A staff auditor walks through a client's purchase-approval workflow and finds it elegant: tiered authorization, system-enforced segregation, automated three-way match. The CFO posts a $2.4 million top-side journal entry on December 30 with no supporting documentation. None of the controls fired, because none of them were designed to stop the CFO. That blind spot is exactly what AU-C 240 expects you to plan for.
AU-C 315 acknowledges that internal control, no matter how well designed and operated, has inherent limitations. A system reduces the risk of material misstatement but cannot eliminate it. The exam tests whether you can name the five limitations and recognize them in scenarios.
KEY: "Reasonable assurance" is the ceiling. Internal control provides reasonable, not absolute, assurance that financial statements are free of material misstatement. The auditor's report uses the same phrase for the same reason.
HIGH-FREQUENCY: The exam expects you to identify which limitation a scenario describes. Memorize the five.
- Faulty human judgment. Decisions made under time pressure, with incomplete information, or by inexperienced staff can be wrong even when the control is well designed.
- Simple breakdowns. People make mistakes. They misunderstand instructions, mis-key data, or skip a step because they are tired or distracted. Controls that work 99% of the time still fail.
Common mistakes
- Confusing the limitations. A scenario describes a controller who instructed an AP clerk to post invoices without approvals. That is management override, not collusion. Collusion requires two or more people who would otherwise check each other agreeing to defeat a control. A manager directing a subordinate is override. Memorize the distinction.
- Treating the AU-C 240 procedures as optional when controls are strong. Strong controls let you reduce substantive testing in tested areas. They never let you skip the journal entry, estimate, and unusual transaction procedures. These three are required on every audit.
- Performing only a current-year estimate review. AU-C 240 specifically requires a retrospective review (prior-year estimates compared to actuals) plus a current-year evaluation. A current-year-only review misses the bias pattern the standard is designed to surface.
Bottom line
- Internal control has five inherent limitations: faulty judgment, simple breakdowns, collusion, management override, and cost-benefit trade-offs.
- Management override is a presumed, non-rebuttable significant risk on every audit under AU-C 240, regardless of fraud evidence or management character.
- Three required procedures address override: examine journal entries and other adjustments, review estimates for bias, and evaluate the business rationale for significant unusual transactions.
- The journal entry test targets entries with unusual accounts, weak descriptions, period-end timing, atypical posters, or round numbers.
Exam shortcut
When a question asks which inherent limitation a scenario describes, anchor on who is doing what. One person making a mistake is "breakdown." One person ignoring a control they have authority over is "override." Two or more people coordinating around a control is "collusion." The CEO posting a journal entry is override.
The full lesson (about 2,167 words, 14 min read) adds 1 worked example, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.C5
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.