ACCT3002 Chap.6 Internal Controls and Control Risk
Internal Controls and Control Risk
Internal controls help management achieve assertions and prepare reliable financial statements. The auditor understands design, considers implementation and tests operation before relying on a lower control-risk assessment.
A control deficiency answer should identify the missing or ineffective control, explain the possible misstatement, propose a control that changes authority or review, and state the auditor's responsive testing. Tests of controls examine whether a control operated; substantive procedures test recorded amounts directly.
What this chapter covers
- 01
Control environment
- 02
Segregation of duties
- 03
Authorisation
- 04
Independent review
- 05
Tests of controls
- 06
Substantive response
Worked example · free
Separate supplier creation from payment
- 1Identify incompatible master-file, recording and payment access.
- 2Explain the risk of fictitious suppliers, diverted payments and misstated expenses, payables or cash.
- 1Separate duties and require independent approval of new suppliers and bank-detail changes.
- 2Test access, approvals, change logs and unusual suppliers, then revise substantive work.
Key terms
- Control environment
- The control environment is the governance, attitudes, responsibilities and discipline that shape how controls operate across the entity.
- Control deficiency
- A control deficiency exists when a control is missing, poorly designed or fails to operate so misstatement may not be prevented or detected.
- Test of control
- A test of control obtains evidence about whether a relevant control operated effectively during the period.
- Substantive procedure
- A substantive procedure seeks direct evidence about transactions, balances or disclosures through tests of details or analytics.
Internal Controls and Control Risk FAQ
How do controls affect substantive testing?
Strong controls that are properly designed, implemented and tested can support lower control risk and less substantive work. Weak, failed or untested controls require a higher assessment and more direct evidence. The relationship may change as new exceptions appear.
What is the difference between a control recommendation and an audit response?
A recommendation tells management how to prevent or detect the problem, such as separating access or adding independent review. The audit response changes evidence work, such as testing access logs, expanding samples or performing more substantive procedures.
Does one matched document prove a control worked?
No. The auditor needs evidence that the control operated across the relevant period and population. Define the control, select appropriate occurrences, inspect performance and follow up deviations. A single clean item may not support planned reliance.
How do I diagnose a control weakness completely?
Name the missing or ineffective activity, the duties or data it concerns, and the person who currently performs them. Explain the unauthorised transaction or accounting error that could follow and attach it to an assertion. Design a replacement that is specific enough to operate: identify the owner, evidence of approval, frequency, information reviewed and treatment of exceptions.
Then separate management's correction from the auditor's response. The auditor may inspect access rights, observe performance, sample approvals, reperform a reconciliation or test exception logs. If operation is not supported, increase control risk and revise the nature, timing or extent of substantive work. This sequence turns a generic segregation point into a defensible audit analysis.
What distinguishes a walkthrough from reliance testing?
A walkthrough follows one or a few transactions through initiation, processing, recording and reporting to confirm the auditor's understanding and locate relevant controls. It can include inquiry, observation and inspection, but it does not ordinarily establish consistent operation throughout the period.
Reliance testing selects occurrences across the relevant time, examines evidence that authorised personnel performed the activity, checks how exceptions were resolved and may reperform the control. Evaluate deviations by cause and frequency rather than treating every signature as proof. A control that is well designed but inconsistently operated cannot support the planned low assessment.
Explain what additional substantive evidence is required when the intended reliance is no longer justified.
What compact chain links a weakness to audit work?
Use weakness, possible error, assertion, redesigned control, test and evidence consequence. Naming all six prevents the common jump from poor segregation straight to a recommendation. The redesigned activity needs an owner, frequency, review criteria and retained evidence; the test needs a population and expected attribute.
If deviations undermine reliance, the final link raises control risk and redirects substantive procedures toward the balance, transaction or disclosure exposed by the failed activity.
Exam move
For every weakness, use four headings: missing control, possible misstatement, management fix and auditor response. This prevents the recommendation from being mistaken for audit evidence. Practise classifying procedures as tests of controls or substantive tests and explain the objective of each. When a deviation appears, write how it changes reliance, control risk and the planned evidence mix.
Working through Internal Controls and Control Risk in ACCT3002? Sia is AskSia’s AI Accounting tutor — ask any ACCT3002 Internal Controls and Control Risk question and get a clear, step-by-step explanation grounded in how ACCT3002 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.