A controller can change a financial statement adjustment after ordinary transaction controls have finished operating. The auditor must understand the limitations of internal controls to assess whether those controls address the resulting financial reporting exposure.
Internal control provides reasonable assurance, a high level of confidence that objectives will be achieved, while allowing for unavoidable limitations. Management must balance control benefits against costs, and even well-designed procedures depend on people, information, and changing operating conditions.
The inherent limitations of internal controls can defeat even properly designed and implemented safeguards: faulty human judgment, accidental breakdowns, collusion, and management override. Their possibility prevents absolute assurance that financial reporting objectives will be achieved.
A control deficiency exists when design or operation fails to allow timely prevention, or detection and correction, of misstatements. Missing or unsuitable controls create design deficiencies; adequately designed controls not performed as intended have operating deficiencies. The auditor evaluates each deficiency's potential impact on misstatement risk.
Staffing constraints may explain a deficiency but do not make missing segregation inherently unavoidable. The auditor evaluates the potential impact on misstatement risk and whether compensating controls, such as independent...
Common mistakes
- Approval equals accounting support. Entry 318's approval marker does not establish that the $180,000 reserve reduction is supported.
- Small means excluded. Entry 207 remains relevant despite falling below the illustrative $1,000 accumulation threshold.
- Missing reporting layer. Selecting only ledger entries omits consolidation adjustment 24 and its $96,000 reporting effect.
Bottom line
- Judgment errors, accidental breakdowns, collusion, and management override are inherent limitations; missing segregation or inadequate safeguards are correctable deficiencies even when staffing is limited.
- An accidental breakdown may reveal an operating deficiency; a control never implemented cannot be classified as a normally effective control suffering an accidental lapse.
- Management override involves management authority or influence; a junior employee's unauthorized act alone is employee circumvention.
- Override capability, indicators requiring investigation, and evidence of misstatement support different conclusions.
Exam shortcut
The bypass route may involve direct posting access, pressure on another employee, altered approval records, or changes outside the ledger. The adjustment indicates direction and assertion: omitted liabilities suggest completeness; unsupported reserve reductions suggest valuation; invented sales suggest occurrence. In paired cases, the response changes where the changed fact matters. A new access capability changes authorization work without proving that the recorded amount is wrong.
The full lesson (about 4,264 words, 28 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.C5
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.