Page 318 - COSO Guidance

For example, a smaller company might not have adequate control activities for an outside service
provider of payroll services. One bookkeeper might provide the input data to the payroll service and also
review the payroll summary report provided by the payroll service after processing has been completed.
These incompatible control activities — data entry (bookkeeping) and review of output reports
(independent reconciliation) — by the same individual represents a control weakness. Management
might mitigate this weakness in control activities by increasing the extent and depth of their monitoring
activities. For example, management might use analytical review procedures to estimate gross payroll by
multiplying the average wage by hours worked. If this management estimate were significantly at
variance with the gross payroll provided by the payroll service organization, then management would
investigate why. Additionally, management could, in a manufacturing environment, compare hours
worked with hours charged to jobs and investigate significant variances.

Right-sizing documentation

There are several reasons to document business processes, procedures, and other components of
internal control. First, documentation will allow for uniform practices throughout the business. Various
locations will have references on how to handle a variety of transactions (sales returns, for example, at a
retail store). Documentation also provides a definition of job responsibilities to different areas in the
company, assists in training personnel, and provides support for management to report on the
effectiveness of internal control.

There may be a distinction between large and small businesses concerning the depth and breadth of
documentation required to assess the effectiveness of internal control over financial reporting. For
example, in smaller companies, there are usually fewer employees and closer management supervision
on a day-to-day basis through observation and review of daily or weekly reports. There is also the
opportunity for more meetings with senior-level management to communicate expectations and policies.

Because senior and other levels of management have a frequent and direct interaction with employees,
management can assess whether controls are working. However, management will need to provide the
auditor who will be attesting to the effectiveness of internal control, if applicable, with some support for
management’s assertion on the effectiveness of internal control over financial reporting.

Knowledge check

2. Companies can enhance their efficiencies over assessing internal control by doing which of these?

a. Right-sizing documentation.
b. Performing solely substantive tests.
c. Considering all risks.
d. Perceiving internal control as a separate process.

© 2020 Association of International Certified Professional Accountants. All rights reserved. 10-10