Skip to main content

Legal

Tax & Accounting

Trade & Supply

Risk & Fraud

News & Media

Books

Developers

Internal Control

Assess control risk

When you assess control risk, you'll do the following:
  • Document your control risk assessments for each COSO component, audit area, and related assertions in the Internal Control Assess Control Risk form at CX10.2.1.
  • For those areas in which controls were tested, indicate your control risk assessment, considering the displayed test results. If sampling was applied using CX-10.2‒Tests of Controls Sampling Planning and Evaluation Form, make sure your risk assessments are appropriate given the sample size and number of deviations noted.

Public company audit of internal control

When performing a public company integrated audit of internal control and the financial statements, you'll need to test controls to simultaneously accomplish the objectives of both audits. In performing the audit of internal control, you'll need to obtain evidence that internal control has operated effectively for a sufficient period of time, which may be less than the financial statement period (ordinarily a year).
To assess control risk for specific assertions at less than the maximum for the financial statement audit, you're required to obtain evidence that the relevant controls operated effectively during the entire period you plan to place reliance on those controls.
At this point, you'll have completed your control testing and will assess control risk for each assertion for purposes of your financial statement audit. You'll also be able to reach a tentative conclusion regarding control effectiveness in CX-15 for purposes of your audit of internal control.
Make sure that your control risk assessments (High, Moderate, Low) for your financial statement audit are consistent with your internal control audit conclusions, keeping in mind that your control risk assessments are for the entire period under audit and your internal control effectiveness conclusion at CX-15 is as of a point in time.
The control risk assessments that you enter in the Assess Control Risk section carry forward to the applicable area.

This article applies to:

  • Product: Guided Assurance

Related content