With a renewed emphasis in testing with precision on internal controls over financial reporting, it may help to jump the gun and review some of your most complex controls that would fall within scope of an external auditors review. The following definition of ‘testing with precision’ is defined in the following statement via Crowe Horwath LLP:
• For a control to be considered designed and operating effectively it should not only be taking place but also be operating with enough precision such that a material misstatement would be prevented or detected.
To relate this concept to a real world internal control testing scenario, let’s consider the following example:
• Mary reviews the reconciliation prepared by Richard and signs and dates the reconciliation evidencing her review.
It will not be sufficient for an external auditor to simply test a sample of reconciliations and verify that both Richard and Mary signed and dated indicating preparation and review in a timely fashion. They will also want to have evidence in our documentation that demonstrates Mary’s review was with enough detail to catch any potential errors that could material individually or when combined with other potential errors. The way such precision can be documented can vary, but here are some examples:
• If the reconciliation includes the various supporting schedules and source documents attached all in one package, Mary could initial each page and put comments or tick marks next to each of the items within the package that she tied out during her review. Then when the external/internal auditors come in to look at the reconciliation package, there will be somewhat of a paper trail demonstrating that Mary’s review was not simply cursory but that she was digging into the details.
• A checklist could be developed that itemizes each of the steps Mary routinely does when she reviews the reconciliation…(i.e. she traces line item A to source document A, line item B to source document B and recalculates line item C). This checklist could be signed off by Mary and filed with each reconciliation package to evidence that her review was with precision.
• If Mary has questions for Richard that Richard has to respond to that could be done via email. These emails could be printed and attached to the reconciliation to show that Mary was not just rubber stamping, but was drilling into the details and asking questions before she signed off as reviewed. Sometimes, even high-level controls can be shown to operate with at least some level of precision simply by retaining these emails.
• If Mary’s review resulted in any adjustments or changes to the reconciliation, it would be helpful to provide this documentation to the auditors to show those changes were printed or otherwise maintained.
• Lastly, the auditors can sit down with Mary and she can show them exactly what she does each month when she reviews the reconciliation.
In conclusion, there are a multitude of methods that can be used in testing your internal controls to ensure they are adequately designed, operating effectively, and ultimately mitigating risk to prevent material misstatements that could potentially damage a stakeholder’s investment. Take a page out of the intrapreneurial philosophy handbook and go over some of your most complex controls - you never know where human error/fraud could be hiding.
For more examples, contact Vibato today and we will provide you with a complimentary assessment for your company and steer you in the right direction.
