The system of internal control: 5 components and how the auditor understands it (ISA 315, revised in 2019)
The five components of the system of internal control shown on a small café, the difference between the design, implementation and operating effectiveness of a control, a table of common deficiencies, and how a deficiency found changes the audit approach.
"Lochin kafe" is a family business with two branches. Its owner, Sardor, met an auditor for the first time when the bank asked for audited financial statements for a loan. On the first day the auditor, Gulnora, asked for neither invoices nor the balance sheet. Her questions were different: "Who can cancel a receipt at the till? If the price of meat goes up, who discusses it and when? When did you last count the cash unannounced?" Sardor was surprised: what do these questions have to do with an audit?
The answer is this: without understanding the company's system of internal control, the auditor cannot properly assess where an error might be hiding in the financial statements. In this article we look at the five components of the system and what the auditor does with them.
Conditions: the café, names and examples are hypothetical, compiled by the author.
In Uzbekistan the international standards on auditing are the standards of auditing activity (Law "On Auditing Activity", Article 9). Identifying and assessing the risks of material misstatement is covered by ISA 315; its version revised in 2019 applies to audits of financial statements for periods beginning on or after 15 December 2021.
Which components make up the system of internal control?
ISA 315 (revised in 2019) divides the entity's system of internal control into five components. Let us look at them using "Lochin kafe":
| Component | Content (in plain words) | What it looks like at "Lochin kafe" | What the auditor asks |
|---|---|---|---|
| 1. Control environment | the manager's attitude to integrity and order, who is responsible for what | Sardor does not let a cash shortage slide with "fine, next time", every shift hands in a report | Does the manager follow the rules himself? |
| 2. The entity's risk assessment process | identifying risks that threaten the business and deciding on them | before opening the new branch, food price and rent risks were discussed | Who reviews risks, and how regularly? |
| 3. The entity's process to monitor the system of internal control | tracking whether controls actually work | once a month Sardor counts a branch's cash without notice and records the result | If a control stops working, who notices it and how? |
| 4. The information system and communication | how a transaction is initiated, recorded, processed and reaches the financial statements; how duties are communicated to staff | the order is entered into the till software, the end-of-day report goes to the accountant automatically | Which path does data take from the sale to the financial statements? |
| 5. Control activities | specific rules and procedures that prevent or detect errors and unauthorised actions | a receipt can be cancelled only with the manager's password, the storeroom key is held only by the chef | Which rule prevents which error? |
The fifth component is the most visible, but the first has the deepest effect: if the manager breaks the rules himself, even the best-written control activity stays on paper.
Design, implementation and operating effectiveness: what is the difference?
Three different questions are asked about a single control. Mixing them up is the most common misunderstanding in auditing:
| Concept | Question | Café example | Which standard |
|---|---|---|---|
| Design | If applied properly, does the control prevent the error or detect it? | Cancelling a receipt with the manager's password is a logical rule. If all waiters know the password, the design is weak | ISA 315 |
| Implementation | Does the control actually exist and is it being used? | Gulnora asks to try cancelling a receipt at the till: does the software ask for the password? | ISA 315 |
| Operating effectiveness | Did the control operate consistently throughout the period? | A sample is taken from the receipts cancelled during the year and each is checked for the manager's approval | ISA 330 (tests of controls) |
An important point: a control working today does not prove that it worked in March. If a conclusion for the whole year is needed, a test of controls is needed.
ISA 330, paragraph 8: the auditor must perform tests of controls in two cases: (1) when the risk assessment includes an expectation that controls are operating effectively, that is, the auditor intends to rely on them; (2) when substantive procedures alone cannot provide sufficient appropriate audit evidence.
Which deficiencies are most common?
| Deficiency | What risk it creates | How the auditor responds |
|---|---|---|
| One employee receives the money, records it and closes the till himself | a shortage or misappropriation stays hidden | daily cash reports are reconciled in detail with bank cash collections |
| All waiters can cancel a receipt | revenue may be understated | the report of cancelled receipts for the year is analysed in full |
| Many people hold the storeroom key | inventory shortage | observation of the year-end count, the number of items counted is increased |
| The bank statement is not reconciled with the records | an error or unauthorised payment is found late | the year-end balance is obtained by external confirmation from the bank |
| No record of who changed the price list | unauthorised discounts, lower revenue | the software's price change log is requested, selling prices are compared on a sample basis |
| The manager overrides the rules himself | the whole system weakens | special attention is paid to manual entries and unusual transactions |
How do the findings change the audit approach?
| Situation | What the auditor does |
|---|---|
| The control is well designed, implemented, and the auditor intends to rely on it | tests of controls are performed; if they are positive, the extent of tests of details may be smaller |
| The control is weak or absent | the auditor does not rely on the control: more tests of details, closer to the reporting date, with a larger sample |
In both cases ISA 330, paragraph 18 applies: irrespective of the assessed risk, substantive procedures are performed for each material class of transactions, account balance and disclosure. In other words, even the strongest control does not eliminate substantive procedures entirely.
Deficiencies found during the audit are also communicated to the company. Under ISA 265, significant deficiencies are communicated in writing to those charged with governance on a timely basis. For "Lochin kafe" Gulnora set out two deficiencies in writing: everyone knows the password for cancelling receipts, and the bank statement is not reconciled. Sardor fixed both within a week: the password was changed, and the accountant now prepares a reconciliation statement at the end of each month.
Conclusion for the manager
The auditor's questions about internal control are not an interrogation. A company that answers them clearly gains twice: the audit goes faster, and deficiencies are found before they turn into large losses.
Test yourself
5 questions on this topic: pick an option or reveal the answer.
Under ISA 315 as revised in 2019, how many components make up an entity's system of internal control?
Which three main inherent risk factors does ISA 540 (Revised, auditing accounting estimates) single out when assessing risks for accounting estimates?
Internal control at "Gulobod sut" is very strong; the auditor performed tests of controls and confirmed that they operated effectively. Under ISA 330, what happens to substantive procedures for material account balances (for example, receivables)?
Under the IESBA Code of Ethics, which fundamental principle includes the auditor's duty to take steps so that staff working under their authority have appropriate training and supervision?
In the audit of "Mirzacho'l agro", the auditor wants to be sure that the control of a manager approving voided receipts operated consistently from January to December. Which aspect of this control is being tested, and under which ISA?
Answered: 0 / 50 of 5 correct
All tests →See also
Sources
- Law of the Republic of Uzbekistan "On Auditing Activity" (25 February 2021, No. ZRU-677), Article 9 · international standards on auditing are the standards of auditing activity
- ISA 315 (Revised 2019) "Identifying and Assessing the Risks of Material Misstatement", copy of the IFAC publication (on the Malaysian Institute of Accountants website) · text of the standard; components of the system of internal control
- KPMG: Accounting and Auditing Update (January 2020), overview of ISA 315 (Revised 2019) · five components: control environment, risk assessment process, monitoring process, information system and communication, control activities
- ICAEW: Revised ISA 315 for 2022 audits · the standard applies to audits of periods beginning on or after 15 December 2021
- Chartered Accountants Ireland: ISA (UK and Ireland) 330, paragraph 8 · when tests of controls are required: when the auditor expects to rely on controls or when substantive procedures alone cannot provide sufficient appropriate evidence
- Chartered Accountants Ireland: ISA (UK and Ireland) 330, paragraph 18 · irrespective of the assessed risk, substantive procedures are performed for each material class of transactions, account balance and disclosure
- IAASA: ISA 265 "Communicating Deficiencies in Internal Control" · significant deficiencies are communicated in writing to those charged with governance on a timely basis
- Café, names, examples and tables · compiled by the author, hypothetical