How to Assess Control Design Effectiveness?
Explore a structured approach for evaluating if an internal control is capable of meeting its objective before you test its day-to-day performance.
Internal controls are processes that help a company achieve its objectives, ensure reliable financial reporting, and comply with laws. These controls must be evaluated, an assessment with two parts: control design and operational effectiveness. A control can be perfectly designed but fail in practice, or be poorly designed but followed diligently. This analysis focuses on assessing a control’s design, the foundation for a reliable internal control system.
Understanding Control Design
Control design effectiveness is an evaluation of whether a control, as designed, can successfully prevent or detect a significant financial error in a timely manner. The assessment asks: if everyone follows the procedure perfectly, will this control achieve its purpose? This is distinct from operating effectiveness, which tests whether the control is performed consistently and correctly by personnel.
For example, a company may have a control that requires a manager to approve any purchase order exceeding $5,000. The design of this control is effective because it places a review and authorization step at a logical point to prevent unauthorized spending.
If the manager approves every purchase order without reviewing the details, the control is not operating effectively. The failure is in its execution, not the rule itself. Assessing design effectiveness isolates the control’s logic from individual performance, ensuring the procedure is sound on paper before testing it in practice.
Information Required for Assessment
Before an assessment can begin, specific documentation must be gathered to provide a clear picture of the processes and controls. Documents include process narratives, flowcharts, and a Risk and Control Matrix (RCM). Each provides a different but complementary view of the control environment.
Process narratives are written descriptions explaining a process from initiation to conclusion. For example, a purchasing narrative would describe how a request is initiated, the steps for creating an order, vendor selection, approvals, and how the transaction is recorded. It also identifies the individuals or departments responsible for each step.
Flowcharts offer a visual representation of the process, using symbols to depict steps, decisions, and the flow of information. A flowchart visually traces a transaction, showing every handoff and approval point. This format helps identify potential gaps or inefficiencies that a narrative might obscure.
The RCM is a table that connects risks to the controls designed to mitigate them. It lists the specific risk, the control objective, a description of the control activity, and the financial statement assertion it supports.
The Assessment Process
The primary method for assessing control design is the walkthrough, which traces a transaction from its origin to its final destination in the financial records. This involves following one or two transactions to understand the entire process flow. The evaluator uses process narratives and flowcharts as a map to confirm the documented process matches what happens in reality.
During a walkthrough, three techniques are used: inquiry, observation, and inspection of documents. Inquiry involves asking employees to explain their duties and how they handle unusual situations. For example, an evaluator would ask a clerk how they verify that a submitted receipt is valid and matches an expense report.
Observation means watching an employee perform their duties, such as a clerk accessing the payment system. Inspection of documents involves examining evidence created by the process, like the expense report, receipt, and approval email. The goal is to ensure all documents are consistent and adhere to the control’s requirements.
Identifying and Classifying Deficiencies
The assessment may uncover weaknesses in a control’s design. A control design deficiency exists when a necessary control is missing or an existing one is structured so it cannot meet its objective, even if performed perfectly. For example, if a policy requires complex passwords but the IT system does not enforce this, a design deficiency exists.
Once identified, a design deficiency is classified by its severity, based on the likelihood and potential financial magnitude of a misstatement. A control deficiency is the least severe category, representing a flaw that does not rise to a more serious level.
A significant deficiency is a flaw, or combination of them, less severe than a material weakness yet important enough to merit attention by those overseeing the company’s financial reporting.
The most severe classification is a material weakness. This is a deficiency, or combination of deficiencies, where there is a reasonable possibility a material misstatement of financial statements will not be prevented or detected on a timely basis. This hierarchy ensures the most serious issues receive the highest attention from management and auditors.