What are internal controls, and why do auditors care about them?
What the interviewer wants to hear
- Policies and procedures that help reliable reporting, operations and compliance
- Examples: approvals, segregation of duties, reconciliations, access controls
- Preventive and detective controls
- Strong controls can reduce substantive testing
- Weaknesses are reported to management and those charged with governance
Model answer
Internal controls are the processes a company uses to make sure transactions are authorised, recorded correctly and assets are protected. Examples are approval limits on purchases, segregation of duties between ordering, receiving and paying, monthly bank and ledger reconciliations, and IT controls such as user access rights. Some controls are preventive, like requiring two signatures for a payment, and some are detective, like a reconciliation that catches an error afterwards. Auditors care because the strength of controls affects the risk of material misstatement. If we understand and test key controls and they work well, we can rely on them and reduce the amount of substantive testing. If they are weak, we need more detailed testing. Under SA 265 we also communicate significant deficiencies to management and those charged with governance in writing, so the company can fix them.
Can you answer it under time pressure?
Take a timed easy round and get scored on every answer.
More easy Auditor questions
- What is a financial statement audit, and why do companies need one?
- What are financial statement assertions? Give examples for a balance and for a class of transactions.
- How would you explain materiality to a client, and how do you set it?
- What types of audit opinion can an auditor give, and when is each used?
- What is the difference between tests of controls and substantive procedures? Give an example of each.
- What procedures can an auditor use to obtain audit evidence?
- What does professional skepticism mean to you? Give an example of applying it.
- What does an audit engagement letter contain, and why does it matter?
- What are the main threats to auditor independence, and how are they managed?