Indirect control
An indirect control supports the operation of other controls rather than directly preventing, or detecting and correcting, an assertion-level misstatement. Controls over the technology environment, including access and change management, can support automated transaction controls. Auditors consider dependencies when assessing whether a direct control can be relied upon.
Worked example
Change-management controls limit unauthorised edits to the settings used by an automated invoice-matching control.
Common mistake
Do not assume that effective indirect controls alone establish that the dependent direct control operated effectively.
Where it appears in your exams
| Qualification | Exam | Relationship | Period |
|---|---|---|---|
| ACCA | AA | Direct | September 2026–June 2027 |
| ACCA | AAA (INT) | Direct | September 2026–June 2027 |