AUD Area II.C — Understanding Internal Control, Business Processes, and IT in Risk Assessment

COSO Internal Control – Integrated Framework

The most commonly used model in U.S. practice for describing and evaluating internal control.

Internal control

Processes designed by a company's board, management, and employees to provide reasonable assurance about achieving objectives.

Reasonable assurance

The level of assurance that controls can reduce risk but not eliminate it.

Control Environment

The foundation for control consciousness, often described as the 'tone at the top'.

Risk Assessment

How the entity identifies and analyzes risks to achieving its objectives.

Control Activities

Policies and procedures that help ensure management directives are carried out.

Information and Communication

How information is generated and communicated to enable people to perform controls.

Monitoring Activities

Ongoing evaluations to check whether controls are present and functioning.

Entity-level controls (ELCs)

Controls that have a pervasive effect across the entity rather than addressing one transaction stream.

IT General Controls (ITGCs)

Controls over the IT environment that support the effective functioning of application controls.

Application controls

Controls built into a specific application to prevent or detect misstatements in a particular transaction stream.

Walkthrough

An audit technique that traces one transaction from initiation through recording and reporting.

SOC 1 report

Reports on controls at a service organization relevant to user entities' internal control over financial reporting.

Type 1 SOC report

Reports on the design of controls and whether they were placed in operation as of a point in time.

Type 2 SOC report

Includes Type 1, plus tests of operating effectiveness over a period of time.

Management override

The ability of management to circumvent controls that appear well designed, especially in financial reporting.

Collusion

The act of two or more people circumventing segregation of duties.

Human judgment and error

Common limitation of internal control systems, resulting from misunderstandings, fatigue, or poor training.

Complementary user entity controls (CUECs)

Controls the SOC report assumes the user entity must implement for the system to work as intended.

Audit committee oversight

A key example of entity-level controls influencing financial reporting.

Operational effectiveness

Evaluating whether a control operates as intended over a period.

Design effectiveness

Determining if a control, when operated as described, would prevent or detect misstatements.

Accrual true-up

A manual journal entry that may misstate financial results if issued without proper controls.

Unusual transactions

Transactions that require special scrutiny due to their nature or timing, often involving management override risk.

Segregation of duties

A control designed to reduce errors and fraud by ensuring that no single individual is responsible for all aspects of a transaction.

Material misstatement

An error or omission in financial reporting that could influence the economic decisions of users.

Precision review

A high-level review that requires clear expectations, defined thresholds for follow-up, and competent reviewers.

Audit evidence

Information auditors gather to support their findings and conclusions, particularly regarding controls.