Internal control objectives responsibility and limitations

Internal control

A process carried out by the board, management, and personnel to provide reasonable assurance about reporting reliability, operating effectiveness and efficiency, and legal or regulatory compliance.

Three internal control objective categories

Reliable financial reporting; effective and efficient operations; compliance with applicable laws and regulations.

Control environment foundation

The control environment supports the entire internal control system.

Internal control limitations

Human error, deliberate circumvention, and collusion can prevent controls from providing absolute assurance.

Management internal control responsibility

Establish and maintain adequate ICFR and assess and report on its effectiveness when required.

Auditor internal control responsibility

Understand relevant controls, assess control risk, evaluate controls addressing identified fraud risks, and test or report on controls when required or when relying on them.

Less control reliance

Higher assessed control risk and RMM lead to lower planned detection risk, stronger tests, more year end work, and generally larger samples.

More control reliance

Supported lower control risk may permit higher planned detection risk, more interim testing, and fewer substantive tests while still obtaining sufficient evidence.