Internal Control Testing: Don’t Let Time Cost You Money

Have you been spending too much time and money to test your financially significant controls? In our experience at RyanSharkey, a company’s cost of internal control testing is significantly higher than expected due to a variety of factors. These include high numbers of key controls, excessive management review controls and inefficiencies stemming from the controls testing process across the organization. This results in budgetary challenges while trying to enhance a current control compliance program.

When companies first adopt an internal controls program, more controls in a process are identified than are needed. In addition, management will more frequently describe these controls as “key controls” (i.e., controls that may lead to a financial misstatement if they are ineffective) and as “management review controls” (i.e., controls that indicate higher levels of judgement and management review). The management decisions in this case also lead to an over-testing of controls resulting in additional time being spent testing unnecessary controls, which creates much higher costs than a fully rationalized control environment.

At RyanSharkey, we use to following approach to ensure our clients’ controls are appropriately and effectively rationalized and our testing strategy focuses on continuous improvement of efficiency.

  1. Determine which controls are aligned with the current process – Due to business and process changes stemming from (or related to) growth, reorganization or acquisitions/divestments, the initial controls created by the company may no longer reflect the current process. It is critical to review process documentation and current workflows, and to interview process owners to determine whether the process and controls are aligned, and whether any changes in risk assessments/gap analysis have been mitigated.
  2. Identify “key controls” and “management review controls” – Once it is determined which controls are correct for a process, we identify which controls should be considered “key.” A “key control” is required to provide reasonable assurance that material errors will be prevented or detected in a timely manner. If that control fails, it is highly improbable that another control could detect the control absence. We also review the control activity to determine the amount of judgement and management review required in performing the control to assess if it should be labeled as a “Management Review Control.”
  3. Align controls across processes and business units – Through control alignment, an organization can develop synergies through standardization. In addition, required process documentation and training can be leveraged without substantial additional expense.
  4. Develop a testing strategy – While control rationalization can be a major gain to efficiency, a comprehensive testing strategy must be developed. A strategy must include: appropriate scoping using financial statements and risk assessments; leveraging sample testing across multiple controls; aligning testing phases to reduce year-end testing efforts; and developing control remediation requirements.
  5. Discuss and align with external auditors – The final step to maximize cost and time efficiency of any rationalization and testing strategy discussion is to communicate with your external auditors. This alignment sets expectations for their reliance strategy on management testing, as well as timing of work paper review and an agreed upon approach dealing with testing exceptions. 

Do you have questions about internal controls rationalization and controls testing strategy, or other risk advisory-related matters? Please contact Michael Korenchuk, CPA, at 703.677.4896 or please feel free to leave us a message below.

Blog Category: 

Material discussed in this article is meant to provide general information and should not be acted on without professional advice tailored to your firm’s individual needs.

Questions? Contact RyanSharkey using the form below.

Fill out my online form.