## Learning Outcomes

After reading this article, you will be able to describe the five components of internal control, with particular focus on the control environment and the entity’s risk assessment process. You will learn to identify features of a strong and weak control environment, explain the auditor’s objectives in evaluating these elements, and analyse how deficiencies increase the risk of material misstatement and influence audit strategy.

## ACCA Audit and Assurance (AA) Syllabus

For ACCA Audit and Assurance (AA), you are required to understand the key elements that make up a system of internal control and their relevance to the audit process. When revising this topic, focus on the following:

- The reason an auditor obtains an understanding of internal control components relevant to the preparation of the financial statements.
- The description and explanation of the five components of internal control, with emphasis on:
  - the control environment,
  - the entity’s risk assessment process.

- Evaluation of internal control components, including identification of deficiencies and significant deficiencies.
- The auditor’s response if the control environment or risk assessment process is weak.
- The limitations of internal control and their implications for audit procedures.

## Test Your Knowledge

_Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, look more closely at that area during your revision._

1. List the five components of internal control as per ISA 315 (Revised 2019).
2. Name two ways senior management can demonstrate commitment to ethical values in the control environment.
3. Why is the control environment critical to an auditor’s risk assessment and choice of procedures?
4. What should an auditor do if the risk assessment process at a client fails to address significant risks?
5. Give one example of a deficiency in risk assessment, and state its impact on audit risk.

## Introduction

A system of internal control is the structure of processes and procedures developed by management to provide reasonable assurance of achieving objectives relating to financial reporting, operations, and compliance.

The control environment sets the tone for the whole system—reflecting the commitment of those in charge to integrity, ethical values, and good governance. The risk assessment process helps management identify and address risks threatening accurate financial reporting. Both components underpin the effectiveness of the other controls, shape the auditor’s understanding of the company, and guide the audit approach.

> **Key Term: internal control**
> A process designed and implemented by management and those charged with governance to provide reasonable assurance about the achievement of objectives relating to financial reporting, operations, and compliance.
>
> **Test Tip:**
> When revising Control environment and risk assessment, connect each definition, method, or rule to the kind of question the assessment is likely to ask.

### The Five Components of Internal Control

According to ISA 315 (Revised 2019), a sound internal control system comprises five core components:

![Financial reporting risk assessment cycle linking change drivers, risk evaluation, control responses, ongoing monitoring, and auditor action for unaddressed significant risks.](https://static.pastpaperhero.com/images/acca-aa-components-of-internal-control-control-environment-and-risk-assessment_00.png)

_Entity risk assessment traces identification, evaluation, control responses, and auditor action when significant financial reporting risks remain unaddressed._

1. Control environment
2. Entity’s risk assessment process
3. Information system and communication
4. Control activities
5. Monitoring of controls

This article examines in detail the first two: the control environment and risk assessment process.

### Control Environment

The control environment is the basis for all other controls. It reflects the general attitude, actions, and awareness of the board and management regarding the importance of control and ethical conduct.

> **Key Term: control environment**
> The set of standards, processes, and structures that provide the basis for carrying out internal control across the organisation, representing management's commitment to integrity, ethical values, and governance.

Key features of a robust control environment include:

- Clear commitment from management and those charged with governance to integrity and ethics (e.g., codes of conduct, disciplinary policies).
- Independence and effective oversight by the board or audit committee.
- Clear assignment of authority, responsibility, and reporting lines within the organisation.
- Policies ensuring recruitment, training, and retention of competent staff.
- Accountability for performance, including consequences for breaches of policy.

### Worked Example 1.1

**Scenario:** A finance director regularly bypasses company policy for approving expenses without consequence and rarely disciplines improper conduct.

> **Answer:**
> The control environment is weak. Management’s actions demonstrate poor ethical standards and indifference to proper control, undermining discipline and trust in the effectiveness of all other controls.

### Entity’s Risk Assessment Process

An effective risk assessment process enables the organisation to identify, analyse, and address risks that may impact accurate financial reporting.

> **Key Term: risk assessment process**
> The procedures management uses to identify and analyse risks relevant to the achievement of objectives, including those related to financial statement misstatement, and to decide how risks should be managed.

Such a process should:

- Identify new, emerging, or ongoing risks related to financial reporting (e.g., changes in IT systems, new accounting standards, economic uncertainty).
- Assess both the likelihood and significance of risks.
- Consider appropriate responses (new procedures, updated controls, staff training, etc.).

Risks may arise from:

- Introduction of complex systems or unfamiliar accounting rules,
- Growth, restructuring, or changes in operations,
- Changes in the business environment or strategy.

### Worked Example 1.2

**Scenario:** A company implements a new software system for revenue recognition. Management does not assess the risk that errors could affect reported income.

> **Answer:**
> The risk assessment process is inadequate. Failure to evaluate the impact of major changes on financial reporting can result in misstatements going unnoticed, raising audit risk.

### Evaluating These Components as an Auditor

You must assess both the control environment and risk assessment process when planning the audit. A strong control environment signals that other controls are more likely to work well, allowing greater reliance on systems and potentially fewer or lighter substantive procedures. Conversely, a weak environment means you cannot place reliance on other controls regardless of how they are designed. Similarly, if the risk assessment process is poor, material misstatements may not be identified or addressed by management.

> **Key Term: risk of material misstatement**
> The risk that the financial statements are materially misstated prior to audit, whether from fraud or error.

### Worked Example 1.3

**Scenario:** During planning, an auditor notices the client’s board does not scrutinise significant accounting estimates or review major management judgements in the accounts.

> **Answer:**
> This weakens the control environment. Lack of oversight increases both inherent and control risk for areas involving significant estimates or judgements and means extra substantive procedures will likely be required.

### Limitations and Common Deficiencies

No internal control system can completely prevent or detect every misstatement. Even with good controls, management override, collusion, or human error can undermine effectiveness. In smaller entities, controls may be informal but still effective if leadership directly oversees transactions.

> **Exam Warning:**
> Do not simply list control activities or policies. Examiners expect you to address how the control environment and the risk assessment process affect audit risk, audit strategy, and the types of audit procedures required.

## Summary

A strong control environment and a thorough risk assessment process are essential for reliable internal control and effective audit planning. If either is poor, audit risk rises and the auditor must plan more substantive procedures, regardless of the existence of other controls or extensive documentation.

## Key Point Checklist

_This article has covered the following key knowledge points:_

- List and briefly describe the five components of internal control.
- Identify characteristics of a strong control environment.
- State the objectives of an entity’s risk assessment process.
- Explain why auditors evaluate these components and how deficiencies affect audit approach.
- Recognise the limitations of internal control and the practical implications for audit procedures.

## Key Terms and Concepts

- internal control
- control environment
- risk assessment process
- risk of material misstatement


Components of internal control - Control environment and risk assessment