Entity-Level Controls: The Complete Auditor's Guide to Evaluating Governance, Risk Management, and Internal Control
How Internal and External Auditors Should Assess the Control Environment, Management Oversight, Financial Reporting, Fraud Risk, and the Effectiveness of Entity-Level Controls
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Internal Auditing, COSO, PCAOB Standards, Risk Management, and Corporate Governance
An organization may have hundreds of documented internal controls and still experience significant financial reporting failures, fraud, regulatory violations, and operational losses.
Why?
Because individual transaction controls cannot compensate for every weakness in the organization's overall control environment.
An accounts payable department may have effective invoice approval procedures. A payroll department may reconcile employee compensation. The accounting department may perform monthly balance sheet reconciliations.
But what happens when senior management can override these controls?
What happens when the Board of Directors does not receive reliable financial information?
What happens when management fails to identify emerging risks, ignores significant audit findings, or allows employees to circumvent established policies?
These are entity-level control problems.
Entity-level controls establish the governance, accountability, risk management, and oversight structure within which all other internal controls operate.
For internal and external auditors, understanding and evaluating these controls is essential to determining whether an organization's internal control framework is appropriately designed and operating effectively.
This guide explains how auditors should identify, document, evaluate, test, and report on entity-level controls using the COSO Internal Control–Integrated Framework, PCAOB auditing standards, and the IIA Global Internal Audit Standards.
1. What Are Entity-Level Controls?
Entity-level controls (ELCs), sometimes called company-level controls, are controls that operate across an organization or significantly influence multiple business processes, locations, accounts, or financial reporting activities.
Unlike transaction-level controls, which address specific activities such as invoice approval or payroll processing, entity-level controls address broader organizational risks.
Examples include:
Board of Directors and Audit Committee oversight.
Management's commitment to integrity and ethical conduct.
Organizational structure and assignment of authority.
Enterprise risk assessment and fraud risk assessment.
Financial reporting policies and management review.
Whistleblower and ethics reporting mechanisms.
Internal Audit oversight and reporting.
Information technology governance.
Management's monitoring of internal control deficiencies.
Controls addressing management override.
Regulatory compliance oversight.
Management's process for identifying significant business changes.
Entity-level controls are not simply policies or statements of management intent.
They must involve identifiable activities, responsible individuals, appropriate evidence, and processes for addressing exceptions.
For example, a Code of Conduct is an important component of the control environment.
However, the existence of a Code of Conduct does not demonstrate that employees understand it, management enforces it, or violations are investigated.
The auditor must evaluate whether the related controls actually operate.
2. Why Entity-Level Controls Matter
Entity-level controls influence the reliability of nearly every business process.
Consider an organization with well-designed purchasing procedures.
Purchase orders require approval, vendors must be verified, and invoices are matched to receiving documentation.
However, the CFO routinely directs employees to process exceptions without supporting documentation.
The purchasing controls may appear effective when tested individually, but the organization's control environment permits management override.
Similarly, an organization may have detailed financial reporting procedures while its Audit Committee rarely meets or receives incomplete information.
In both situations, the underlying governance weaknesses can undermine otherwise effective transaction controls.
Entity-level controls matter because they help determine whether management has established an environment in which employees are expected and able to follow established procedures.
They also influence whether control deficiencies are identified, communicated, and corrected.
An organization cannot demonstrate an effective internal control framework merely by documenting individual transaction controls.
3. The COSO Framework: Foundation for Entity-Level Control Evaluation
The COSO Internal Control–Integrated Framework provides a widely recognized foundation for evaluating internal controls.
COSO identifies five integrated components supported by 17 principles.
COSO component | Principles | Primary entity-level focus |
Control Environment | 1–5 | Integrity, oversight, organizational structure, competence, accountability |
Risk Assessment | 6–9 | Objectives, risks, fraud, significant changes |
Control Activities | 10–12 | Risk responses, technology controls, policies and procedures |
Information and Communication | 13–15 | Relevant information, internal reporting, external communication |
Monitoring Activities | 16–17 | Control evaluations, deficiencies, corrective actions |
An effective internal control system requires the five components and relevant principles to be present and functioning and the components to operate together.
Auditors should evaluate both the design and operating effectiveness of relevant controls.
The COSO framework is particularly useful because it provides a structured approach to evaluating management's responsibilities.
It also helps auditors distinguish between an isolated process deficiency and a broader organizational control weakness.
4. COSO Principle 1: Integrity and Ethical Values
The first COSO principle addresses the organization's commitment to integrity and ethical values.
This is a foundational entity-level control area.
Management establishes expectations through policies, decisions, incentives, communications, and personal conduct.
Auditors should examine whether the organization maintains a Code of Conduct, communicates ethical expectations, addresses conflicts of interest, and investigates allegations of misconduct.
However, the audit should not stop with reviewing written policies.
Questions auditors should ask
Does senior management consistently comply with established policies?
Are employees required to disclose conflicts of interest?
Are ethics violations investigated objectively?
Are disciplinary actions applied consistently?
Can employees report concerns without retaliation?
Are exceptions involving executives reviewed independently?
Audit procedures
The auditor may examine ethics training records, conflict-of-interest disclosures, investigation procedures, employee survey results, and reports provided to the Audit Committee.
The auditor should also consider whether management's actions are consistent with its stated ethical expectations.
Tone at the top is demonstrated through management behavior, not simply through statements in a policy manual.
5. COSO Principle 2: Board and Audit Committee Oversight
The Board of Directors and Audit Committee are important elements of the organization's governance structure.
Effective oversight requires more than holding meetings.
The Board and Audit Committee must receive relevant information, challenge management when necessary, and oversee the effectiveness of internal controls.
Key controls auditors should evaluate
Board and Audit Committee charters.
Committee independence and relevant expertise.
Meeting frequency and attendance.
Financial reporting review procedures.
Oversight of Internal Audit and external auditors.
Review of significant control deficiencies.
Monitoring of management corrective actions.
Procedures for receiving significant risk and compliance information.
Audit procedures
Auditors should examine meeting agendas, minutes, management reports, Audit Committee materials, and evidence of follow-up on significant matters.
For example, if the Audit Committee is responsible for overseeing financial reporting, the auditor should determine whether it receives the necessary information in sufficient time to exercise meaningful oversight.
A meeting agenda stating "financial statements reviewed" may not provide adequate evidence of the nature and effectiveness of the review.
The auditor should examine whether significant accounting judgments, financial reporting risks, and identified control deficiencies were communicated and discussed.
The precise procedures required depend on the organization's governance framework and applicable legal and regulatory requirements.
6. COSO Principle 3: Organizational Structure, Authority, and Responsibility
Effective internal controls require clearly assigned responsibilities.
An organization should establish reporting relationships, decision-making authority, and accountability for important business activities.
Auditors should evaluate whether responsibilities are appropriately distributed and whether management has established adequate segregation of duties.
Warning signs
Unclear reporting relationships.
Excessive concentration of authority.
Employees performing incompatible functions.
Undocumented delegation of approval authority.
Managers overriding established procedures.
Internal Audit reporting exclusively to executives whose activities it audits.
Practical audit example
Suppose the CFO can create vendors, approve invoices, modify banking information, and authorize payments without independent review.
This concentration of authority creates significant control risks.
The auditor should evaluate whether compensating controls exist and whether they operate at a sufficient level of precision.
7. COSO Principle 4: Competence
Organizations must attract, develop, and retain competent personnel to support their objectives.
An effective internal control framework depends on employees who understand their responsibilities.
Auditors should examine whether management establishes appropriate qualifications, training requirements, performance expectations, and succession plans.
For example, employees responsible for preparing complex financial reports should possess the necessary accounting knowledge.
Similarly, individuals responsible for cybersecurity, regulatory compliance, and internal control monitoring need appropriate technical expertise.
Audit evidence
Relevant evidence may include job descriptions, professional qualifications, training records, performance evaluations, and documented supervisory reviews.
A control may be well designed but ineffective if the person responsible for performing it lacks the necessary competence.
8. COSO Principle 5: Accountability
Management must hold individuals accountable for their internal control responsibilities.
This includes evaluating performance, addressing control failures, and ensuring that employees comply with established procedures.
Auditors should determine whether control ownership is clearly assigned.
They should also examine whether management responds appropriately when controls fail.
For example, if account reconciliations are repeatedly completed late, management should investigate the causes and take corrective action.
A process in which deficiencies are repeatedly reported but never corrected indicates weaknesses in accountability and monitoring.
9. COSO Principles 6–9: Entity-Level Risk Assessment
Risk assessment is one of management's most important responsibilities.
Management must identify and analyze risks that could prevent the organization from achieving its objectives.
The COSO risk assessment component includes four principles:
Principle 6: Specify suitable objectives.
Principle 7: Identify and analyze risks.
Principle 8: Assess fraud risk.
Principle 9: Identify and analyze significant changes.
Auditors should determine whether management has established a systematic risk assessment process.
What should a management risk assessment include?
Organizational objectives.
Financial reporting risks.
Operational risks.
Compliance risks.
Fraud risks.
Cybersecurity and information technology risks.
Significant changes in business operations.
Risks associated with third-party relationships.
Management's responses to identified risks.
Audit procedures
Auditors should examine risk assessment documentation, management meeting materials, risk registers, and evidence that significant risks are communicated to the appropriate governance personnel.
The auditor should also determine whether management updates risk assessments when conditions change.
A risk assessment prepared several years ago may no longer address the organization's current exposures.
10. Fraud Risk Assessment Is a Critical Entity-Level Control
Fraud risk assessment deserves particular attention.
Organizations should consider how employees, managers, executives, and third parties could intentionally circumvent controls.
Important fraud risks include:
Management override of financial reporting controls.
Fictitious vendors and fraudulent payments.
Improper revenue recognition.
Unauthorized journal entries.
Misappropriation of assets.
Conflicts of interest and related-party transactions.
Manipulation of accounting estimates.
Cyber-enabled payment diversion.
Collusion among employees or vendors.
Auditors should determine whether management's fraud risk assessment considers incentives, opportunities, and rationalizations.
The assessment should also consider how management override or collusion could defeat established controls.
A fraud risk assessment that addresses only employee theft while ignoring executive misconduct may be incomplete.
11. COSO Principles 10–12: Entity-Level Control Activities
Control activities are the policies and procedures that help ensure management's risk responses are implemented.
Although many control activities operate at the transaction level, others operate across the organization.
Examples include:
Financial reporting policies.
Corporate approval authority matrices.
Enterprise-wide segregation-of-duties requirements.
Information technology access governance.
Management review of consolidated financial results.
Controls over significant accounting estimates.
Policies governing related-party transactions.
Procedures for approving significant contracts.
Controls over regulatory financial reporting.
The importance of control precision
Not all entity-level controls provide the same degree of assurance.
A CEO's quarterly review of overall profitability may help identify broad business problems.
However, it may not be sufficiently precise to detect a material misstatement in a particular account.
By contrast, a documented review of a significant accounting estimate may operate at a level of precision capable of detecting a material misstatement.
Auditors must determine what risks each control addresses and whether the control operates with sufficient precision.
12. COSO Principles 13–15: Information and Communication
Management must obtain, generate, and communicate information necessary to support internal control.
Entity-level information and communication controls include:
Management financial reporting.
Board and Audit Committee reporting.
Internal communication of policies.
Reporting of significant control deficiencies.
Regulatory compliance reporting.
Whistleblower communications.
Escalation of significant financial risks.
Questions auditors should ask
Does management receive reliable financial information?
Are significant risks communicated promptly?
Does the Board receive information necessary for oversight?
Can employees report concerns through appropriate channels?
Are important regulatory requirements communicated to responsible personnel?
Audit example
Suppose management identifies a significant liquidity problem but does not communicate the issue to the Board until the organization faces a cash shortage.
The problem may indicate a weakness in entity-level communication and governance controls.
The auditor should evaluate whether management has established effective procedures for identifying, escalating, and reporting significant financial risks.
13. COSO Principles 16–17: Monitoring Activities
Monitoring is the process through which management determines whether internal controls continue to operate effectively.
Management should establish ongoing evaluations, separate evaluations, or a combination of both.
Internal Audit may provide independent assurance, but management remains responsible for its monitoring activities.
Examples of entity-level monitoring controls
Monthly financial performance reviews.
Monitoring of significant accounting reconciliations.
Management review of compliance exceptions.
Periodic access rights reviews.
Monitoring of unresolved audit findings.
Fraud indicator reporting.
Control self-assessments.
Review of significant policy exceptions.
Evaluating deficiency remediation
Auditors should determine whether management identifies control deficiencies, evaluates their significance, assigns corrective action responsibilities, and monitors implementation.
A recurring deficiency may indicate that management's remediation process is ineffective.
The auditor should examine whether corrective actions address root causes rather than merely correcting individual errors.
14. Entity-Level Controls Versus Transaction-Level Controls
Auditors must understand the distinction between entity-level and transaction-level controls.
Characteristic | Entity-level control | Transaction-level control |
Scope | Organization-wide or multiple processes | Specific transactions or activities |
Examples | Audit Committee oversight, enterprise risk assessment | Invoice approval, payroll reconciliation |
Primary purpose | Establish governance and broad control effectiveness | Address specific process risks |
Typical evidence | Minutes, reports, assessments, monitoring records | Approvals, reconciliations, transaction records |
Common risk | Ineffective oversight or management override | Unauthorized or inaccurate transactions |
Both categories are important.
A strong control environment can support effective transaction controls.
However, broad entity-level controls do not automatically eliminate the need to test transaction-level controls.
Auditors must evaluate the specific risks addressed by each control.
15. Direct and Indirect Entity-Level Controls
PCAOB AS 2201 distinguishes among company-level controls based on their effect on financial reporting risks.
Some controls have an indirect effect.
Others may monitor the effectiveness of more detailed controls.
Certain controls operate at a level of precision sufficient to prevent or detect material
misstatements.
Indirect entity-level controls
Examples include the Code of Conduct, management's general ethical expectations, and organizational structure.
These controls influence the overall control environment but ordinarily do not directly prevent or detect a specific financial statement misstatement.
Monitoring controls
Examples include management's review of business unit performance and Internal Audit's evaluation of process controls.
These controls may identify deficiencies in other controls.
Their effectiveness depends on the nature and precision of the monitoring activities.
Precise entity-level controls
Some management review controls may operate with sufficient precision to address
specific financial reporting risks.
For example, a detailed corporate-level review of an accounting estimate may detect a material misstatement if the review is appropriately designed and effectively performed.
The auditor should never assume that an entity-level control is sufficiently precise merely because a senior executive performs it.
The nature of the review, the information used, the thresholds for investigation, and the evidence of follow-up all matter.
16. PCAOB AS 2201: Company-Level Controls in an ICFR Audit
PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, specifically addresses company-level controls.
The standard requires auditors to evaluate company-level controls because they can have a pervasive effect on internal control over financial reporting.
Relevant controls include:
Controls related to the control environment.
Controls over management override.
The company's risk assessment process.
Centralized processing and controls.
Controls monitoring results of operations.
Controls monitoring other controls.
Controls over the period-end financial reporting process.
Policies addressing significant business control and risk management practices.
The auditor's evaluation of company-level controls affects the audit approach.
However, the extent to which a company-level control can reduce testing of other controls depends on its effectiveness and precision.
A general financial performance review cannot automatically substitute for a control addressing a specific relevant assertion.
17. Evaluating the Period-End Financial Reporting Process
The period-end financial reporting process is a particularly important entity-level control area.
It includes the procedures used to prepare annual and interim financial statements and related disclosures.
Auditors should evaluate controls involving:
The preparation and review of financial statements.
Consolidation and elimination entries.
Significant journal entries.
Accounting estimates.
Financial statement disclosures.
Management's review of significant accounting judgments.
Audit Committee oversight of financial reporting.
The preparation and authorization of regulatory filings.
Practical example
Consider a company that files financial statements with the SEC.
The auditor should understand the controls management has established over preparing, reviewing, and authorizing the financial statements.
These controls may include detailed reviews by accounting personnel, CFO certification procedures, disclosure committee activities, and Audit Committee oversight.
Applicable legal requirements and company governance policies determine the specific responsibilities of the Board and Audit Committee.
The auditor should evaluate the actual control activities rather than assume that every organization must follow an identical approval process.
18. How to Test the Design Effectiveness of Entity-Level Controls
Design effectiveness addresses whether a control, if operated as prescribed by competent personnel, is capable of achieving its intended objective.
The auditor should begin by identifying the risk addressed by the control.
Next, the auditor should determine how the control is intended to operate.
Example: Audit Committee oversight
Risk: Significant financial reporting risks or control deficiencies are not appropriately communicated or addressed.
Control objective: Ensure that significant financial reporting matters receive appropriate independent oversight.
Control description: The Audit Committee receives periodic financial reporting, significant audit findings, and management remediation reports.
Design evaluation procedures
Review the Audit Committee charter.
Identify required reporting responsibilities.
Examine the types of information management is expected to provide.
Determine whether significant deficiencies must be escalated.
Evaluate whether the Committee has appropriate authority and independence.
Consider whether the control can address the identified risk.
A control may be poorly designed even when management claims that it is performed regularly.
19. How to Test Operating Effectiveness
Operating effectiveness addresses whether the control actually operated as designed during the relevant period.
Auditors should obtain evidence that the responsible individuals performed the required activities.
Example: Quarterly management financial review
Suppose the CFO is required to review consolidated financial results each quarter.
The auditor should determine:
Who performed the review?
When was the review performed?
What financial information was examined?
How was the accuracy and completeness of the information established?
What thresholds triggered investigation?
Which unusual items were identified?
What follow-up procedures occurred?
What evidence demonstrates that the review was completed?
A signature on a financial report may not establish the precision or effectiveness of the review.
The auditor should evaluate whether the review could identify the relevant errors or misstatements.
Appropriate audit procedures
Depending on the control, procedures may include inquiry, observation, inspection, and reperformance.
Inquiry alone generally does not provide sufficient evidence of operating effectiveness for a relevant control.
The nature, timing, and extent of testing should reflect the control's risk, frequency, and importance.
20. Management Review Controls: The Precision Problem
Management review controls are common entity-level controls.
Examples include monthly budget-to-actual reviews, consolidated financial statement reviews, and reviews of significant estimates.
However, management review controls are frequently difficult to evaluate.
The auditor must determine whether the review operates at a sufficient level of precision.
Example
Management states: "The CFO reviews the financial statements every month."
That statement is not a complete control description.
The auditor needs to know what the CFO examines, what expectations are used, how differences are identified, and what happens when unusual items are found.
A more complete description might be: "The CFO reviews monthly revenue and gross margin results by business unit, compares actual performance with approved forecasts and historical trends, investigates differences exceeding defined thresholds, and documents explanations and corrective actions."
Even this description must be evaluated against the risks and assertions the control is intended to address.
The auditor should determine whether the thresholds and review procedures are sufficiently precise to identify material misstatements.
21. Information Produced by the Entity: Can the Auditor Trust the Reports?
Many entity-level controls rely on information produced by the organization.
Examples include financial dashboards, exception reports, aging schedules, budget comparisons, and compliance reports.
Before relying on a management review control, the auditor must evaluate the reliability of the information used in the review.
For external auditors, PCAOB AS 1105 addresses the reliability of information used as audit evidence, including information produced by the company.
The auditor should consider whether the information is sufficiently accurate and complete for the audit purpose.
For example, a CFO's review of an accounts receivable aging report may be ineffective if the underlying report excludes significant customer balances.
A review control cannot be more reliable than the information on which the review depends.
22. Management Override: A Pervasive Entity-Level Risk
Management override deserves special attention because senior executives may have the authority or influence to circumvent established controls.
Potential examples include:
Unauthorized journal entries.
Manipulation of accounting estimates.
Improper revenue recognition.
Undisclosed related-party transactions.
Override of purchasing controls.
Suppression of unfavorable financial information.
Improper pressure on accounting personnel.
Failure to report significant control deficiencies.
Auditors should evaluate whether the organization has controls capable of preventing or detecting inappropriate management override.
These may include independent Audit Committee oversight, restricted system access, journal entry monitoring, related-party disclosure procedures, and protected reporting channels.
The auditor should also consider whether employees can raise concerns without retaliation.
For external financial statement audits, PCAOB AS 2401 addresses fraud risks, including management override.
Management override is not adequately addressed merely because management signs an annual Code of Conduct.
23. Entity-Level Controls and Cybersecurity Governance
Information technology governance has become an important part of entity-level control evaluation.
Financial reporting and operational processes increasingly depend on interconnected systems, cloud applications, automated interfaces, and third-party service providers.
Auditors should examine whether management has established appropriate oversight of technology risks.
Relevant areas include:
IT governance responsibilities.
Cybersecurity risk assessment.
Identity and access management.
Privileged access oversight.
Change management.
Incident response.
Business continuity.
Third-party technology risk management.
Data governance.
The relevance of individual IT controls to financial reporting depends on the systems, applications, and risks involved.
Not every cybersecurity control is an ICFR control, but weaknesses in technology governance may affect the reliability of financial information and related processes.
24. Entity-Level Controls Over Third-Party Relationships
Organizations increasingly rely on vendors, consultants, outsourced service providers, and cloud technology companies.
These relationships create risks that management must identify and address.
Entity-level third-party controls may include:
Vendor risk assessment policies.
Due diligence requirements.
Contract approval procedures.
Conflict-of-interest disclosures.
Monitoring of significant service providers.
Evaluation of service organization control reports.
Business continuity requirements.
Escalation of significant vendor problems.
Auditors should determine whether management has established an effective framework for overseeing third-party risks.
For financial reporting, the auditor should consider the relevance of outsourced processes and applicable service organization guidance.
25. Entity-Level Controls and Regulatory Compliance
Organizations operating in regulated industries must establish controls for identifying and complying with applicable requirements.
Examples include banking, insurance, healthcare, government contracting, and public education.
Entity-level compliance controls may involve:
Compliance risk assessments.
Assignment of regulatory responsibilities.
Monitoring of new requirements.
Regulatory reporting procedures.
Management review of significant filings.
Escalation of compliance violations.
Reporting to the Board or appropriate committees.
Corrective action monitoring.
Auditors should evaluate whether management has established controls appropriate to the organization's regulatory environment.
The existence of a compliance department does not automatically establish that compliance risks are effectively managed.
26. Entity-Level Controls in Banks, Insurance Companies, and Government Organizations
Although COSO provides a common framework, entity-level control requirements differ by industry.
Banking
Bank auditors may evaluate Board oversight, enterprise risk management, regulatory compliance, credit risk governance, liquidity risk management, cybersecurity oversight, and Bank Secrecy Act/anti-money laundering governance.
Insurance
Insurance auditors may examine underwriting governance, claims oversight, investment controls, actuarial assumptions, reinsurance, regulatory reporting, and controls relevant to applicable financial reporting requirements.
Government organizations
Public-sector auditors may evaluate governance, budgetary oversight, procurement controls, regulatory compliance, grant management, fraud risk assessment, and management accountability.
The GAO Green Book provides an important public-sector internal control framework.
Its application depends on the organization's legal and regulatory circumstances.
In every industry, auditors should tailor their procedures to the organization's objectives, risks, and applicable requirements.
27. Entity-Level Controls and the IIA Global Internal Audit Standards
The IIA Global Internal Audit Standards provide a professional framework for internal audit activities.
Internal Audit should evaluate governance, risk management, and control processes using a risk-based approach.
Relevant requirements include:
Standard 9.4 — Internal Audit Plan: Establishing a plan based on the organization's strategies, objectives, and risks.
Standard 13.2 — Engagement Risk Assessment: Understanding relevant risks when planning an engagement.
Standard 13.4 — Evaluation Criteria: Identifying appropriate criteria for evaluating the activity under review.
Standard 14.2 — Analyses and Potential Engagement Findings: Analyzing relevant information to develop potential findings.
Standard 14.3 — Evaluation of Findings: Evaluating findings to determine their significance.
Standard 14.4 — Recommendations and Action Plans: Developing recommendations or obtaining management action plans as appropriate.
Standard 15.2 — Confirming the Implementation of Recommendations or Action Plans: Establishing a methodology to confirm implementation.
An entity-level controls engagement should produce useful conclusions about the effectiveness of management's governance and control activities.
The internal auditor should communicate significant deficiencies to the appropriate management and governance personnel.
28. Common Entity-Level Control Deficiencies
Auditors frequently encounter weaknesses such as:
Ineffective Audit Committee oversight: Significant risks or deficiencies are not adequately reviewed.
Incomplete risk assessment: Management has not identified significant financial, operational, or fraud risks.
Weak management accountability: Control responsibilities are unclear or deficiencies remain unresolved.
Insufficient financial reporting review: Management reviews reports without meaningful investigation of unusual items.
Management override: Senior executives circumvent established procedures without appropriate independent oversight.
Inadequate fraud risk assessment: Management focuses on accidental errors but overlooks intentional misconduct.
Weak information and communication: Significant issues are not escalated promptly.
Ineffective monitoring: Management does not identify or correct recurring control failures.
Unreliable management information: Important controls depend on reports that have not been appropriately validated.
Insufficient documentation: Management cannot demonstrate that significant control activities occurred.
The auditor should evaluate the significance of these deficiencies based on the applicable audit framework and the potential consequences.
29. How to Write an Entity-Level Control Audit Finding
An effective audit finding should clearly explain the deficiency and its implications.
A practical framework includes five elements.
Condition: What did the auditor identify?
Criteria: What requirement, policy, standard, or control objective should have been satisfied?
Cause: Why did the deficiency occur?
Effect: What actual or potential risk results from the deficiency?
Management Action Plan: What improvement should management indicate?
Example: Inadequate Monitoring of Financial Reporting Controls
Condition: Management did not maintain a documented process for tracking and reviewing significant financial reporting control deficiencies. Several deficiencies remained unresolved beyond their established remediation dates without documented escalation.
Criteria: COSO Principles 16 and 17 address monitoring activities and the communication of internal control deficiencies to responsible parties.
Cause: Management had not assigned clear responsibility for maintaining a centralized deficiency tracking process or established formal escalation requirements.
Effect: Significant control weaknesses could remain unresolved, increasing the risk that financial reporting errors or other control failures would not be prevented or detected promptly.
Management Action Plan: Management will establish a formal deficiency tracking and escalation process, assign responsible owners, establish remediation deadlines, and provide periodic status reports to appropriate governance personnel.
The auditor should support the finding with sufficient evidence and avoid assigning a severity classification without evaluating the applicable criteria.
30. How Should Auditors Rate Entity-Level Control Deficiencies?
Not every entity-level control deficiency represents a material weakness.
For internal auditors, findings may be classified using an organization's established risk-rating methodology.
Factors may include:
The significance of the risk.
The likelihood of a control failure.
The potential financial or operational impact.
The pervasiveness of the deficiency.
The effectiveness of compensating controls.
The possibility of management override.
The consequences for governance and regulatory compliance.
For auditors evaluating ICFR under PCAOB standards, deficiencies must be assessed using the applicable definitions and requirements for control deficiencies, significant deficiencies, and material weaknesses.
The evaluation includes whether there is a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis.
A governance weakness can be serious without automatically meeting the definition of a material weakness.
Auditors should avoid using these terms interchangeably.
31. A Practical Entity-Level Controls Audit Program
A comprehensive entity-level controls engagement can be organized into the following phases.
Phase 1: Understand the organization
Review the organizational structure, business model, significant risks, governance arrangements, and regulatory environment.
Phase 2: Identify relevant control objectives
Map the organization's control objectives to the COSO components and relevant principles.
Phase 3: Identify key entity-level controls
Document the controls management has established to address significant risks.
Phase 4: Evaluate control design
Determine whether the controls are capable of addressing the identified risks.
Phase 5: Test operating effectiveness
Obtain evidence that the controls operated as intended during the period under review.
Phase 6: Evaluate control precision
Determine whether management review and monitoring controls operate at a level sufficient to address their intended risks.
Phase 7: Evaluate deficiencies
Assess identified deficiencies individually and in combination, including their potential pervasive effects.
Phase 8: Report results
Communicate supported findings, their significance, and appropriate recommendations.
Phase 9: Monitor corrective actions
Determine whether management has implemented effective remediation.
This approach should be tailored to the engagement's objectives and the organization's circumstances.
32. Entity-Level Controls Audit Checklist
Before concluding an engagement, auditors should be able to answer the following questions:
Audit area | Key evaluation question |
Ethics | Does management demonstrate and enforce integrity and ethical values? |
Governance | Does the Board provide effective independent oversight? |
Authority | Are responsibilities and approval authorities clearly established? |
Competence | Do control owners possess appropriate skills? |
Accountability | Are control responsibilities and deficiencies actively managed? |
Risk assessment | Does management identify and evaluate significant risks? |
Fraud | Does management consider fraud and management override? |
Change | Are significant business changes incorporated into risk assessments? |
Control activities | Are relevant organization-wide controls appropriately designed? |
Technology | Are significant technology risks governed and controlled? |
Policies | Are control requirements communicated and enforced? |
Information | Is management information reliable and appropriate? |
Communication | Are significant risks communicated promptly? |
Monitoring | Does management evaluate control effectiveness? |
Remediation | Are deficiencies corrected and independently followed up? |
Financial reporting | Are significant financial reporting processes controlled? |
Precision | Can relevant controls detect the errors they are intended to address? |
Evidence | Is there sufficient evidence that controls operated? |
The checklist is a planning and evaluation aid, not a substitute for a risk-based audit program.
33. Using Artificial Intelligence to Audit Entity-Level Controls
AI can help auditors organize large volumes of governance and control documentation.
Potential applications include reviewing Board and Audit Committee materials, comparing policies with COSO principles, identifying gaps in risk assessments, analyzing deficiency trends, and evaluating draft audit findings.
Example: COSO control mapping
Review this organization's documented entity-level controls and map them to the five COSO components and 17 principles. Identify potential gaps and distinguish documented controls from controls whose operating effectiveness has not been established.
Example: Audit Committee oversight
Review these Audit Committee agendas and minutes. Identify evidence of oversight of financial reporting, significant risks, Internal Audit findings, and management remediation. Highlight matters requiring additional audit evidence.
Example: Management review controls
Evaluate this management review control description. Identify the risk addressed, information used, review frequency, precision, investigation thresholds, evidence of follow-up, and potential design deficiencies.
Example: Deficiency analysis
Analyze these validated internal control findings and identify recurring root causes, common control owners, overdue corrective actions, and potential entity-level themes.
AI can help identify areas requiring attention.
However, auditors must validate outputs against source documentation and protect confidential information.
AI-generated assessments do not establish the design or operating effectiveness of entity-level controls.
34. Management Owns Entity-Level Controls
One of the most important principles of corporate governance is that management owns the internal control framework.
The Board provides oversight.
Management establishes and operates controls.
Internal Audit provides independent assurance.
External Audit evaluates controls to the extent required by the engagement and applicable auditing standards.
These responsibilities should not be confused.
A CFO should not wait for Internal Audit to identify weaknesses in financial reporting controls.
A CEO should not wait for the Board to discover significant operating risks.
Management should proactively assess risks, establish controls, monitor effectiveness, identify deficiencies, and implement corrective actions.
The Audit Committee should evaluate whether management is fulfilling those responsibilities.
An effective entity-level control environment requires management to take ownership of internal control rather than treating it as an Internal Audit project.
35. Ten Questions Every Audit Committee Should Ask About Entity-Level Controls
Has management established a documented internal control framework?
Does management perform a comprehensive risk assessment, including fraud risks?
Are significant financial reporting controls clearly assigned to responsible individuals?
How does management identify and monitor control deficiencies?
What controls prevent or detect inappropriate management override?
Does the Audit Committee receive timely information about significant risks?
Are management review controls supported by reliable information?
Are significant accounting estimates and financial reporting judgments independently reviewed?
Does Internal Audit provide objective assurance over governance and control processes?
How does management demonstrate that corrective actions have been implemented and are effective?
The answers should be supported by evidence.
General assurances that "management has everything under control" are not a substitute for effective governance.
Conclusion: Entity-Level Controls Determine the Strength of the Entire Internal Control Framework
Entity-level controls establish the foundation for effective governance, risk management, financial reporting, and organizational accountability.
They influence whether management identifies risks, employees follow policies, significant issues reach the Board, and internal control deficiencies are corrected.
An organization may have extensive transaction-level controls but still experience serious failures when its control environment is weak.
For auditors, evaluating entity-level controls requires more than reviewing policies and interviewing management.
It requires examining actual governance activities, evaluating control design, testing operating effectiveness, assessing management review precision, and determining whether significant deficiencies are appropriately communicated and remediated.
The COSO framework provides the structure.
PCAOB AS 2201 provides important guidance for company-level controls in ICFR audits.
The IIA Global Internal Audit Standards support a disciplined, risk-based approach to evaluating governance, risk management, and controls.
Ultimately, the most important question is not whether the organization has documented entity-level controls.
It is whether management can demonstrate that those controls are effectively governing the organization, identifying significant risks, preventing or detecting control failures, and supporting reliable financial reporting.
That is the standard auditors should strive to evaluate.
Strengthen Your Entity-Level Controls Auditing Skills With Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides professional CPE training focused on the practical skills auditors need to evaluate internal controls, governance, financial reporting, and organizational risk.
Our programs address the COSO Internal Control–Integrated Framework, PCAOB auditing standards, the IIA Global Internal Audit Standards, management review controls, audit evidence, fraud risk assessment, and internal control testing.
Recommended CCS Training Areas
COSO Internal Control–Integrated Framework
Learn how to evaluate the five COSO components, 17 principles, and the effectiveness of internal controls.
Testing the Design and Operating Effectiveness of Internal Controls
Develop practical procedures for evaluating control design, operating effectiveness, evidence, and deficiencies.
PCAOB AS 2201 — Auditing Internal Control Over Financial Reporting
Understand company-level controls, management review controls, control precision, and the evaluation of ICFR deficiencies.
Internal Auditing and the Global Internal Audit Standards
Learn how to evaluate governance, risk management, and internal controls using a risk-based methodology.
Audit Committee Responsibilities and Corporate Governance
Examine management accountability, independent oversight, financial reporting governance, and control deficiency monitoring.
Artificial Intelligence for Auditors
Explore how AI can assist with COSO control mapping, risk assessments, document review, control evaluation, and audit reporting.
Explore Upcoming CPE Events
Visit Corporate Compliance Seminars to review available training programs, live webinars, and in-person events.
Effective entity-level controls create the foundation for effective auditing, reliable financial reporting, and responsible corporate governance.
Corporate Compliance Seminars — Professional CPE Training in Internal Auditing, PCAOB Standards, COSO, Corporate Governance, Risk Management, and Internal Controls.
Comments