Materiality, Risk Assessment & Internal Control
Comprehensive master handwritten notes covering the full architecture of SA 315, SA 320, SA 330, and SA 265. Features the complete mathematical audit risk model, the CRIME internal control components, internal check protocols, evaluation techniques (ICQ, Checklists, Flowcharts), international frameworks (COSO, CoCo, Turnbull, SOX 404), Indian Companies Act 2013 IFCoFR statutory mandates, and zero-omission solutions for all 5 TYUs and 15 TYKs.
CA Y has been serving as the statutory auditor of a dynamic manufacturing company for the last three years. As he prepared for the upcoming audit cycle, an uncomfortable question struck him: "Is conducting a full risk assessment practically useful every single year? Can't we simply adopt the SALY approach (Same As Last Year) since the business operations appear largely unchanged?"
To resolve this dilemma, CA Y attended an advanced technical webinar on audit effectiveness. The session illuminated critical insights:
- Mandatory Legal & Professional Duty: Assessing audit risk is not an optional academic exercise—it is explicitly mandated by SA 315 and SA 320. A dynamic risk assessment directly drives audit effectiveness and audit quality.
- Risks Are Never Static: Even if the client's core operations seem unchanged, external factors evolve rapidly: amendments in taxation or corporate laws, emergence of technological disruptions, supply chain shifts, inflationary cost pressures, or changes in senior management. The auditor's risk assessment must reflect these ground realities.
- Business Risk Linkage: Understanding client business risks (e.g., loss of a key customer, cyber threats, raw material shortages) and evaluating the company's strategies to mitigate them allows the auditor to identify areas where Risk of Material Misstatement (RMM) spikes.
- Control Deficiencies & Missing Controls: Evaluating internal control systems pinpoints specific gaps where controls are deficient or entirely non-existent, causing Control Risk (CR) to escalate.
- Saving the Auditor's Skin (Legal Defense): Identifying and communicating significant deficiencies in internal control to Those Charged with Governance (TCWG) under SA 265 induces boardroom action and serves as crucial contemporaneous documentation protecting the auditor against future allegations of negligence!
1. Materiality & Risk Assessment (SA 320 & SA 315)
As per SA 320 "Materiality in Planning and Performing an Audit", the concept of materiality is applied by the auditor both in planning and performing the audit, and in evaluating the effect of identified misstatements on the audit and of uncorrected misstatements, if any, on the financial statements, and in forming the opinion in the auditor's report.
Materiality and audit risk are considered throughout the audit, in particular when:
- Identifying and assessing the risks of material misstatement (SA 315).
- Determining the nature, timing, and extent (NTE) of further audit procedures (SA 330).
- Evaluating the effect of uncorrected misstatements on the financial statements and forming the auditor's opinion (SA 450 & SA 700).
Risk assessment assesses the level of risk across various business processes. It focuses specifically on:
- Business Environment: Market conditions, competitive forces, customer demand, and technological advancements.
- Regulatory Environment: Specific industry regulations, environmental laws, labour codes, and tax frameworks.
- Organizational Structure: Decentralized operations, branch networks, delegation of authority, and reporting hierarchies.
- Environmental & Operational Changes: New product launches, enterprise software migrations (ERP), mergers, or restructuring.
- Specific Concerns: Matters flagged by executive management, internal auditors, or the Audit Committee.
1.1 Identification of Risks & Audit Risk Definition
Audit Risk is defined as the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. Audit risk is a function of the risks of material misstatement (RMM) and detection risk (DR).
1.2 Audit Risk Components & Mathematical Relationship
Audit risk comprises three distinct components, structured across client-level risks (pre-existing prior to audit) and auditor-level risks:
| Component | ICAI Standard Definition | Practical Commentary & Auditor Focus |
|---|---|---|
| Inherent Risk (IR) (Client Level) |
The susceptibility of an assertion about a class of transaction, account balance, or disclosure to a misstatement that could be material, either individually or when aggregated with other misstatements, assuming that there were no related internal controls. Addressed at both the overall financial statement level and the assertion level. |
Arises from the entity's nature, industry, and external environment. High-risk areas include:
|
| Control Risk (CR) (Client Level) |
The risk that a misstatement that could occur in an assertion about a class of transaction, account balance, or disclosure and that could be material, individually or when aggregated, will not be prevented, or detected and corrected, on a timely basis by the entity's internal control. | Management is responsible for designing, implementing, and maintaining internal controls. Entity-level controls (board oversight, ITGC, HR policies) are pervasive, while activity-level controls relate to specific assertions. Due to inherent limitations, control risk can never be zero. |
| Detection Risk (DR) (Auditor Level) |
The risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will not detect a misstatement that exists and that could be material, individually or when aggregated with other misstatements. |
Detection risk is strictly within the auditor's control. It arises from:
|
Audit Risk (AR) = Inherent Risk (IR) × Control Risk (CR) × Detection Risk (DR)
Since Risk of Material Misstatement (RMM) = Inherent Risk (IR) × Control Risk (CR), the formula simplifies to:
Audit Risk (AR) = Risk of Material Misstatement (RMM) × Detection Risk (DR)
1. Inverse Relationship between RMM and DR: For a given target level of Audit Risk, the acceptable level of Detection Risk bears an inverse relationship to the assessed RMM. If RMM is High, acceptable DR must be Low (requiring extensive, rigorous substantive testing). If RMM is Low, acceptable DR can be Higher.
2. Inverse Relationship between Materiality and Audit Risk: There is an inverse relationship between Materiality and the level of Audit Risk. The higher the materiality level, the lower the audit risk, and vice versa. The auditor takes this inverse relationship into account when determining the nature, timing, and extent of audit procedures.
The interrelationship between Inherent Risk, Control Risk, and Detection Risk is illustrated below:
| Auditor's Assessment of Control Risk | Auditor's Assessment of Inherent Risk | ||
|---|---|---|---|
| High | Medium | Low | |
| High | Lowest | Lower | Medium |
| Medium | Lower | Medium | Higher |
| Low | Medium | Higher | Highest |
📋 Management Assertions under SA 315
Financial statements represent representations made by management about recognition, measurement, presentation, and disclosure of economic events. For example, management of ABC Ltd asserts that sales records contain all transactions (completeness), that transactions took place and are valid (occurrence), and have been properly recorded in the correct period (accuracy and cut-off).
- Occurrence: Transactions and events recorded have occurred and pertain to entity.
- Completeness: All transactions and events that should have been recorded have been recorded.
- Accuracy: Amounts and other data have been recorded appropriately.
- Cut-off: Transactions recorded in the correct accounting period.
- Classification: Transactions recorded in proper nominal ledger accounts.
- Existence: Assets, liabilities, and equity interests exist.
- Rights and Obligations: Entity holds or controls the rights to assets, and liabilities are obligations of the entity.
- Completeness: All assets, liabilities, and equity interests that should have been recorded have been included.
- Valuation and Allocation: Assets, liabilities, and equity are included at appropriate amounts, including valuation adjustments.
- Occurrence, Rights & Obligations: Disclosed events have occurred and pertain to entity.
- Completeness: All disclosures that should have been included in the FS have been included.
- Classification & Understandability: Financial information is appropriately presented and described, and disclosures clearly expressed.
- Accuracy & Valuation: Financial and other information are disclosed fairly and at appropriate amounts.
⚖️ Two Levels of Assessing Risks of Material Misstatement
Auditors are required to assess the risks of material misstatement at two distinct levels:
-
Overall Financial Statement Level: Refers to risks of material misstatement that relate pervasively to the financial statements as a whole and potentially affect many assertions.
ICAI Example 2: If the top accountant is not competent enough, errors could occur across the entire financial statements. Such errors will not be confined to a single account balance or assertion (e.g. completeness of sales), but will pervade accuracy, existence, and valuation across multiple financial statement heads. -
Assertion Level: Relates to risks identifiable with specific assertions at the class of transactions, account balance, or disclosure level (Completeness, Existence, Accuracy, Valuation).
ICAI Example 3: While considering the valuation assertion, the auditor could assess the risk of error in payables as low; however, for inventory where obsolescence is a major factor, the auditor would assess the valuation risk as high. Similarly, risks due to completeness (missing items) in inventory may be low, but high in relation to sales.
Background: During the process of extracting exception reports, the auditors noted numerous purchase entries without valid purchase orders.
Analysis: In terms of percentage, about 40% of purchases were made without valid purchase orders, and a few purchase orders were validated only after the actual purchase took place. Furthermore, there was no reconciliation between the goods received and the goods ordered.
Assertion Affected: Validity of purchases (Occurrence & Accuracy).
Pervasive / Account Balance Level: Account Balance Level.
Account Balances Affected: (i) Purchases, and (ii) Accounts Payable / Trade Payables.
Audit Procedures Addressing Validity of Account Balance:
- Select a sample of purchases; review correspondence with vendors, internal purchase requisitions, and vendor account reconciliations.
- Review vendor listing along with ageing details; follow up material amounts paid before normal credit periods and analyse reasons for exceptions.
- Meet with the company's purchase officer and obtain formal responses to inquiries regarding purchases made without POs.
- Discuss a formal summary of such control issues with client management and TCWG.
2. Risk-Based Audit Approach (RBA)
Under a modern Risk-Based Audit (RBA) approach, the auditor does not distribute audit effort equally across all balances. Instead, audit resources are directed proactively to areas carrying the highest risk of material misstatement.
2.1 Audit Risk Analysis
Audit risk analysis evaluates the probability and potential monetary magnitude of misstatements across various operational cycles. The auditor distinguishes between:
- Business Risks: Risks resulting from significant conditions, events, circumstances, actions, or inactions that could adversely affect an entity's ability to achieve its objectives and execute its strategies.
- Audit Risks: The risk that the auditor fails to detect material misstatements resulting from these business risks in the financial statements.
2.2 General Steps in the Conduct of Risk-Based Audit
The execution of an RBA spans three sequential phases:
• Perform preliminary engagement activities (SA 220 & SQC 1).
• Plan overall engagement and determine materiality (SA 300 & 320).
• Perform Risk Assessment Procedures (RAP): inquiries, analytical procedures, observation, and inspection (SA 315).
• Understand entity, environment, and internal controls (Design & Implementation - D&I).
• Assess RMM at Financial Statement level and Assertion level.
• Identify Significant Risks requiring special audit consideration.
• Develop overall responses to FS-level risks (assign experienced staff, increase skepticism).
• Design and perform Further Audit Procedures (FAP) under SA 330.
• Conduct Tests of Controls (TOC) to evaluate operating effectiveness.
• Address automated processing where substantive procedures alone are insufficient.
• Perform substantive procedures (Tests of Details & Analytical Procedures).
• Introduce an element of unpredictability in audit procedures.
• Test journal entries to counter management override of controls.
• Evaluate sufficiency and appropriateness of audit evidence obtained.
• Determine whether assessed level of risk changed during audit fieldwork.
• Evaluate impact of identified and uncorrected misstatements (SA 450).
• Communicate internal control deficiencies to TCWG & management (SA 265).
• Formulate independent audit opinion under SA 700 / 705 / 706.
Before concluding the audit, the auditor must assess whether the preliminary assessment of control risk is confirmed by the results of substantive procedures and tests of controls.
If deviations are discovered, the auditor must make specific inquiries to understand their cause and implications. If the auditor concludes that the preliminary low assessment of control risk is not supported, he must increase the assessed level of control risk and correspondingly expand the nature, timing, and extent (NTE) of substantive procedures!
💡 Test Your Understanding (TYU 1 & 2 Solved)
1. ICAI Solution Analysis:
Evaluation of internal controls influences the auditor's assessment of risks of material misstatement. Risks of material misstatement also consist of control risk.
2. Deviation from Established Controls:
In the statutory audit of the Divisional office, procedure relating to delegation of powers was violated: surveyor appointments were made unilaterally by the Divisional Manager instead of the Divisional Claims Committee in 5 out of 10 cases (50% deviation). This is a serious violation demonstrating that controls are not operating effectively as laid down by company management.
3. Impact on Substantive Procedures:
Such deviations from established controls lead the auditor to conclude that control risk needs to be revised upward. Revision of control risk leads directly to an increase in the assessed risk of material misstatement (RMM). Consequently, CA R must modify and expand the nature, timing, and extent (NTE) of planned substantive procedures—including independent examination of surveyed claims and verifying surveyor assessments.
1. ICAI Assessment of All Audit Risk Components:
For assessing audit risk, the auditor shall evaluate all components of audit risk (Inherent Risk, Control Risk, and Detection Risk):
2. Inherent Risk Considerations (High):
- The NGO is operating in a political-cum-social field, making its core activities inherently risky.
- Crowdfunding donations must be examined in relation to the constitution/trust deed of the NGO.
- Receipt of foreign funds carries high inherent risk; the credibility and integrity of persons behind the NGO is paramount, as shady NGOs can be involved in money laundering or misutilizing donor funds.
- Unaudited last year accounts increase inherent risk due to the probable carry-forward effect of opening misstatements (SA 510).
- Risk of non-compliance with strict FCRA laws carries severe consequences, including cancellation of registration (SA 250 & SA 570).
3. Control Risk Considerations (High):
Because the NGO scaled up rapidly in the current year from a small scale, formal internal controls may be absent or non-existent. Lack of formal controls increases the probability of non-compliance with statutory regulations.
4. Detection Risk Considerations:
Since the audit is accepted for the first time, the auditor lacks historical familiarity with the NGO's systems. This may lead to higher detection risk due to inappropriate sampling or faulty audit procedures unless extensive substantive testing is planned.
3. Internal Control System: Nature, Scope, Objectives & Structure
A comprehensive set of internally generated policies and procedures adopted by management is a prerequisite for an organization's efficient and effective functioning. Creating and maintaining an adequate system of internal control appropriate to the size and complexity of the business is a primary and non-delegable responsibility of management and Those Charged with Governance (TCWG).
3.1 Nature of Internal Control & Standard Definition
As per SA 315, Internal Control is defined as:
"The process designed, implemented, and maintained by Those Charged with Governance, management, and other personnel to provide reasonable assurance about the achievement of an entity's objectives with regard to:
1. Reliability of financial reporting,
2. Effectiveness and efficiency of operations,
3. Safeguarding of assets, and
4. Compliance with applicable laws and regulations."
When obtaining audit evidence about the effective operation of internal controls, the auditor considers:
• How they were applied;
• The consistency with which they were applied during the period; and
• By whom they were applied.
Deviations in Effective Operation: The concept of effective operation recognizes that some deviations may have occurred (caused by staff turnover, significant seasonal volume fluctuations, or human error). When deviations are detected, the auditor makes specific inquiries regarding the timing of staff changes in key control functions and ensures that tests of controls appropriately cover such periods of fluctuation.
ICAI Example 5: The auditor might obtain audit evidence about proper segregation of duties by observing the individual who applies a control procedure. However, observation pertains only to the point in time at which the procedure was applied. The auditor may decide to supplement observation with inquiry, inspection of reports, or testing controls throughout the period. If substantially different controls were in use at different times (e.g. ERP changeover mid-year), the auditor would consider each separately.
Internal control, no matter how sophisticated and well-designed, can provide management and the auditor with only reasonable assurance—and NEVER absolute assurance—that operational, financial reporting, and compliance objectives will be achieved.
This is due to the inherent limitations of internal control, which include:
- Cost-Benefit Constraint: Management's consideration that the cost of an internal control does not exceed the expected benefits to be derived.
- Human Vulnerability: The fact that most controls tend to be directed at routine rather than unusual transactions; potential for human error due to carelessness, distraction, errors of judgment, or misunderstanding of instructions.
- Collusion: The possibility of circumvention of internal controls through collusion with employees or with parties outside the entity.
- Abuse of Authority / Management Override: The possibility that a person responsible for exercising an internal control could abuse that responsibility (e.g. a member of management overriding controls).
- Manipulations by Management: Manipulations with respect to transactions or estimates and judgments required in preparing financial statements.
3.2 Scope of Internal Controls
The scope of internal controls extends beyond mere accounting controls and includes administrative controls, operational workflows, and statutory compliance mechanisms.
In an independent financial audit, the auditor is primarily concerned with those policies and procedures within accounting and internal control systems that are relevant to the financial statement assertions.
- ICAI Example 6 (Operational Data): If production statistics were used as a basis for an analytical procedure, the controls to ensure the accuracy of such statistics would be relevant to the audit.
- ICAI Example 6 (Legal Compliance): If non-compliance with certain laws and regulations has a direct and material effect on the financial statements, controls over such compliance are directly relevant.
3.3 Objectives of the Internal Control System
The objectives of internal control relating to the accounting system ensure that transactions processed are complete, valid, and accurate:
Transactions are executed strictly in accordance with management's general or specific authorization.
All transactions are promptly recorded in an appropriate manner to permit preparation of financial statements and maintain accountability for assets.
Assets and records are safeguarded from unauthorized access, use, or disposition.
Assets are verified at reasonable intervals and appropriate action is taken with regard to discrepancies.
ICAI Example 7: In case it is found that sales transactions are not being properly valued in accordance with price lists, the auditor would concentrate on seeing that invoices are priced accurately and recoverable amounts are correctly posted. He may also want to expand his confirmation requests at year-end to cover a larger sample of trade receivables.
3.4 Structure of Internal Control & Five Foundational Elements
In order to achieve control objectives, it is necessary to establish adequate control policies and procedures across five elements:
-
3.4.1 Segregation of Duties (SOD): Transaction processing is allocated to different persons so that no single person handles all aspects of a transaction from beginning to end:
(a) Authorization of transactions;
(b) Execution of transactions;
(c) Physical custody of related assets; and
(d) Maintenance of records and documents.
Periodic Rotation: Periodic rotation of personnel duties is highly desirable to prevent fatigue, eliminate complacency, avoid collusion, and develop alternative capable personnel. - 3.4.2 Authorization of Transactions: Delegation of financial and operational authority to specified levels and designated officers.
-
3.4.3 Adequacy of Records and Documents: Accounting controls should ensure that:
(i) Transactions are executed in accordance with management authorization;
(ii) Transactions and events are promptly recorded at correct amounts;
(iii) Transactions are classified in appropriate accounts and in the proper period;
(iv) Recording facilitates preparation of financial statements in conformity with applicable FRF;
(v) Recording facilitates maintaining accountability for assets;
(vi) Assets and records are protected from unauthorized access or use;
(vii) Sufficient descriptive records of assets (identification and location) are maintained. - 3.4.4 Accountability and Safeguarding of Assets: Accountability commences right from asset acquisition through disposal. Fixed assets register, inventory bin cards, and physical security measures.
- 3.4.5 Independent Checks: Independent verification of control systems, surprise counts, bank reconciliations, and critical reviews by internal auditors.
Internal Check implies an organization of the overall system of bookkeeping and accounting duties where staff duties are arranged such that the day-to-day work of one employee is complementary to and automatically checked by another employee.
Objectives of Internal Check:
- To detect errors and frauds with ease and speed.
- To minimize commission of errors and frauds by any staff member.
- To increase staff operational efficiency.
- To locate the specific stage or responsibility area where error/fraud occurred.
- To prevent embezzlement of cash and falsification of accounts.
General Conditions Pertaining to Internal Check (ICAI 10 Principles):
- No single person should have complete control over any important aspect of business operations.
- Staff duties should be rotated periodically.
- Every staff member should be encouraged to take annual leave.
- Persons having physical custody of assets must not have access to books of account.
- Accounting control over each class of asset, supported by periodic physical verification.
- Mechanical devices (biometrics, cash registers, POS) should be used wherever practicable.
- Budgetary control should be exercised and wide deviations reconciled.
- For year-end inventory taking, trading activities should, if possible, be suspended.
- Financial and administrative powers should be distributed judiciously.
- Procedures laid down for periodical verification of different accounting records.
4. Components of Internal Control (The CRIME Framework)
In accordance with SA 315, an internal control system consists of five interrelated components:
• R = Risk Assessment Process of the Entity
• I = Information System & Related Business Processes & Communication
• M = Monitoring of Controls (Ongoing & separate evaluations)
• E = Existing Control Activities (Policies & procedures enforcing management directives)
4.1 Control Environment (Foundational Component)
The control environment sets the tone of an organization, influencing the control consciousness of its people. Key elements evaluated by the auditor include:
- Communication & Enforcement of Integrity and Ethical Values: Code of conduct, whistleblower mechanisms, and removal of incentives that encourage unethical acts.
- Commitment to Competence: Matching employee skills with requisite knowledge and training.
- Participation by TCWG: Independence from management, experience, stature, and active oversight of financial reporting.
- Management's Philosophy & Operating Style: Approach to taking and managing business risks, attitudes toward financial reporting, and accounting estimates.
- Organizational Structure: Clear framework for planning, executing, controlling, and reviewing activities.
- Assignment of Authority & Responsibility: Clear reporting relationships and authorization hierarchies.
- Human Resource Policies & Practices: Standards for hiring, orientation, training, evaluating, counseling, promoting, and compensating personnel.
4.2 Entity's Risk Assessment Process (9 Circumstances Where Risks Arise)
How management identifies business risks relevant to financial reporting, estimates their significance, assesses likelihood, and decides actions to address them.
- (a) Changes in Operating Environment: Changes in regulatory or operating environments can result in changes in competitive pressures and significantly different risks.
- (b) New Personnel: New personnel may have a different focus on or understanding of internal control.
- (c) New or Revamped Information Systems: Significant and rapid changes in IT systems can change the risk pertaining to internal control.
- (d) Rapid Growth: Significant and rapid expansion of operations can strain controls and increase the risk of a breakdown in controls.
- (e) New Technology: Incorporating new technologies into production processes or information systems may change the risk associated with internal control.
- (f) New Business Models, Products, or Activities: Entering into business areas or transactions with which an entity has little experience may introduce new risks.
- (g) Corporate Restructurings: Restructurings, divestitures, or acquisitions may be accompanied by staff reductions and changes in supervision and segregation of duties.
- (h) Expanded Foreign Operations: Expansion into foreign operations carries new and unique risks (currency volatility, foreign compliance).
- (i) New Accounting Pronouncements: Adoption of new accounting principles or changing frameworks (e.g. Ind AS standards) may affect risks in preparing financial statements.
If the auditor identifies risks of material misstatement that management failed to identify:
- The auditor must determine whether an underlying risk of that kind ought to have been identified by the entity's risk assessment process.
- If such a risk existed and was missed, the auditor shall evaluate why the entity's process failed to identify it, and whether the process is appropriate to its circumstances.
- The auditor shall determine whether this represents a significant deficiency in internal control under SA 265!
4.3 Control Activities & Segregation of Duties
Policies and procedures ensuring management directives are carried out. Categories:
- (a) Performance Reviews: Analyses of actual performance vs. budgets, forecasts, and prior periods; relating different sets of operating or financial data to one another; investigative and corrective actions.
- (b) Information Processing: General IT Controls (ITGC) and Application Controls (field checks, automated limits).
- (c) Physical Controls: Physical security over assets, authorization for access to computer programs and data files, and periodic counting and comparison with control records.
- (d) Segregation of Duties: Assigning different personnel responsibilities of authorizing transactions, recording transactions, and maintaining custody of assets.
4.4 Information System, Relevant Business Processes & Communication
The information system relevant to financial reporting objectives ensures the entity:
- Identifies and records all valid transactions;
- Describes transactions on a timely basis in sufficient detail to permit proper classification;
- Measures transaction values properly in financial statements;
- Determines the correct time period in which transactions occurred (proper accounting period); and
- Presents transactions and related disclosures properly in financial statements.
4.5 Monitoring of Controls & Role of Internal Audit
Ongoing monitoring (built into recurring activities like supervisory reconciliations) and separate periodic evaluations (internal audit). If management does not monitor reconciliations, personnel are likely to stop preparing them!
💡 Test Your Understanding (TYU 3 & 4 Solved)
1. Role of Internal Audit:
Internal audit involves continuous and critical appraisal of the functioning of an entity with a view to suggest improvements and add value to strengthen overall governance, strategic risk management, and internal controls. It evaluates control design, implementation, and operating effectiveness.
2. Analysis of the Control Flaw in RK Living Limited:
- The information system requires booking purchases in the purchase ledger and stock records from the date of purchase invoice only.
- Because goods take 3-4 days in transit from Silvassa, booking upon invoice date shows stock as received when the goods are actually in transit.
- This presents a distorted picture of company stocks (overstating physical factory inventory and understating goods-in-transit).
- Furthermore, availing Input Tax Credit (ITC) under GST laws prior to actual physical receipt of goods violates statutory conditions of Section 16(2) of the CGST Act.
3. Internal Auditor's Action:
The design of the control itself is faulty. The internal auditor should report this significant deficiency to management, recommending that stock records and purchases be booked only upon physical receipt and verification via Goods Receipt Notes (GRN), or that a separate "Goods-in-Transit" accounting mechanism be established.
1. Component Identification:
The referred component of internal control is "Control Activities".
2. Specific Sub-Category — Performance Reviews:
- Control activities that may be relevant to an audit include policies and procedures that pertain to "Performance Reviews".
- Such control activities include reviews and analyses of actual performance versus budgets, forecasts, and prior period performance; relating different sets of data (operating or financial) to one another; and taking investigative and corrective actions.
- In the given scenario, analyzing budgeted sales targets against actual performance, fixing departmental responsibilities, and requiring justifications with compensatory action plans represents performance reviews within the Control Activities component.
5. Review of the System of Internal Controls
The review of internal controls enables the auditor:
(i) To formulate his opinion as to the reliance he may place on the system; and
(ii) To locate areas of weakness so that the audit programme and NTE of procedures can be adjusted.
Manual elements are more suitable where judgment and discretion are required:
- Large, unusual, or non-recurring transactions;
- Circumstances where errors are difficult to define, anticipate, or predict;
- Changing circumstances requiring a control response outside the scope of an automated control; and
- Monitoring the effectiveness of automated controls.
ICAI Example 9: If the auditor is not satisfied with the control system regarding trade receivables, he may decide to have extensive confirmation requests at year-end.
6. Internal Control Assessment & Evaluation Techniques
Auditors employ four primary techniques to evaluate and document internal controls:
6.1.1 Internal Control Questionnaire (ICQ)
Structured list of questions with "Yes", "No", and "N/A" options. A "No" answer prima facie indicates a weakness requiring further inquiry and audit testing.
6.1.2 Check List
A checklist contains instructions and verification points that the audit staff must directly verify and answer during fieldwork (e.g. verifying three-way matching, checking pre-numbering of GRNs).
6.1.3 Flow Chart Technique
Graphic representation of client systems using standard geometric symbols (Document, Process, Decision, Permanent/Temporary File, Flow Direction). Offers a bird's eye view, highlights bottlenecks, and facilitates easy updates.
6.1.4 Narrative Records
Written description of system; best suited for small entities with simple workflows.
7. Reporting to Clients on Internal Control Weaknesses (SA 265)
Under SA 265, the auditor has a mandatory duty to communicate significant deficiencies in internal control in writing to Those Charged with Governance (TCWG) on a timely basis.
A deficiency exists when a control is unable to prevent/detect misstatements on a timely basis or is missing. It is a significant deficiency when it merits TCWG attention.
The written communication (Management Letter / Letter of Weakness) must include:
- Description of deficiencies and potential effects.
- Context disclaimers:
• Purpose of audit was to express an opinion on financial statements, not on internal control effectiveness;
• Internal control was considered only to design audit procedures;
• Matters reported are limited to those identified during audit considered significant.
💡 Test Your Understanding (TYU 5 Solved)
1. Deficiency Definition under SA 265:
A deficiency in internal control exists when:
- A control is designed, implemented, or operated in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis; or
- A control necessary to prevent, or detect and correct, misstatements is missing.
2. Analysis of the Insurance Premium Lapse:
The internal control system fails to capture insurance premiums that have become due and payable. This is a significant deficiency because failure to keep insurance policies current renders company assets uninsured, exposing the company to catastrophic losses in the event of fire, accident, or theft.
3. Criteria for Significant Deficiency:
Under SA 265, significance depends not only on whether a misstatement has actually occurred, but on the likelihood that it could occur and its potential magnitude. The susceptibility to loss of an asset is a primary factor determining significance.
4. Required Communication:
CA S must communicate this significant deficiency in writing to Those Charged with Governance, detailing:
(a) A description of the deficiency and an explanation of its potential effects (uninsured assets, potential major loss); and
(b) Sufficient information to understand the context of the audit.
8. Frameworks of Internal Control (Global & Indian Statutory)
3 Objectives, 5 Components, and 17 Principles represented in the 3D Cube.
4 Elements: Purpose, Commitment, Capability, Monitoring & Learning.
Risk-based internal controls embedded in normal operations; annual board reviews.
Integrated audit: Sec 404(a) management report + Sec 404(b) auditor attestation on ICFR.
8.2 Indian Statutory Mandates under Companies Act, 2013
| Provision | Governing Body | Statutory Mandate |
|---|---|---|
| Section 134(5)(e) | Board of Directors (Listed Companies) | Directors' Responsibility Statement must state that internal financial controls (IFC) are laid down, adequate, and operating effectively. |
| Section 143(3)(i) | Statutory Auditor | Auditor's report must state whether company has adequate Internal Financial Controls with reference to Financial Statements (IFCoFR) and their operating effectiveness. |
| Rule 8(5)(viii) of Accounts Rules | Board's Report | Details on adequacy of internal financial controls with reference to financial statements. |
| CARO 2020 Clause (xi) & (xiv) | Statutory Auditor | Clause (xi) on fraud reporting; Clause (xiv) on internal audit system commensurate with size and consideration of reports. |
📝 Test Your Knowledge (TYK 1 to 15 Solved)
All 15 theoretical, practical, and mathematical case study questions from the ICAI Study Material, solved with step-by-step authoritative analysis, standard references, and exam scoring keywords.
(i) The manufacture and sale of air conditioners and is having regular profits.
(ii) The construction of large infrastructure projects and incurred losses in the previous two financial years, due to pandemic.
1. Legal & Professional Framework (SA 320):
As per SA 320 "Materiality in Planning and Performing an Audit", determining materiality involves the exercise of professional judgment. A percentage is often applied to a chosen benchmark as a starting point in determining materiality for the financial statements as a whole.
2. Factors Affecting Identification of an Appropriate Benchmark:
- Elements of the Financial Statements: Assets, liabilities, equity, revenue, expenses.
- User Attention Items: Whether there are items on which the attention of users of the financial statements tends to be focused (e.g., evaluating financial performance via profit, revenue, or net assets).
- Nature of the Entity, Industry & Life Cycle: Where the entity is at in its life cycle, and the industry and economic environment in which it operates.
- Ownership & Financing Structure: If financed solely by debt rather than equity, users may put more emphasis on assets and claims on them than on earnings.
- Relative Volatility of the Benchmark: A benchmark that fluctuates drastically is unsuitable.
3. Guidance for Specific Scenarios:
Case (i) — Manufacture and sale of air conditioners with regular profits:
CA B may consider Profit Before Tax (PBT) / Earnings from continuing operations as the appropriate benchmark, as users of a profitable commercial entity focus primarily on operating profits.
Case (ii) — Construction of large infrastructure projects with pandemic losses:
In case ABC Limited incurred losses in the previous two financial years, PBT is volatile and unrepresentative. CA B may consider Revenue or Gross Profit as the benchmark.
Alternative ICAI Benchmark: For infrastructure projects/programs, Total Cost or Net Cost (expenses less revenues or expenditure less receipts) may be appropriate. Where an entity has custody of significant assets, Total Assets may also serve as an appropriate benchmark.
1. Five Interrelated Components (CRIME):
As per SA 315, an internal control framework comprises five components:
- Control Environment: Sets tone of organization; includes integrity, ethical values, competence, management philosophy, and TCWG oversight.
- Entity's Risk Assessment Process: How management identifies, estimates, assesses likelihood, and manages business risks relevant to financial reporting.
- Information System & Communication: Procedures and records initiating, recording, processing, and reporting transactions, resolving processing errors, and communicating reporting roles.
- Control Activities: Policies and procedures enforcing management directives, including authorization, performance reviews, ITGC/application controls, physical controls, and Segregation of Duties (SOD).
- Monitoring of Controls: Ongoing monitoring and separate periodic evaluations (such as internal audit) to assess control performance over time.
1. Concept & Definition:
A Flow Chart is a graphic, pictorial representation of an accounting and internal control system. It traces documents and transactions sequentially from inception through processing, authorization, physical handling, and ultimate storage using standard geometrical symbols.
2. Distinct Advantages over Narrative Records:
- Comprehensive Bird's Eye View: Presents complex multi-departmental procedures on a single visual chart, overcoming the tedium and ambiguity of voluminous written descriptions.
- Instant Identification of Weaknesses: Easily highlights missing approvals, lack of segregation of duties, bottlenecks, and duplicate workflows.
- Ease of Updating: Walkthrough tests can verify flowchart accuracy; changes are made simply by altering specific symbols without rewriting entire narratives.
- Standardized Communication: Facilitates seamless briefing of junior audit team members on client systems.
1. Standards on Auditing Principles (SA 200 & SA 315):
According to SA 200, Audit Risk has two components: Risk of Material Misstatement (RMM) and Detection Risk (DR).
Audit Risk = Risk of Material Misstatement × Detection Risk.
And Risk of Material Misstatement = Inherent Risk × Control Risk.
2. Extraction of Given Parameters:
- Inherent Risk (IR): Susceptibility of service billing to defalcation without controls = 40% = 0.40.
- Control Risk (CR): Since internal control prevents defalcation to 75%, the risk that control fails = 100% - 75% = 25% = 0.25.
- Detection Risk (DR): Auditor's satisfaction level of detection is 60%. Therefore, detection risk = 100% - 60% = 40% = 0.40.
3. Step-by-Step Mathematical Calculation:
(a) Risk of Material Misstatement (RMM):
RMM = Inherent Risk × Control Risk = 40% × 25% = 10% (or 0.10)
(b) Overall Audit Risk (AR):
Audit Risk = Risk of Material Misstatement × Detection Risk = 10% × 40% = 4% (or 0.04)
4. Audit Conclusion & Analysis:
• Chances of material misstatement are reduced to 10% by internal controls applied by management.
• Overall Audit Risk is reduced down to 4% through the combination of internal controls and auditor substantive procedures.
1. Implementation of Risk-Based Audit (RBA):
As outlined under Para 2.2, the conduct of a Risk-Based Audit spans three sequential phases:
Phase 1: Risk Assessment:
- Planning overall engagement and determining materiality (SA 300 & 320).
- Performing risk assessment procedures to understand the tile manufacturing business and identify inherent and control risks.
- Identifying relevant internal control procedures and assessing their design and implementation (D&I).
- Assessing RMM at financial statement level and assertion level.
- Identifying significant risks requiring special audit consideration (e.g. expansion capex, long-term borrowings).
- Communicating material weaknesses in control design and implementation to TCWG.
Phase 2: Risk Response:
- Designing and performing further audit procedures (FAP) responding to assessed risks (SA 330).
- Performing Tests of Controls (TOC) to evaluate operating effectiveness of internal controls.
- Performing substantive tests of details and analytical procedures focused on high-risk areas.
- Incorporating an element of unpredictability; performing procedures to address management override of controls.
Phase 3: Reporting:
- Assessing audit evidence obtained to determine whether it is sufficient and appropriate.
- Determining if there was a change in assessed risk; reporting findings to TCWG (SA 265); forming audit opinion (SA 700).
1. ICAI 8-Point Control System over Selling and Collection of Tickets:
- Printing of Tickets: Serially numbered pre-printed tickets should be used, designed so they cannot be duplicated to avoid forgery. Serial numbers should not repeat in a reasonable period (month or year). Separate series for each denomination/activity.
- Ticket Sales: Sale of tickets should take place from the Central ticket office at each of the 5 centres, preferably through ticketing machines. Proper control over machine keys.
- Daily Cash Reconciliation: Cash collected at each office/machine must be reconciled daily with the number of tickets sold using denomination serial numbers.
- Daily Banking: Each day's collection should be deposited in the bank intact on the next working day. Till that time, cash should be in joint custody of authorized persons who sign the daily cash-in-hand report.
- Entrance Ticket Cancellation: Entrance tickets must be cancelled (torn/scanned) at the entrance gate when the public enters the centre.
- Advance Booking: The system should ensure all advance-booked tickets are fully paid for.
- Discounts and Free Passes: Concessional rates for group bookings must be properly authorized, and signed authorization forms preserved.
- Surprise Checks: Internal audit system should carry out periodic surprise checks for cash counts, daily banking, reconciliations, and stock of unsold tickets.
1. Reassessment of Materiality (SA 450 & SA 320):
As per SA 450, the auditor is required to reassess materiality in accordance with SA 320 before evaluating the impact of uncorrected misstatements, to confirm its continued appropriateness in light of the entity's actual financial results.
2. Revision of Materiality as Audit Progresses:
- Materiality determination under SA 320 often relies on estimates early in the audit. When actual financial results become known, the auditor must adjust materiality.
- As the audit progresses, materiality may be revised for the financial statements as a whole or for specific classes/balances if the auditor becomes aware of information that would have caused a different initial determination.
- In MINI Builders, because month 12 actual sales were only 30% of the estimated figure due to project completion slowdowns, actual full-year revenue is substantially lower than estimated.
3. Guidance for Mr. Gautam:
- Mr. Gautam must review and reassess materiality downward based on actual 12-month financial results.
- If the reassessed materiality is lower than previously calculated, Mr. Gautam must reconsider performance materiality and the appropriateness of the nature, timing, and extent of further audit procedures.
- He must then evaluate all uncorrected misstatements against the revised lower materiality threshold before forming his audit opinion.
1. Materiality for Specific Classes / Account Balances (SA 320):
As per SA 320, when establishing the overall audit strategy, the auditor determines materiality for the financial statements as a whole. If, in specific circumstances, there are particular classes of transactions, account balances, or disclosures for which misstatements of lesser amounts than overall materiality could reasonably influence economic decisions of users, the auditor shall also determine specific materiality levels to be applied to those items.
2. Revision of Materiality & Performance Materiality:
The auditor shall revise materiality in the event of becoming aware of information that would have caused a different initial amount. If a lower materiality is concluded, the auditor shall determine whether it is necessary to revise performance materiality and whether planned procedures remain appropriate.
3. Application to Magma Ltd:
Deepti & Co. applied materiality for the FS as a whole, but additional information regarding import of machinery for a new product draws attention to a critical specific aspect of the company's business. Thus, Deepti & Co. can re-evaluate the materiality concepts after considering the necessity of such revision for this specific capital expenditure.
(a) Explain the internal check system, its objectives, and general conditions pertaining thereto.
(b) In AMRO Ltd., the head of procurement, Mr. Amit, has complete control over the procurement process without oversight, and there has been no staff rotation for over five years. Evaluate whether general conditions of internal check are violated.
1. Part (a) — Refer Para 4.5 Sub-heading 1:
Internal check implies organization of the bookkeeping and accounting system such that staff duties are allocated so that no single person handles all aspects of a transaction, and the day-to-day work of one employee is complementary to and automatically checked by another.
2. Part (b) — Evaluation of Violations in AMRO Ltd:
YES, in the given situation, general conditions pertaining to the internal check system are violated:
- Violation 1: The head of procurement, Mr. Amit, having complete control over the procurement process without oversight violates the principle that no single person should control any important aspect of the business operation.
- Violation 2: The lack of staff rotation for over five years violates the principle that staff duties should be rotated periodically so that members do not perform the same function for an extended period.
1. Communication under SA 265:
Under SA 265, the auditor shall communicate in writing significant deficiencies in internal control identified during the audit to Those Charged with Governance on a timely basis.
2. Required Content of Written Communication:
- (a) A description of the deficiencies and an explanation of their potential effects; and
- (b) Sufficient information to enable TCWG and management to understand the context:
• Purpose of audit was to express an opinion on the financial statements.
• Consideration of internal control was designed solely to plan audit procedures, not to express an opinion on internal control effectiveness.
• Matters reported are limited to those identified during audit that the auditor considered of sufficient importance to merit reporting.
1. Detailed Analysis of Violations:
- Procurement without Quotations: Violates the principle of authorization and competitive pricing, exposing the company to inflated procurement costs and fraud.
- Accepting Chemicals without Lab Testing: In chemical manufacturing, raw materials must undergo strict quality clearance. Absence of lab test certificates risks batch contamination, finished goods rejection, and safety hazards.
- Payments on Photocopy Invoices without GRNs: Violates the three-way matching control. Releasing payments on photocopy invoices creates immediate risk of duplicate payments and payment for goods never received.
- Single Clerk Handling Entire Payroll: Total violation of segregation of duties. Preparing wage sheets, drawing cash, and paying wages alone enables the creation of ghost workers and misappropriation of cash wages.
1. ICAI Ruling on Internal Check Violations:
YES, in the given situation, general conditions pertaining to the internal check system are violated as follows:
- (i) Physical Custody vs. Accounting Records: Allowing Mr. Abhishek, the store manager, to maintain inventory records while also having physical custody of inventory violates the cardinal principle that those with physical custody of assets must not have access to books of accounts.
- (ii) Staff Rotation: The lack of staff rotation for over seven years violates the principle that staff duties should be rotated periodically to prevent any single person from performing the same function for too long.
- (iii) Concentration of Control: The head of procurement, Mr. Sumit, having complete control over the procurement process without oversight violates the principle that no single person should control any important aspect of the business operation.
1. SA 501 Framework on Segment Information:
As per SA 501 "Audit Evidence — Specific Considerations for Selected Items", the auditor shall obtain sufficient appropriate audit evidence regarding the presentation and disclosure of segment information in accordance with the applicable FRF by obtaining an understanding of the methods used by management in determining segment information.
2. Matters Relevant When Understanding Management's Methods:
- (i) Inter-Segment Transactions: Sales, transfers, and charges between segments, and elimination of inter-segment amounts.
- (ii) Budget Comparisons: Comparisons with budgets and other expected results (e.g. operating profits as a percentage of sales).
- (iii) Allocation of Assets and Costs: The methods used for allocation of assets and costs among segments.
- (iv) Consistency with Prior Periods: Consistency with prior periods, and the adequacy of disclosures with respect to inconsistencies.
1. Entity's Risk Assessment Process (Para 4.2):
In Rishabh Ltd., developments during the year may give rise to risks affecting the preparation and reliability of financial statements. As part of the entity's risk assessment process, management identifies and evaluates such risks.
2. Circumstances Giving Rise to Changed / Increased Risks (ICAI Para 4.2):
- Changes in Operating Environment: Regulatory or economic shifts changing competitive pressures.
- New Personnel: New staff with different focus or understanding of internal control.
- New or Revamped Information Systems: Significant and rapid IT changes altering control risks.
- Rapid Growth: Rapid operational expansion straining existing controls.
- New Technology: New production technologies (e.g. smart appliances) altering control risks.
- New Business Models, Products, or Activities: Entering unfamiliar business areas (e.g. D2C e-commerce).
- Corporate Restructurings: Staff reductions and altered supervision/SOD.
- Expanded Foreign Operations: Foreign operations introducing unique regulatory and currency risks.
- New Accounting Pronouncements: Adoption of new accounting principles or changing standards.
1. SA 265 Written Communication Requirements:
As per SA 265, the auditor CA Chintan shall include in the written communication of significant deficiencies in internal control:
(i) A description of the deficiencies and an explanation of their potential effects; and
(ii) Sufficient information to enable TCWG and management to understand the context of the communication.
2. Important Points with Regard to Management Letter / Letter of Weakness:
- Lists Weaknesses & Suggestions: The letter lists down the areas of weaknesses in the system and offers constructive suggestions for improvement.
- Scope Disclaimer: It should clearly indicate that it discusses only weaknesses that have come to the attention of the auditor as a result of his audit, and that his examination has not been designed to determine the adequacy of internal control for management.
- Reference Document for Management: It serves as a valuable reference document for management for the purpose of revising the system and insisting on strict implementation.
- Minimizes Legal Liability: The letter also serves to minimize legal liability of the auditor in the event of a major defalcation or loss resulting from a weakness in internal control.