Entity-level control

<h2 id="regulation-surrounding-entity-level-controls">Regulation surrounding entity-level controls</h2>
<h3>Sarbanes-Oxley Act of 2002</h3>
<p>As  a result of several accounting and auditing scandals, congress passed the <a href="/facts/Sarbanes-Oxley_Act/pfYfkDD2">Sarbanes-Oxley Act of 2002</a>.  Section 404 of the act requires company management to assess and report on the effectiveness of the company's <a href="/facts/Internal_control/jMcXFBMm">internal control</a>.  It also requires the company's independent auditor to attest to management's disclosures regarding the effectiveness of internal control. The act also created the <a href="/facts/Public_Company_Accounting_Oversight_Board/kIRH6v9A">Public Company Accounting Oversight Board</a> (PCAOB).<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a>
</p>
<h3>PCAOB Auditing Standard 2201</h3>
<p>The <a href="/facts/Public_Company_Accounting_Oversight_Board/kIRH6v9A">Public Company Accounting Oversight Board</a> (PCAOB) became the primary regulator of audits of publicly traded companies.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a>  In June 2007, the PCAOB adopted Auditing Standard 2201 (Supersedes AS No. 5).<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> This standard contains the standards over performing an audit of internal control over financial reporting that is integrated with an audit of financial statements.
</p><p>The auditor must test entity-level controls that are important to the auditor's conclusion about whether the company has effective internal control over <a href="/facts/Financial_reporting/c6EUpGtV">financial reporting</a>. Depending on the auditor's evaluation of the effectiveness of the entity-level controls, the auditor can increase or decrease the amount of testing that they will perform.
</p><p>Entity-level controls vary greatly in nature and precision. Their effect on the audit plan varies according to how precise they are.
</p>
<table><tbody><tr><th>Type</th><th>Description</th><th>Audit Effect</th></tr><tr><td>Indirect</td><td>Some entity-level controls have an indirect effect on the chances of detecting or preventing a misstatement on a timely basis.  They do not directly relate to risks at the financial statement assertion level.</td><td>Affect control selection, and the nature, timing, and extent of the procedures performed.</td></tr><tr><td>Monitoring</td><td>Some entity-level controls monitor the effectiveness of other controls.  They could be designed to identify breakdowns of lower level controls.  These controls are not precise enough by themselves to specifically address the assessed risk at the relevant assertion level.</td><td>Reduce the testing of other controls if operating effectively.</td></tr><tr><td>Precise</td><td>Some entity-level controls are precise enough to prevent or detect misstatements on a timely basis.</td><td>If the control sufficiently addresses the risk, then additional tests of controls relating to that risk are not necessary</td></tr></tbody></table>
<h2 id="common-entity-level-controls">Common entity-level controls</h2>
<table><tbody><tr><td><ul><li>Controls related to the <a href="/facts/Control_environment/2GyVY7vv">control environment</a></li><li>Controls over management override</li><li>The company's <a href="/facts/Risk_assessment/vlG9Uf0h">risk assessment</a> process</li><li>Centralized processing and controls, including shared service environments</li><li>Controls to monitor results of operations</li><li>Controls to monitor other controls, including activities of the <a href="/facts/Internal_audit/lEEmUV49">internal audit</a> function, the <a href="/facts/Audit_committee/J9qXoaPN">audit committee</a>, and self-assessment programs</li><li>Controls over the period-end <a href="/facts/Financial_reporting/c6EUpGtV">financial reporting process</a></li><li>Policies that address significant business control and risk management practices</li><li>Internal audit</li><li>Whistle-blower hotline</li><li><a href="/facts/Code_of_conduct/EB7soVIQ">Code of conduct</a></li><li>IT environment and organizations</li><li><a href="/facts/Self-assessment/2ddADLp8">Self-assessment</a></li><li>Shared services</li><li>Disclosure committee</li><li>Oversight by the Board of Senior Management</li><li>Policies & procedures manual</li><li>Variance analysis reporting</li></ul></td><td><ul><li>Remediation mechanism</li><li>Management triggers embedded within IT systems</li><li>Internal communication and performance reporting</li><li>Tone setting</li><li>Board/audit committee reporting</li><li>External communication</li><li><a href="/facts/Segregation_of_duties/2kFl4Cje">Segregation of duties</a></li><li>Accounts reconciliations</li><li>System balancing and exception reporting</li><li><a href="/facts/Change_management/lqReblGf">Change management</a></li><li>Risk assessment methodology</li><li>Risk assessment analytical techniques</li><li><a href="/facts/Governance/I4tEBlhT">Governance</a></li><li>Assignment of authority and responsibility</li><li>Hiring and retention practices</li><li>Fraud prevention/detection controls and <a href="/facts/Analytical_procedures_(finance_auditing)/F1oeFkQY">analytical procedures</a></li></ul></td></tr></tbody></table>
<h2 id="evaluating-entity-level-controls">Evaluating entity-level controls</h2>
<h3>Auditor's evaluation</h3>
<p>Entity-level controls, along with all other internal controls should be evaluated by independent auditors according to SAS 109 (AU 314) issued by the <a href="/facts/AICPA/kPhhttyA">AICPA</a>.  SAS 109 stipulates that "auditors should obtain an understanding of the five components of internal control sufficient to assess the risk of material misstatement of the financial statements whether due to error or fraud, and to design the nature, timing, and extent of further audit procedures."<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a>
</p><p>The information gathered from obtaining an understanding of the five components of internal control should be used to do the following:
</p>
<ul><li>Identify types of potential misstatements</li>
<li>Consider factors that affect the risks of material misstatement</li>
<li>Design tests of controls, when applicable, and substantive procedures</li></ul>
<p>Entity-level controls are generally included in the testing.
</p>
<h3>COSO internal control-integrated framework</h3>
<p>The aforementioned five components of internal control refer to the five parts of the <a href="/facts/Committee_of_Sponsoring_Organizations_of_the_Treadway_Commission/eSYqds99">COSO</a> framework.<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a>   The framework gives auditors a way to evaluate the controls of an entity.
</p><p>The five components are:
</p>
<ol><li>Control environment</li>
<li>Risk assessment</li>
<li>Information and communication</li>
<li>Control activities</li>
<li>Monitoring</li></ol>
<p>Entity-level controls often fit into one or more of the five COSO components.
</p>
Example<table><tbody><tr><th>COSO Components</th><th>Background Checks</th><th>Audit Committee</th><th>Internal Audit</th><th>Shared Services</th></tr><tr><td>Control Environment</td><td>X</td><td>X</td><td></td><td></td></tr><tr><td>Risk Assessment</td><td>X</td><td>X</td><td>X</td><td></td></tr><tr><td>Information & Communication</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Monitoring</td><td></td><td>X</td><td>X</td><td></td></tr></tbody></table>
<h3>Management's evaluation</h3>

<p>There are four basic steps that management can use to evaluate entity-level controls:
</p>
Identify risks
Use a top-down approach to identify and categorize risk.
Identify entity-level controls and link to risks
Examine current entity-level controls to determine what controls have been placed into operation.  Also, identify important entity-level controls that may be missing  in the current framework.  Then link the entity-level controls best suited to address the identified risks.
Evaluate the design and operating effectiveness of entity-level controls
Determine how effectively each entity-level control addresses identified risks by considering, among other things: sensitivity; competency of the reviewer, frequency and consistency of the control's operation; whether the control is reliable and repeatable; and whether appropriate review and follow-up action is taking place.
Leverage entity-level controls as appropriate to mitigate risks
By leveraging strong entity-level controls, management will be able to develop a more effective and efficient controls evaluation strategy.
<h2 id="definitions-of-selected-entity-level-controls-organized-into-the-coso-framework">Definitions of selected entity-level controls organized into the COSO framework</h2>

<h3>Control environment</h3>
Code of Conduct
The norms to which the organization voluntarily agrees to comply.  For example, the company's code of conduct might include a policy for prohibiting employees from accepting gifts from vendors.
Governance
A mechanism for monitoring how the resources of an organization are being put to an efficient use by management, with an emphasis on transparency and accountability
Assignment of Authority and Responsibility
The term "authority" refers to the right to perform the organization's activities.  The term "responsibility" refers to the obligation to perform assigned activities.  It is important for the achievement of control objectives that authorities and responsibilities be consistent with the goals of its business activities and assigned to appropriate personnel.
Hiring and Retention Practices
Hiring and retaining skilled resources is critical to an organization's success. Policies and procedures around job definition, recruitment, training, performance appraisal, <a href="/facts/Employee_retention/a4b6qtGX">employee retention</a> programs, and management of employee exits are important components of managing human resources.
Fraud Prevention Prevent/Detect Controls and Analytical Procedures
This refers to the anti-fraud controls and procedures used by management to prevent, detect and mitigate fraud.  Examples might include segregation of duties, setting up an ethics hot line and periodic job rotation.
<h3>Risk assessment</h3>
Risk Assessment Methodology
A systematic approach to identify, assess and prioritize risks.
Risk Assessment Analytical Techniques
Analytical techniques, if used appropriately, can serve as a tool in the risk assessment process.  Since risk is an outcome of perception, analytical techniques help remove subjectivity, to a certain extent by collation and presentation of data in a systematic manner for assessment of potential impact and likelihood of occurrence or risks.
<h3>Information and communication</h3>
Internal Communication and Performance Reporting
This refers to the lines of communication that run through an organization's structure, both top-down and bottom-up, including peer communication.  Performance reporting is part of internal communication, and usually involves a two-way process of setting expectations and monitoring performance against agreed-upon expectations.
Tone Setting
Tone setting refers to various components of the "tone at the top," that are the building blocks of the character of an organization.  Having set the right tone, it is equally important to have open channels of communication so that those within and outside the organization understand and act upon it.  Examples of such components of tone include code of ethics and corporate governance practices.
Board/Audit Committee Reporting
Board members, including independent directors, assume fiduciary responsibilities which require them to have access to accurate and relevant information.  While most countries have enacted laws regarding formal reporting to the board of directors and the Audit Committee of the Board, these usually constitute baseline procedures and requirements.  Companies are free to adopt more stringent measures regarding Board/Audit Committee Reporting, such as holding more frequent formal Audit Committee Meetings than required by law.
External Communication
This refers to the communication to the shareholders, stock market, customers, regulators, vendors, and other entities outside the company's formal boundaries.  The annual report is an example of external communication around the company performance, financial statements, vision, goals and targets.
<h3>Monitoring</h3>
Ongoing Monitoring Activities
Periodic review of process and controls using relevant management reporting tools.  For example, these would include monthly review of aging of accounts receivable to determine the extent of reserves required for doubtful debts.
Independent Assessment Mechanism
Use of external specialists or professionals to review and assess internal controls.  For example, this might include the use of external tax professionals to review the controls around tax positions developed by the in-house tax team.
Variance Analysis Reporting
Comparison and reporting of actual performance against pre-determined benchmarks, if used appropriately, can serve as an early-warning mechanism.  For example, a steady increase in debtor turnover might indicate varying levels of collection-related issues.
Remediation Mechanism
This refers to a systematic approach to resolving identified internal control issues.  While an issue could be identified by either an internal or an external monitoring mechanism, the remediation mechanism is usually management-owned.
Management Triggers Embedded Within IT Systems
Most enterprise applications configure business rules in a manner as to prevent, require pre-approval, or alert relevant management personnel in the event that certain pre-set thresholds are not observed.  For example, a sales application could deploy a control preventing sales transactions above the specified credit limit of a customer.
<h2 id="importance">Importance</h2>

<p>Entity-level controls have a pervasive influence throughout an organization.  If they are weak, inadequate, or nonexistent, they can produce material weaknesses relating to an audit of internal control and material misstatements in the financial statements of the company.  The presence of material misstatements could result in receiving an adverse opinion on internal controls and a qualified opinion on the financial statements.  Material misstatements are expensive to fix, and receiving an adverse or qualified opinion generally results in a drop in stock price of a publicly traded company.
</p>
<h2 id="benefits">Benefits</h2>

<ul><li>Reduction of the likelihood of a negative risk event by establishing and reinforcing the infrastructure that sets the control consciousness of the organization</li>
<li>A broad risk coverage over financial reporting and operations.  For companies conducting evaluations of internal controls, the presence of effective entity-level controls can contribute to a more effective and efficient evaluation strategy</li>
<li>Generation of efficiencies in other business and operational processes</li>
<li>Reinforcement for all <a href="/facts/Stakeholder_(corporate)/yN9L44ac">stakeholders</a> of the importance of internal controls to the success of the business</li>
<li>Better understanding of how identified risks are mitigated, and redirect evaluation and other resources toward priority risk areas</li>
<li>Increased effectiveness and efficiency of management's risk assessment and controls evaluation.</li></ul>

<ul><li><a href="http://www2.eycom.ch/publications/items/2008_entity_level_controls/2008_ey_entity_level_controls.pdf">"Entity-Level Controls"</a> (PDF). <a href="https://web.archive.org/web/20110706231944/http://www2.eycom.ch/publications/items/2008_entity_level_controls/2008_ey_entity_level_controls.pdf">Archived</a> (PDF) from the original on 2011-07-06. Retrieved 2009-04-21.</li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="http://arquivo.pt/wayback/20080223212954/http://www.pcaobus.org/">PCAOB official site</a></li>
<li><a href="http://www.coso.org">Committee of Sponsoring Organizations: COSO</a></li>
<li><a href="http://www.aicpa.org">The American Institute of Certified Public Accountants</a></li>
<li><a href="http://aaahq.org">American Accounting Association</a></li>
<li><a href="https://web.archive.org/web/20120806051608/http://www.soxlaw.com/s404.htm">A Guide to the Sarbanes-Oxley Act</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"Sarbanes-Oxley Act of 2002" (PDF). Retrieved 2009-04-21.[permanent dead link] <a href="http://news.findlaw.com/hdocs/docs/gwbush/sarbanesoxley072303.pdf" target="_blank">http://news.findlaw.com/hdocs/docs/gwbush/sarbanesoxley072303.pdf</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>"SEC Description of the PCAOB". Archived from the original on 2009-04-09. Retrieved 2009-04-21. <a href="https://www.sec.gov/answers/pcaob.htm" target="_blank">https://www.sec.gov/answers/pcaob.htm</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>"Auditing Standard No. 5". Archived from the original on 2019-04-02. Retrieved 2016-05-05. <a href="http://pcaobus.org/Standards/Auditing/Pages/Auditing_Standard_5.aspx" target="_blank">http://pcaobus.org/Standards/Auditing/Pages/Auditing_Standard_5.aspx</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>"AU 314 / SAS 109" (PDF). Archived from the original (PDF) on December 3, 2008. Retrieved 2009-04-21. <a href="https://web.archive.org/web/20081203092238/http://www.aicpa.org/download/members/div/auditstd/AU-00314.PDF" target="_blank">https://web.archive.org/web/20081203092238/http://www.aicpa.org/download/members/div/auditstd/AU-00314.PDF</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
<li id="fn:5"><p>"COSO Internal Control-Integrated Framework". Archived from the original on 2009-02-28. Retrieved 2009-04-21. <a href="https://web.archive.org/web/20090228134313/http://www.coso.org/IC-IntegratedFramework-summary.htm" target="_blank">https://web.archive.org/web/20090228134313/http://www.coso.org/IC-IntegratedFramework-summary.htm</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li>
</ol>

Entity-level control open-in-new

Entity-level control