Control environment, the risk assessment process and monitoring of controls

A company's finance manual is excellent. But the managing director openly boasts of ignoring rules, junior staff fear to report errors, nobody checks references on new hires and the board never asks about risk. The controls on paper will not work. The first three components of internal control are therefore about attitude, risk awareness and information, and they decide whether the activities in the manual mean anything.

This topic covers the five components of internal control identified by International Standard on Auditing (ISA) 315, with detailed treatment of the control environment, the entity's risk assessment process, the information system and the monitoring of controls, followed by the auditor's walk-through tests. Control activities and information technology controls are covered in the next topic.

Key terms in plain English

Syllabus check

This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:

• the main components of internal control under ISA 315
• how accounting systems and related controls are identified and recorded
• the evaluation of internal controls

CAMA 2020 and the control environment

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

The five components

ISA 315 identifies five components that together make up the internal control system:

1. the control environment;
2. the entity's risk assessment process;
3. the information system, including the related business processes and communication;
4. control activities (the internal controls themselves); and
5. monitoring of controls.

The auditor must understand each of them as part of evaluating the control systems, and must document the relevant features of the systems and the evaluation of how effective they are. The first, second, third and fifth components are indirect or pervasive: they shape the whole system. The fourth is the direct set of procedures.

1. The control environment

The control environment is the general attitude to internal control of management and employees. It includes the views, awareness and actions of management about internal control, and the governance and management functions. It is the basis of good internal control, giving discipline and structure. It includes:

• communication and enforcement of integrity and ethical values;
• commitment to competence;
• participation of management, including those charged with governance;
• management's philosophy and operating style;
• organisation structure;
• assignment of authority and responsibility; and
• human resource policies and practices.

A strong environment is typically one where management shows a high commitment to setting up and running proper controls. It cannot guarantee that controls work, but it is a positive factor in the auditor's risk assessment. Without it the control system as a whole is likely to be weak.

Evaluating the environment. The auditor considers:

• management participation in the control process, including the board;
• management's commitment to a control culture;
• whether there is a suitable organisation structure with clear divisions of authority and responsibility;
• whether the culture expects ethical behaviour from managers and employees; and
• whether human resource policies on recruitment, training, development and motivation show commitment to quality and competence.

A weak control environment is a risk at the financial statement level and leads to overall responses such as more experienced staff, more supervision, more substantive work at the year end and less reliance on controls.

2. The entity's risk assessment process

In a strong system management identifies, assesses and manages business risks continually. Significant business risks are events or omissions that may prevent the entity from reaching its objectives. Identifying risks means recognising that they exist. Assessing them means deciding if they are significant and perhaps ranking them. Managing them means designing controls and other measures.

ISA 315 requires the auditor to understand the process management uses, so far as it may affect financial reporting. Risks arise or change with:

• changes in the operating environment;
• new personnel;
• new or revamped information systems;
• rapid growth;
• new technology;
• new business models, products or activities;
• corporate restructuring;
• expanded foreign operations; and
• new accounting pronouncements.

The examiner may build these factors into a scenario to see if candidates recognise them as risks. The quality of the client's risk assessment can be used to judge the overall level of audit risk. If there is no process, the auditor must do more work.

3. The information system

An information system consists of infrastructure (physical and hardware components), software, people, procedures and data. Infrastructure and software matter less in mainly manual systems, but most modern systems, even in small entities, use information technology extensively, so exam answers should be about computerised systems. For example, if orders come through a website, there is no point suggesting that staff be observed writing out order forms.

The appropriate test is to place a test order on the website and check that it is recorded in the system by viewing it on screen.

The auditor must understand how the information system affects financial reporting, which means understanding:

• the entity's principal business transactions;
• how these and other events relevant to reporting are captured, that is, identified and recorded;
• the processing methods, manual and computerised;
• the accounting records, manual and computerised, that support the statements; and
• the process of preparing the financial statements.

4. Control activities

These are the specific policies and procedures that prevent, or detect and correct, errors in processing. They are the subject of the next topic.

5. Monitoring of controls

Management must review and monitor how controls operate, on a systematic basis, to make sure they stay adequate and are applied properly. Monitoring can be ongoing, built into normal operations such as supervision and exception reports, or separate evaluations such as internal audit reviews. ISA 315 requires the auditor to understand the monitoring process.

Good monitoring includes a prompt response to deficiencies, with reports to those charged with governance, and follow-up to check that corrections were made. A company in which nobody reviews whether controls work will see them decay over time.

Understanding the system: walk-through tests

Having gained an understanding of the five components and documented it, the auditor confirms the understanding by walk-through tests on each major transaction type, such as sales, purchases and payroll. The auditor selects a few transactions and follows them through each stage of processing, from initiation to the ledger, asking staff to explain each step and looking at the documents and screens.

A walk-through shows whether the process is as described and whether the controls are in place, which is the evidence needed for the evaluation of design and implementation. Once the controls are understood, the auditor can assess how effective they are and how far to rely on them.

How the components fit together

Worked examples

1. The control environment is weak: no commitment to controls, competence or clear authority.
2. Control risk is high across the system, so the auditor uses more substantive procedures at the year end.

1. New systems, rapid growth and foreign operations are all circumstances that raise risk.
2. The auditor assesses how well management has identified and managed these risks, and plans more testing of conversions and new areas.

1. The appropriate test is a test order on the website.
2. The auditor then checks that it appears correctly in the sales system and that the despatch and invoice follow.

1. The auditor asks each person to describe their step and views the documents.
2. If the actual process differs from the documented process, the auditor revises the understanding and the assessment of controls.

How to score full marks

• List the five components in ISA 315 order.
• For the environment give the seven elements and say it is a pervasive factor.
• Tailor information system tests to a computerised system.
• Explain a walk-through and why it is done.

Common mistakes in the exam

• Describing only control activities when asked about components.
• Suggesting manual observation of a fully online process.
• Saying a strong environment guarantees effective controls.
• Forgetting to document the understanding.

Quick revision

• Five components: environment, risk assessment, information system, control activities, monitoring.
• Seven elements of the control environment.
• Risk process: identify, assess, manage.
• Walk-through: follow a few transactions end to end.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.