner chooses to ignore is overridden at once. That is why the auditor cannot place much reliance on controls and plans substantive work instead.
Worked example: weaknesses in a payroll system
Scenario. Nneka Plastics Ltd employs 180 factory workers paid in cash every week. The payroll clerk keeps the employee master file, calculates pay from clock cards, prepares the pay envelopes and hands them out. Nobody approves the payroll before the bank is asked to release the cash. New starters are added on an oral instruction from supervisors.
Required: identify the control weaknesses, recommend controls, and explain what the weaknesses mean for the auditor’s approach.
| Weakness | Risk | Recommended control |
|---|---|---|
| One clerk keeps the master file, calculates pay and distributes cash | Ghost workers and fraud; undetected errors | Segregation of duties: separate master file maintenance, calculation and payment |
| No approval before the bank releases cash | Unauthorised or wrong pay | Authorisation: the finance manager reviews and signs the payroll summary and compares it with the previous week |
| New starters added on oral instruction | Fictitious employees | Written starter forms authorised by human resources (HR) and checked to the master file; the same for leavers |
| Cash payments handed out by the clerk | Theft and misappropriation | Pay by bank transfer, or distribute in front of two people with signed receipts and record unclaimed wages |
| No independent check of the calculation | Arithmetical errors | Arithmetic and accounting controls: independent recalculation and reconciliation of the payroll total to the ledger |
Effect on the audit. The control environment for payroll is weak and control risk is high. A systems-based approach is not suitable here. The auditor should do substantive work: analytical review of wages, reperformance of the payroll calculation, tracing the master file to personnel records, and attending a pay-out, perhaps a surprise one. The control weaknesses should be reported to management.
Improvements made later would reduce control risk in the next year’s audit, but not in the period already audited.
How to score full marks
- For “suggest controls”, use the six categories as headings and give one control under each that fits the system in the question.
- For a weakness, give three parts: the weakness, the risk it creates and the control that fixes it.
- For “evaluate the control environment”, go through the factors: management participation, commitment, structure, culture and human resources.
- For “how does the auditor use controls”, follow the sequence: understand, walk through, assess design and implementation, test, then decide the substantive work.
- Always say why controls cannot be relied on fully: error, override and collusion.
- For small entities, name the owner-manager, override, lack of documents and low reliance on controls.
- Time. Spend time in proportion to marks.
Common mistakes in the exam
- Listing controls with no link to the system in the question.
- Confusing a walk-through with a test of controls.
- Relying on controls that look good on paper, without testing that they operate.
- Saying that strong controls remove the need for substantive testing.
- Forgetting the control environment as the foundation of the system.
- Recommending segregation of duties for a business with two staff, without suggesting owner supervision as an alternative.
- Applying the statement of financial position approach to a large client.
Quick revision
- Systems-based: rely on controls over the systems rather than on the figures. Management is responsible for the controls.
- Five components: control environment, risk assessment process, information system, control activities, monitoring.
- Control activities: authorisation, physical, arithmetic, accounting, management controls, segregation of duties.
- Process: understand and document, walk-through, assess design and implementation, tests of controls, then decide substantive work.
- Control risk high: extensive substantive testing. Controls tested and working: reduced substantive testing.
- Never rely 100%: human error, management override, collusion.
- Statement of financial position approach: opening net assets plus profit equals closing net assets. Wholly substantive.
- Smaller entities: few controls, owner-manager involvement, override risk, low reliance, much substantive testing.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. How many components of internal control does ISA 315 identify?
- Three
- Four
- Five
- Six
Show the answer
C. Control environment, risk assessment process, information system, control activities and monitoring.
Question 2. Which of the following is a component of internal control?
- The audit report
- Monitoring of controls
- Substantive testing
- Audit sampling
Show the answer
B. The others are audit matters, not parts of the client’s control system.
Question 3. Segregation of duties mainly reduces the risk of:
- Excess inventory
- Error and fraud, because one person’s work checks another’s
- Late reporting
- Falling sales
Show the answer
B. It is difficult to achieve in small entities.
Question 4. The auditor uses a walk-through test to:
- Select a sample for substantive testing
- Confirm his understanding of a process and its controls
- Prove that controls are effective
- Replace tests of controls
Show the answer
B. A walk-through checks understanding. Tests of controls prove operation.
Question 5. Which of the following is a category of control activity?
- Authorisation
- Materiality
- Sampling risk
- Detection risk
Show the answer
A. The others are audit concepts.
Question 6. The auditor assesses control risk as very high. The most likely next step is:
- Tests of controls
- Extensive substantive testing
- Reliance on the controls
- Issuing the report
Show the answer
B. Controls that are weak cannot be relied on, so tests of controls would be wasted.
Question 7. Which is NOT a reason why the auditor never relies fully on controls?
- Human error
- Management override
- Collusion between employees
- A strong control environment
Show the answer
D. A strong environment helps but never guarantees that controls work.
Question 8. The statement of financial position approach rests on the equation:
- Opening net assets + profit = closing net assets
- Assets = liabilities
- Profit = revenue − tax
- Cash in = cash out
Show the answer
A. If both balances are correct, the profit must be correct.
Question 9. A problem commonly met when auditing small entities is that:
- There are too many levels of management
- Management may override the controls that exist
- Segregation of duties is too complex
- The internal audit department is too large
Show the answer
B. The owner-manager can ignore any control.
Question 10. The control environment is best described as:
- The physical premises of the client
- The attitude and actions of the board and management towards control
- The client’s accounting software
- The auditor’s working papers
Show the answer
B. It sets the discipline and structure for the other components.
Written questions
Question 11 (10 marks). Explain the five components of an entity’s internal control system under ISA 315 and how the auditor evaluates the control environment.
Question 12 (20 marks). (a) Describe the categories of control activity, with an example of each. (6 marks) (b) Explain segregation of duties and why it is useful. (4 marks) (c) Explain how the auditor assesses the effectiveness of controls and decides whether to rely on them. (6 marks) (d) Explain why the auditor can never rely entirely on internal controls. (4 marks)
Question 13 (10 marks). Bakare Hardware Ltd is run by its owner-manager. It has eight staff, manual records and no written procedures. The owner approves all orders and signs all cheques, and 60% of sales are for cash. Explain the problems this creates for the auditor and the approach the auditor should take. (10 marks)
Model answers
Show the model answer to Question 11
The five components (5 marks). The control environment: the attitude of the board and management to control. The entity’s risk assessment process: how management identifies, assesses and manages business risks. The information system: how transactions are captured, processed and reported. Control activities: the procedures that prevent, or detect and correct, errors. Monitoring: management’s review of whether controls remain adequate and are applied. (5, 1 each)
Elements of the control environment (2 marks). Integrity and ethical values; management’s philosophy and style; organisational structure; assignment of authority and responsibility; human resource policies; competence of personnel. (2, any four at 0.5)
Evaluation (3 marks). The auditor considers management and board participation in the control process (0.5), management’s commitment to a control culture (0.5), an appropriate structure with clear authority and responsibility (0.5), a culture that expects ethical behaviour (0.5), and human resource policies that show commitment to quality and competence (0.5). A strong environment is positive for risk assessment but does not guarantee that controls operate. (0.5)
Show the model answer to Question 12
(a) Control activities (6 marks, 1 each). Authorisation: a manager approves significant transactions, such as orders above a limit. Physical controls: restricted access to inventory stores and cash. Arithmetic controls: re-checking the calculation of invoices. Accounting controls: control account reconciliations. Management controls: supervision, budgets and variance review. Segregation of duties: ordering, receiving and paying done by different people.
(b) Segregation of duties (4 marks). It divides the work between two or more people so that one person’s work checks the other’s. (1) Errors are more likely to be found, because people spot the mistakes of others more easily than their own. (1) Fraud is harder, because a colleague may notice a suspicious transaction. (1) It is hard in small entities, where owner supervision may partly replace it. (1)
(c) Assessing effectiveness (6 marks). The auditor understands each of the five components and documents the relevant features. (1) Walk-through tests on each major type of transaction confirm the understanding. (1) The auditor judges the design of the controls: could they prevent or detect material misstatement? (1) The auditor judges implementation: are they actually operated? (1) If control risk is high, the auditor goes to extensive substantive testing.
If controls look good on paper, the auditor carries out tests of controls. (1) If the tests show that controls operate, reliance is placed on them and substantive testing is reduced. (1)
(d) Limits (4 marks). Human error, including failure to apply a control properly. (1) Management override, a deliberate decision to ignore a control. (1) Collusion and fraud. (1) The auditor therefore always carries out some substantive testing, and the amount depends on the assessed effectiveness of the controls. (1)
Show the model answer to Question 13
Problems for the auditor (5 marks). There is little evidence of how systems are supposed to work, since nothing is written down, so the auditor must rely on inquiry. (1) There is little evidence that controls were applied, for example authorisations that are not recorded. (1) The owner can override any control. (1) Management may lack the expertise to control the business well.
(1) There is no independent person in management, and segregation of duties is not possible with eight staff. (1)
Approach (5 marks). Understand and evaluate whatever controls exist. The owner’s approval of orders and cheques is a review and authorisation control, but only a partial substitute for normal controls. (1) The attitude and integrity of the owner are central to the risk assessment, since there is no written code of conduct. (1) Place low reliance on controls.
(1) Plan considerable substantive testing, possibly a statement of financial position approach for a small client. (1) Pay particular attention to cash sales, where completeness is a risk: analytical review of margins, cut-off tests and comparison of takings with banking. (1)
Pathfinder on the systems-based approach
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
The case describes a team that chose a control-reliance approach for a client with weak controls and did not test the controls first. No requirement asks for the systems-based approach by name, but the logic of this topic is what the case examines: assess design, test operation, then rely.
Revise first: How the auditor uses internal controls
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
