Controls testing

An internal control system is forever in flux – it changes, it’s improved, it’s reconsidered by the auditors at each audit visit (and continuously by the company itself throughout the year)

Where a control is needed and has not previously been identified as necessary, the auditor will make appropriate recommendations to the executive board in a “letter of weakness” sometimes known as “management letter”

This letter sets out the area where the control is deemed necessary by the auditors, the detailed description of the weakness, auditor’s projection of what could happen if this weakness is not corrected, and the auditor’s recommendation that, if implemented, will address the issue and finally, management’s initial reaction to the recommendations that are communicated orally in a meeting between the auditor and management

If there is already a control in place and, when tested, the auditor discovers that it has not been operated correctly (either through staff misunderstanding or through carelessness) again the auditor will bring this break-down to the attention of management together with the auditor’s recommendation for re-strengthening that control

Whenever a weakness is identified or no control exists or the auditor discovers a break-down of an existing control, the auditor will rely more heavily on substantive testing to confirm the reasonableness of the actual monetary amounts shown in the draft financial statements and …

… will bring the weakness, break-down and recommendation to the attention of the board in the auditor’s letter of weakness

Finally, if it’s a significant and recurrent break-down, the auditor will wish to communicate their concerns on a timely basis to management (very quickly!) in order that management may institute corrective measures as soon as possible

The source? ISA 265

OK?