CPA Exam — AUDAssessing Risk and Developing a Planned ResponseEasy
An auditor is evaluating a client's internal controls over financial reporting. The client is a small, family-owned manufacturing business where the owner-manager directly oversees all significant transactions and regularly reviews all financial reports. Which of the following is the most likely implication of this control environment on the auditor's risk assessment?
- AThe audit will require extensive substantive testing of all account balances due to inherent weaknesses.
- BControl risk will be assessed at a high level due to the lack of formal internal controls.
- CControl risk might be assessed at a lower level due to effective owner-manager review, despite limited segregation of duties.
- DInherent risk will be significantly reduced due to direct owner oversight.
Show answer & explanationAnswer & explanation
Correct answer: C. Control risk might be assessed at a lower level due to effective owner-manager review, despite limited segregation of duties.
In small, owner-managed businesses, the direct and active involvement of the owner-manager can often compensate for a lack of formal internal controls and segregation of duties. This active oversight and review can be an effective control, leading to a potentially lower assessment of control risk than might otherwise be expected.
Why the other options are wrong
- A. While substantive testing is likely, the direct owner oversight might allow for some reliance on these compensating controls, potentially reducing the extent of testing compared to a situation with no effective controls.
- B. While formal controls may be lacking, owner oversight can act as a compensating control.
- D. Owner oversight primarily impacts control risk, not inherent risk, which relates to susceptibility to misstatement before considering controls.
Owner-Manager Review as a Control
In small entities, active involvement and review by an owner-manager can serve as an effective compensating control, potentially reducing control risk despite limited segregation of duties.
- Can mitigate risks from lack of formal controls.
- Requires the owner-manager to be competent and diligent.
- Often seen in smaller, less complex organizations.
Memory trick: The Boss's Eye Catches the Flaws.