Key Controls
Audit Automation includes a Key Controls function. This allows you to maintain a list of key controls that can be referenced throughout the system.
You can maintain the following details for each key control:
- Details of the control
- Financial statement area and assertion: This allows you to link the control to the relevant financial statement area and indicate the assertions that it covers.
- Design: Comments on the design and efficiency of the control. It is a requirement that you consider the key controls, their design and effectiveness for all audits. If it is then decided that a controls based approach is to be taken, procedures need to be designed to test the control.
- Implementation: Comments on the implementation of the control. As with the design and efficiency, it is required that the implementation of controls be confirmed for all audits.
- Key control: A flag to allow you to indicate that it is a key control. This flag will generally be set as you would normally only record key controls in the database. However, it is provided to cover the situation where you wish to record all controls and mark the ones that are considered key.
- Tested: Further testing to be performed. For controls based audit, this flag allows you to indicate if the control is to be tested in the current audit. When set, the [Work Programme] button becomes active allowing you to design the procedures to be carried out in respect of the control.
- Conclusion: This allows you to record your conclusion on the work carried out on the control.
- Last tested: This field shows the period end in which the control was last tested. Initially this will be blank, however, it can be updated manually when the control is created to allow you to record the period end in which it was last tested. When you balance forward, the system will update the field for all controls that were tested in the year.
- Source: this filed provides the source where the control has been added
- Designed effectively: can be at Yes, No or N/A
- Implemented: can be at Yes, No or N/A
- IT control: it is a tick box you choose to tick or not
The 3 last fields (in bold characters above) have been added to CCH Audit Automation application (from the CCH Audit auomation 2022.3 release done in November 2022).
Accessing the key controls
There are two ways you can list, add and maintain key controls:
• By selecting the Reference [Key controls] menu option.
• By selecting the [Key control] button that is provided on the following source Audit Automation dialogs:
o Key process form
o Key business process flow
o Key process text
o Perennial checklist question form
o Background information
o Identified audit risk
Adding a control from one of these dialogs links the control to the source.
When you access any of these dialogs you can immediately tell from the colour of the [Key control] button whether or not controls are linked to that source. If the button text is shown in black, no key controls are linked to the source.
Whereas, if the button text is green, there are linked controls e.g.
Listing the key controls
When you access the key controls function from the menu option, or by selecting the [Key control] button on a source dialog, the system displays a list of key controls on the Key controls dialog.
Key controls list accessed from menu
If you access the list of controls from the menu, all of the key controls are listed, as illustrated above.
If you access the list of controls from a source dialog, the list initially only includes the controls associated with the source. You can click the Show all key controls checkbox to list all of the controls, if required.
Procedures
The [Procedures] button displays a report containing all of the recorded controls, the procedures that have been carried out in connection therewith, the results and conclusions.
Summary
This [Summary] button displays a report of all controls and conclusions, without the audit procedures.
Adding and editing key controls
To add a new key control, click the [Add] button on the Key controls dialog. Similarly, to edit an existing key control, select the control and click the [Edit] button.
Adding or editing a key control is carried out on the Key control dialog illustrated below.
The following key control details can be entered or amended on this dialog:
Details of control: 2:
You must enter the details of the control
Comment on the design and efficiency of the control
It is a requirement that you consider the design of the key controls for all audits. If it is then decided that a controls based approach is to be taken, procedures then need to be designed to test the control.
You can decide if the control has been designed effectively.
3 choices are available: Yes, No or N/A
Comment on implementation of control
As with the design and efficiency, it is required that the implementation of controls be confirmed for all audits.
You can decide if the control has been implemented.
3 choices are available: Yes, No or N/A
Financial statement area/Assertion
You may associate the risk with any number of financial statement areas/assertion combinations. Use the [Add] button to select an area and assertion from the list provided.
Choose the area by highlighting the relevant section on the left, then click the checkboxes to select or deselect the relevant assertions. One area can be added at a time with any selection of assertions.
Plan to test operating effectiveness?
It is a requirement that you consider the efficiency key controls for all audits. If it is then decided that a control-based approach is to be taken, procedures then need to be designed to test the control.
You can decide if you plan to test the operating effectiveness of the control.
3 choices are available: Yes, No or N/A
If you choose ‘Yes’, the [Work Programme] button becomes active allowing you to design the procedures to be carried out in respect of the control.
If you indicate that a control is not to be tested in the current year and you have planned procedures in respect of the control, the system does not remove the list of procedures to be carried out but simply inactivates them. This means that if, later in the audit, or in a following year, you indicate that the control is to be tested, the previously defined procedures will be restored and can then be reviewed and edited as required.
Key control checkbox
This checkbox is ticked by default and indicates that the control is considered a key control. If the control is not key, the tick may be removed. This will generally be set as you would normally only record key controls. However, it is provided to cover the situation where you wish to record all controls and mark the ones that are considered key.
IT control checkbox
An IT control checkbox has been added to allow users to flag a control as an IT control.
Further testing to be performed
For a controls based audit, this checkbox allows you to indicate if the control is to be tested during the current audit. When ticked, the [Work Programme] button becomes active allowing you to design the procedures to be carried out in respect of the control.
If you indicate that a control is not to be tested in the current year and you have planned procedures in respect of the control, the system does not remove the list of procedures to be carried out but simply inactivates them. This means that if, later in the audit, or in a following year, you indicate that the control is to be tested, the previously defined procedures will be restored and can then be reviewed and edited as required.
Last tested
This field shows the period end in which the control was last tested. Initially this will be blank, however it can be updated manually to allow you to record the period end it was last tested. When you balance forward, the system will update the field for all controls that were tested in the year.
Work programme
You may design the audit procedures in respect of the control at any time. This can be done from this dialog by clicking on the [Work programme] button, or you can do this at the same time as designing your work in respect of assessed risks via the Audit area risk dialog.
Conclusion
After the field work has been completed, you will need to record your conclusion on the control. The [Conclusion] button will be active at all times and if no procedures have been designed, you are free to enter a conclusion during planning or completion. However, if procedures have been planned, the system will only allow you to enter a conclusion if all work has been completed. Clicking on this button will result in the following dialog being displayed:
Enter your conclusion and click on [OK].
If you have entered a conclusion in error, or later wish to remove it, you can do so by returning to this form and selecting [Remove conclusion].
If someone else has entered a conclusion and you wish to add to it, you can do so by selecting the [Add to comments] option which appears on this dialog.
Adding Comments to a Key Control Raised by a more Senior User
If you open a control that has been raised by another member of staff who is at a more senior level than you, you will not be able to edit the details. Instead, an [Add comment] button appears above the details.
Click the [Add comment] button to display the following dialog on which you can enter your own comments and observations.
Maintaining key controls source links
When you create a key control from a source dialog, e.g. Key processes, the system automatically links the control to the source. So, when you access the list of controls from the source dialog you will only see the controls associated with that source.
You can view all of the key controls defined by selecting the Show all key controls checkbox.
Key controls list accessed from source dialog
This allows you to link an existing control (which may already be linked to a different source) to the current source. Select the control to be linked and click the [Link source] button to associate it with the current source.
In this way a control can be linked to more than one source.
Identifying all control sources
You can display the full list of key controls by selecting the Reference [Key controls] menu option. The system displays the Key controls dialog with the “Show all key controls” option ticked so that all controls are shown.
You can view the source, or sources, of all of the controls on the 9th column of this grid.
A source of General indicates the control was defined via the menu option and is not linked to any other source dialog.
Drilling down to the source
You can also drill down to the source of a particular control. Highlight the control and right click, or click on [Source] button. A pop up menu appears listing the sources to which the control has been associated. Click on the source to be displayed and the source dialog from which the risk was originally entered will be displayed.
For example:
Key control additional processing
Balance Forward Key Control Processing
On a balance forward, the system will update the Last Tested field for all tests where further tests were carried out in the year and clear all further test flags, inactivating any planned procedures in respect of the controls.
After updating the control details, you can then decide which controls are to be tested in the following year’s audit. If you select anywhere procedures have been defined in prior years, the procedures will be restored and can then be reviewed and edited as required.
Test Control
The Test of Control program first displays key controls and the procedures designed for them, followed by tests designed in respect of specific assertions.
Risk Analysis
In risk analysis, when you open a financial area, the system displays identified risks in the top half of the window. A [Show Key Controls] button appears at the head of this list to allow you to switch to displaying any key controls that have been entered in respect of the area.
From here, you can double click on the description of the control to drill down to the risk record and in the assertion area to display and design audit procedures in respect of the control.
All controls are shown but those that have not been flagged as being tested in the year are displayed in silver. You cannot design procedures in respect of these items.
Where you have designed audit procedures in respect of key controls, the system automatically associates the tests carried out with any assertions that the control has been indicated as covering. Hence, if you indicate that you are placing reliance on controls for the assertion, you will not be forced to design further procedures if the assertion is covered by a tested control, however, you are free to do this if it is appropriate.
Key control quality control
For all controls that have been flagged as being subject to further tests, the system will check that procedures have been defined both when you sign off planning and each audit area.
If no procedures have been defined in respect of a control that is to be tested, you will not be allowed to sign off planning or the area.
In addition, the system will warn seniors if conclusions have not been entered in respect of any controls tested and it will not allow manager to sign off an area until all tested controls have conclusions.
Automated entry from process flow
When you record a process using the internal process flow facility, you have the option to enter controls and to mark a control as key. This is independent of this Key Controls database as it is for systems record purposes. However, if you use this facility, when you tick the Key control checkbox for the process flow, the system will assume that you would also like to record the details of the control in the database and presents the Key control dialog for completion. For further information, see click here.