CPA Exam — AUDEthics, Professional Responsibilities, and General PrinciplesMedium
A CPA is performing an audit of a small, privately-held manufacturing company. The client's management team consists of the owner, who also acts as the CEO and CFO, and a bookkeeper. There is no internal audit function or audit committee. In this scenario, which of the following risks is most significantly heightened and requires particular attention from the auditor?
- ARisk of management override of internal controls.
- BRisk of inadequate segregation of duties.
- CRisk of non-compliance with debt covenants.
- DRisk of misstatements due to related party transactions.
Show answer & explanationAnswer & explanation
Correct answer: A. Risk of management override of internal controls.
In a small, owner-managed business with limited personnel and no independent oversight (like an audit committee), the risk of management override of internal controls is significantly heightened. The owner/CEO/CFO has the ability to bypass controls that might otherwise be in place.
Why the other options are wrong
- B. Inadequate segregation of duties is a related control deficiency, but management override is a distinct and often more pervasive risk in such settings.
- C. While possible, non-compliance with debt covenants is a financial risk, not the primary governance risk highlighted by the scenario.
- D. Related party transactions are a risk, but the scenario primarily points to the owner's ability to override controls, which encompasses more than just related parties.
Management Override Risk
The risk that management, despite the existence of effective internal controls, can circumvent or override these controls to manipulate financial reporting.
- Often present even with strong controls.
- Heightened in owner-managed businesses.
- Requires specific audit procedures to address.
Memory trick: Opportunity, Pressure, Rationalization, Override.