Internal Controls and Control Testing
This domain tests whether you can select the right control, test it properly, and defend a conclusion on design and operating effectiveness - including when a finding is severe enough to be a material weakness.
Framework anchor
COSO Internal Control - Integrated Framework (2013): five components - control environment, risk assessment, control activities, information and communication, and monitoring activities - supported by 17 principles. Control activities are the policies and procedures that mitigate risk.
Control types
- Preventive, detective, corrective.
- Manual, automated, and IT-dependent manual.
- IT general controls (access management, change management, operations) underpin the reliability of automated controls.
- Key controls are those whose failure could materially affect the objective; test those first and report on those.
Testing
- Design effectiveness: does the control, as designed, address the risk? Evidence: policy, walkthrough, configuration export.
- Operating effectiveness: did it operate consistently across the period? Evidence: sample inspection, reperformance, observation.
- Inquiry alone never supports an effectiveness conclusion.
- Sample size scales with frequency: a high-frequency manual control tested annually typically uses 25 items (more for higher assurance); an automated control can often be tested once, provided the relevant ITGCs are effective.
- Handle exceptions by investigating cause, expanding the sample, and concluding.
Deficiency classification
Deficiency, significant deficiency, and material weakness, judged by likelihood and magnitude of potential misstatement. Compensating controls can reduce severity but do not erase a failed key control.
Worked example
Three-way match in accounts payable. Design: read the policy, walk through one invoice, and confirm the ERP blocks payment release without an approved purchase order and goods receipt - design effective. Operating: population of 4,200 POs, random sample of 25, attributes tested for approval before ordering, receipt before payment, and amount within tolerance. One exception: payment without a goods receipt. Cause: a manual override available to two users. Action: expand the sample; if further exceptions appear, conclude the control is not operating effectively, report a deficiency, and remove the override.
Traps that cost marks
- Concluding effectiveness from inquiry alone.
- Testing a non-key control and presenting it as key.
- Clearing an automated control without checking configuration or ITGCs.
- Using design evidence to answer an operating-effectiveness question.