Internal Controls (Advanced)

In modern business environments, virtually all financial reporting depends on IT systems. The auditor must understand and evaluate both IT general controls (ITGCs) and IT application controls.

IT General Controls (ITGCs)

IT Application Controls

Practical implication: When automated controls are effective and supported by strong ITGCs, the auditor can test them with very small samples (often just one or two instances) because the control performs identically every time. Manual controls require much larger samples because each instance depends on human performance.

Entity-level controls operate across the organisation as a whole — they are not tied to a specific process or transaction cycle. They include elements from the control environment (ISA 315 component 1) and the monitoring process (component 3).

Examples:

• Governance and oversight: Board/audit committee oversight, tone at the top, code of ethics, whistleblowing policies
• Risk management: Entity-wide risk assessment process, risk appetite statements
• Management monitoring: Regular review of financial results against budget, KPI dashboards, variance analysis
• Internal audit function: Systematic evaluation of controls (see ISA 610 below)
• HR policies: Competence requirements, background checks, performance evaluation, segregation of duties policies
• IT governance: IT strategy, security policies, business continuity planning

Audit significance: Entity-level controls influence the overall control environment. Strong entity-level controls (active board oversight, effective internal audit, strong tone at the top) reduce the risk of material misstatement across the board. Weak entity-level controls (poor governance, inadequate monitoring, weak ethical culture) increase risks and may require the auditor to increase the extent of substantive procedures across all areas.

Some entity-level controls are precise enough to prevent or detect material misstatements at the assertion level (e.g., detailed management review of a monthly analytical report). These can be directly tested and relied upon. Others are more indirect (e.g., tone at the top) — they influence the environment but cannot be directly linked to specific assertions.

If the auditor's planned approach involves relying on the operating effectiveness of controls, ISA 330 requires tests of controls that address:

Nature (how the control is tested):

• Inquiry alone is not sufficient — it must be combined with other procedures
• Inquiry + observation: Watch the control being performed (e.g., observe the warehouse manager checking delivery notes against the GRN)
• Inspection: Inspect documentary evidence that the control operated (e.g., check for approval signatures on purchase orders, reconciliation tick marks)
• Reperformance: Independently re-execute the control procedure (e.g., reperform a bank reconciliation, re-run a three-way match)

Timing (when controls are tested):

• The auditor should test controls for the entire period of intended reliance (usually the whole financial year)
• If controls are tested at an interim date (before year-end), the auditor must obtain evidence about significant changes to controls after the interim date and perform additional procedures to extend the conclusions to the period-end (e.g., inquiry, observation, and further testing of controls operating after the interim date)
• For significant risks: controls must be tested in the current period — the auditor cannot rely on prior year testing
• For other risks: if the auditor intends to rely on controls tested in a prior period, they must: test a proportion of those controls in each audit (on a rotation basis), and perform procedures to confirm that the controls have not changed since they were last tested (inquiry + observation/inspection). This rotation approach is only appropriate if the controls have not changed and are not related to significant risks.

Extent (sample size for testing):

• The sample size depends on: how frequently the control operates (daily, weekly, monthly, annually), the desired level of assurance, the assessed risk, and whether the control is automated or manual
• Automated controls: If ITGCs are effective, a very small sample (even 1–2 instances) may suffice because the control operates identically every time
• Manual controls: Larger samples are needed — the more frequently the control operates, the larger the sample. For daily controls, sample sizes of 20–40 are common; for weekly controls, 5–15; for monthly, 2–5.
• If deviations (instances where the control did not operate as designed) are found: evaluate the nature and cause, consider the impact on reliance, and potentially increase the sample size or abandon reliance on the control and increase substantive procedures

ISA 610 (Revised 2013) addresses the external auditor's responsibilities regarding the work of the entity's internal audit function.

Two ways the external auditor may use internal audit:

1. Using the work of internal auditors (ISA 610.15-25):

• The external auditor may use work already performed by internal audit (e.g., their testing of controls, substantive procedures, observations)
• Before relying on internal audit work, the external auditor must evaluate:
  • Objectivity: Is the internal audit function independent of the operational areas it reviews? Does it report to TCWG or the audit committee? Is it free from management bias?
  • Competence: Do internal auditors have adequate training, qualifications, and experience?
  • Systematic and disciplined approach: Does internal audit follow professional standards (IIA Standards), have quality control, and document its work properly?
• Even if internal audit work is used, the external auditor must perform sufficient work themselves — they cannot delegate their responsibility for the audit opinion. The external auditor retains sole responsibility for the opinion.
• Areas of greater judgement or higher risk should be performed directly by the external auditor, not delegated to internal audit

2. Direct assistance from internal auditors (ISA 610.26-35):

• Internal auditors may provide direct assistance — performing audit procedures under the direction, supervision, and review of the external auditor
• This is only permitted if not prohibited by law or regulation (note: in the UK, the FRC Ethical Standard generally prohibits direct assistance for PIE audits)
• If permitted: the external auditor must assess objectivity and competence, provide direction and supervision, review the work performed, and document the nature and extent of internal audit's involvement
• Direct assistance must NOT be used for areas of significant judgement or significant risk

ISA 620 applies when the external auditor uses the work of an expert — an individual or organisation with specialised knowledge in a field other than accounting or auditing (e.g., a property valuer, actuary, geologist, environmental specialist, IT forensics expert, legal specialist).

When is an expert needed? When the audit requires knowledge beyond the auditor's competence — for example: valuing complex financial instruments, assessing environmental liabilities, evaluating mineral reserves, determining the useful life of specialised assets, or assessing pension obligations.

Auditor's expert vs management's expert:

• Auditor's expert: Engaged by or works for the audit firm. Their work forms part of the audit evidence. ISA 620 applies.
• Management's expert: Engaged by the entity to help prepare the financial statements (e.g., the actuary who calculates the pension liability). The auditor evaluates the expert's work as part of auditing management's assertions. ISA 500 applies (evaluating evidence).

Requirements when using an auditor's expert (ISA 620):

• Evaluate competence, capabilities, and objectivity: Does the expert have relevant qualifications and experience? Are they independent of the entity? Any circumstances that might compromise objectivity?
• Agree the scope and terms: Nature, scope, and objectives of the work, respective roles, communication arrangements, confidentiality requirements
• Evaluate the adequacy of the expert's work: The auditor must evaluate: the relevance and reasonableness of the expert's findings, the data used (source, completeness, accuracy), the assumptions and methods, and the consistency with other audit evidence
• The auditor retains responsibility: Using an expert does NOT reduce the auditor's responsibility for the audit opinion. The expert is not mentioned in the audit report (unless required for understanding of a modification or KAM, in which case the report states that mention of the expert does not reduce the auditor's responsibility).

ISA 402 applies when an entity (the user entity) outsources processes that are relevant to financial reporting to a service organisation. Examples include: outsourced payroll processing, outsourced transaction processing (e.g., credit card processing), outsourced IT hosting (cloud computing), custodian services for investments.

The auditor's responsibilities:

• The user entity's auditor must obtain an understanding of the nature and significance of the services provided and their effect on the user entity's internal controls
• If the services are significant: the auditor must obtain sufficient appropriate audit evidence about the design and operating effectiveness of controls at the service organisation

How to obtain evidence about controls at a service organisation:

1. Type 1 report (SOC 1 / ISAE 3402 Type 1): A report by the service organisation's auditor on the design and implementation of controls at a point in time. Does NOT provide evidence on operating effectiveness.
2. Type 2 report (SOC 1 / ISAE 3402 Type 2): A report on the design, implementation, AND operating effectiveness of controls over a specified period. More useful — provides assurance that controls actually worked throughout the period.
3. Direct testing: The user entity's auditor may visit the service organisation and perform their own testing (subject to the agreement with the service organisation).
4. Alternative procedures: If a Type 1/2 report is not available and direct testing is not possible, the auditor may use: inquiry of the service organisation, inspection of documents, or user entity controls (controls the user entity has over the outsourced process — e.g., reconciliations, output reviews).

Complementary user entity controls: Service organisations often specify controls that the user entity should implement to complement the service organisation's controls (e.g., reviewing output reports, performing reconciliations). The user entity's auditor must evaluate whether these complementary controls are in place and operating effectively.

Sub-service organisations: If the service organisation itself outsources to another organisation (a sub-service organisation), the auditor must consider the inclusive method (the report covers the sub-service organisation) vs the carve-out method (the sub-service organisation is excluded — the user auditor must obtain separate evidence).