Discuss entity-level controls and provide examples of these types of controls.

Question

What will be an ideal response?

Answer 1

Entity-level controls can have a pervasive effect on the entity's ability to meet the COSO control criteria. If general controls are not effective, the specific controls are probably unreliable. Entity-level controls addressing management's ability to override specific controls are thus of central importance. The pervasiveness of entity-level controls suggests that it may be appropriate for the auditor to test and evaluate them before evaluating the other aspects of internal control over financial reporting. However, testing entity-level controls alone is not sufficient for the purpose of expressing an opinion on the effectiveness of an entity's internal control over financial reporting. Examples of entity-level controls include:

1. Controls within the control environment, which includes the tone at the top, assignment of authority and responsibility, consistent policies and procedures, and entitywide programs that apply to all locations and business units (such as codes of conduct and fraud prevention).
2. Controls over management override.
3. Management's risk assessment process.
4. Centralized processing and controls, including shared service environments.
5. Controls to monitor results of operations.
6. Controls to monitor other controls, including activities of the internal audit function, the audit committee, and self-assessment programs.
7. Period-end financial reporting process.
8. Policies that address significant business control and risk management practices.