A "controls" question is always worth 20 or 30 marks in Section B of the AA exam. To earn those marks, you must distinguish between what a system should achieve, what is wrong with the controls described, how the company should put it right and how the auditor would test whether a control operates. This article shows you how to tackle each requirement.
Recognise what is being asked
Systems
Recent questions have covered purchases, sales, payroll, cash receipts, inventory counts and non-current assets. A question scenario may describe:
one system (Dewberry Co: purchases);
several systems (Harper Co: sales, purchases and payroll); or
inventory count arrangements (Silver Co).
Requirements
It may ask you to:
List control objectives for a specified system.
Identify and explain direct controls that already exist, and describe a test of each.
Identify and explain deficiencies and recommend a control to address each.
Test the controls you have recommended, assuming they are implemented.
Other parts may ask about the auditor's understanding of internal control, significant deficiencies, or the components of internal control. Read each requirement separately: a 30-mark question can also contain substantive procedures or corporate governance matters.
Requirements | The question you need to answer |
|---|---|
Control objective | What should the system achieve? |
Direct control | What does the company already do to achieve it? |
Deficiency and implication | What is wrong ("weakness"), and what could happen as a result? |
Recommendation | What should management do to correct that deficiency? |
Test of control | How would the auditor assesswhether that control operated effectively? |
Control objectives
Describe the desired outcome
Mark allocation
In Dewberry Co, four purchases objectives were required for four marks. The verb list meant that four concise points were enough. The question explicitly said the scenario was not needed to answer this part.
How to answer
Begin “To ensure that …”, followed by the result the system should achieve.
“To ensure that purchases are made only for genuine business purposes.”
The objective is generic: it should not assume that a particular employee signs a document or that a specified procedure exists. “To ensure that the purchasing director authorises orders” describes a possible control activity, not an objective.
System | Illustrative objective |
|---|---|
Purchases | To ensure that liabilities are recorded for all goods received but not yet paid for. |
Sales | To ensure that goods are sold on credit only to customers who are likely to pay. |
Payroll | To ensure that only genuine employees are paid for work performed. |
Inventory count | To ensure that inventory owned by the company is counted once and only once. |
Keep to the system named. An objective about maintaining suitable inventory levels would not answer a question asking for objectives of the purchases system merely because the scenario mentions reorder levels.
Direct controls
Identify what already works
Mark allocation
A direct control is a specific action or restriction described in the scenario that addresses a risk of misstatement. In Granstan Co and Francisco Co, identifying and explaining each direct control earned:
½ mark for identification and
½ mark for its specific benefit
a further mark was available for a test of that control.
How to answer
Use “[person or system] does [specific action], which reduces the risk that [specific consequence]”.
In Granstan Co, the finance director authorises and regularly reviews business customers' credit limits. This helps prevent sales to customers whose debts may not be recoverable.
In Francisco Co, purchase orders are approved by the purchasing manager or director according to value, reducing the risk of unnecessary or personal purchases.
Avoid “this prevents fraud and misstatements” without saying HOW.
If the question assigns controls and deficiencies to different systems, keep them separate: Granstan asks for sales controls but purchases and payroll deficiencies.
Deficiencies
Name the "weakness" and explain its consequence
Mark allocation
The usual allocation is:
½ mark for the deficiency
½ mark for its implication; and
1 mark for a suitable recommendation.
Therefore, eight complete points can earn 16 marks. Quirky Quadbike adds one mark per test of control: six complete points can earn 18 marks.
How to answer
First identify the missing, incomplete or ineffective control, not merely a fact from the scenario. Then trace a plausible consequence for this company:
Weakness → what can go wrong → business or financial statement consequence
System and question | Deficiency and specific implication |
|---|---|
Purchases (Dewberry) | Changes to the supplier master file are reported but the report is merely filed. Fictitious suppliers could therefore be added without detection, enabling fraudulent orders or payments. |
Sales (Harper) | Credit assessments are sometimes omitted for new corporate customers. Sales could be made to customers who cannot pay, creating irrecoverable receivables. |
Payroll (Francisco) | Payroll amounts and payslips are generated automatically, and not independently reviewed. A processing error could go undetected and cause employees to be over- or under-paid. |
Inventory count (Silver) | Third-party sofas are stored with the company's own goods. They might be counted as Silver's inventory, overstating inventory. |
If an accounting balance is affected, say which balance and, where clear, whether it could be overstated or understated.
Do not merely write a recommendation in the negative. “The payroll manager does not recalculate wages” may describe a missing procedure, but it does not, on its own, make the existing process clear. Identify what happens instead: Automatically generated payroll amounts are used without independent review. Then explain the consequence of an undetected processing error. A short statement of a missing control can earn the identification mark when the absence itself is the weakness; the fuller description helps make the answer unambiguous.
Do not invent a deficiency where the scenario supplies no evidence of one.
In Harper, receiving approved requisitions did not justify an assumption that inventory levels had never been reviewed. Equally, “fraud or misstatements may occur” does not explain the particular implication.
Recommendations
Say exactly what management should do
Mark allocation
An appropriate recommendation normally earns 1 mark per deficiency. It must address the weakness identified and be practical for the company.
How to answer
Start with an action (verb), for example:
Authorise (or approve)
Match (linking documents)
Agree (specified details)
Reconcile
Review
Investigate
Restrict (access)
Follow up (outstanding items)
Use “reconcile” only when comparing two records or balances, identifying differences and investigating or resolving them. If the control simply compares details on two documents, use “agree” or “match”.
Specify who does what, using which records, and when if timing matters.
key point
The auditor is not the person implementing the client's control!
Deficiency | Objective is NOT a recommendation | Actionable recommendation |
|---|---|---|
Credit assessments sometimes omitted (Harper) | Ensure that customers are creditworthy | Before opening a new corporate credit account, the credit control department should obtain a credit report or references, assess the customer's ability to pay and set an approved credit limit. |
Supplier changes report filed unread (Dewberry) | Ensure that supplier changes are valid | A responsible manager should review the monthly changes report, investigate unusual amendments and sign it to evidence the review. |
Invoices not sequentially numbered Francisco | Ensure that all invoices are recorded | The system should allocate sequential invoice numbers, and the finance team should investigate gaps in the sequence regularly. |
Giving a department access to a record is sometimes only half a solution. If purchasing staff can view goods received notes, say that they should match them to orders or follow up outstanding orders. Likewise, numbering invoices helps only if someone performs a sequence review and investigates missing numbers.
"Ideas list" for suitable controls
ISA 315's examples of control activities provide prompts when a control is missing. Choose one that addresses the particular deficiency, then make it specific:
Control activity | Illustrations (across the systems) |
|---|---|
Authorisation or approval | Purchasing manager approves orders within an assigned value limit. |
Verification or matching | Warehouse staff compare goods received with the purchase order before accepting delivery. |
Reconciliation | Finance staff reconcile supplier statements with recorded payables and investigate differences. |
Performance review | Sales director investigates unexpected movements in monthly revenue by store. |
Physical control | Inventory belonging to a third party is segregated and labelled before the count. |
Logical access control | Only authorised payroll managers can amend employee standing data. |
Segregation of duties | One clerk records cash receipts; another prepares the bank reconciliation. |
These are ideas, not answers to memorise.
A recommendation must address the actual deficiency. In Harper Co, recommending that another clerk review every invoice did not earn credit. The deficiency required input controls addressing both completeness and accuracy.
Tests of control
Did the control operate?
Mark allocation
A well-described test normally earns 1 mark per control. Granstan and Francisco each required three tests for three marks; Quirky Quadbike required six tests for six marks.
How to answer
THINK! “How can the auditor know whether this particular control happened?” Name the evidence and the feature to look for. A useful pattern is: “Select a sample of [records] and inspect [specific evidence] to confirm [the control operated].” Where the control leaves no record, an appropriately directed observation, reperformance or test data procedure may be needed.
Key point
Enquiry alone is not a sufficient test of control. Asking a member of staff whether they approve orders, for example, does not establish that approvals took place. Responses must be corroborated (e.g. by inspecting approved orders or observing the process).
Be clear what evidence the auditor will look for. “Inspect for evidence of review” is incomplete unless you identify it.
A dated signature or initials on the documents, a digital sign-off, or a system audit trail showing who performed the matching and when.
Control | Test of control |
|---|---|
Purchase orders approved at the proper level (Francisco) | Select purchase orders of different values and inspect the approvals against the authorised signatories and value limits. |
Online orders matched with dispatch notes before invoicing (Granstan) | Inspect a sample of online orders and related invoices for a dated digital signature confirming that a finance team member matched the orders to goods dispatched notes before invoicing. |
Revised requisitions include current inventory levels (Quirky Quadbike) | Inspect a sample of completed requisitions for the recorded inventory level and, where possible, agree it to the inventory record at the request date. |
Security staff supervise employee sign-in (Francisco) | Observe employees signing in and confirm security staff supervise the process. |
Which controls to test?
If the question asks about existing direct controls, test the controls in the scenario. If it asks for controls “if implemented”, test your recommended controls. The test must establish whether the same control operated. For example, trying to create a customer without a credit limit does not test whether an official authorised and reviewed the limit.
Control or amount?
A test of control evaluates the operation of a prescribed control: Did someone approve, compare, reconcile or investigate as required? i.e. Yes or No?
The purpose of a substantive test of details is to detect material misstatements (i.e. amount).
Answer given | Why it falls short | Better answer |
|---|---|---|
“Check the orders.” | Neither the evidence nor the control being tested is clear. | Inspect a sample of orders for approval by the appropriate signatory. |
“Agree invoices to dispatch notes.” | This may test the recorded sale; it does not show that client staff carried out their required matching. | Inspect a sample of sales invoices for a dated signature or initials showing that staff matched each invoice to a goods despatched note before invoicing. |
“Recalculate the year-end receivables balance.” | This tests an amount (i.e. is a substantive procedure), not whether credit limits operate. | Use test data to attempt a credit sale above a customer’s limit and confirm that the system rejects it. |
“Observe the control.” | It does not identify the action being observed; observation also covers only the period witnessed. | Observe the transfer of raw materials to production during the inventory count and confirm that staff record the movements. |
Practise by requirement
Skill | Questions to attempt |
|---|---|
Control objectives | Dewberry Co (March/June 2026): four purchases objectives. |
Existing direct controls and tests | Granstan Co (September/December 2024): sales; Francisco Co (March/June 2024): payroll, purchases and non-current assets. |
Deficiencies, implications and recommendations | Dewberry Co: purchases; Harper Co (March/June 2025): sales, purchases and payroll; Silver Co (September/December 2023): inventory count. |
Deficiencies, recommendations and tests together | Quirky Quadbike Co (September/December 2025): inventory, purchases, sales, cash receipts and payroll. |
After attempting a question, compare your answer with each individual mark component, not just the general point in the suggested answer. In particular, ask whether you have named the weakness, explained its specific effect, proposed an action and tested the action requested.