Direct Entity Level Controls vs. Key Controls 2127
-
Could someone please compare and contrast Key Controls vs. Direct Entity Level Controls? Theoretically, key controls could happen at a transaction level, while Direct ELCs are more at a high level. I just have a difficult time coming up with DIRECT ELCs. Based on the definition, wouldn’t it basically have to be some detail-level reviews done by senior management?
How is your organization leveraging these two types of controls in your 2007 SOX efforts?
Some contrasting examples of the 2 would be appreciated. Thank you.
-
There is not a one-size-fits-all answer as to direct entity-level controls.
A good example of a direct entity-level control is a month-end close (pre-close) meeting where financial results are reviewed with management at a level of detail where mis-statements could be identified and corrected. This generally will not apply to all accounts, as the level of detail necessary to analyze information will differ by account.
For example, in a company where overhead costs are fairly consistent month-to-month, a month-end meeting could generally be relied upon to provide a reasonable control over those costs if the results are reviewed versus run rates and/or budget by major expense type (salaries, rent, utilities, T-and-E, etc.) and significant variances explained. This may allow you to significantly scale back or eliminate testing of transaction-level controls over some or all of those expenses. Another control potentially covered in a month-end meeting may be a review of days sales in inventory in an environment where inventory goes stale and mus turn over quickly. This should allow you to not have to do much additional test work over cost of sales on the income statement. It would not, in my opinion, replace controls over inventory valuation (price and quantity controls).
The key to using a direct company-level control to replace lower level controls is the level of detail at which a financial statement item requires review to ensure that it is stated fairly and accurately and the level of detail covered in the month-end meeting with management.
I see the direct company-level-controls more effective in reviewing income statement items than in providing controls over balance sheet items where you always need to have account reconciliations performed timely and accurately.
Partly related to this, we recently met with a big 4 auditor to discuss our approach to controls identification and identify areas for efficiency in our approach. A couple of comments around key controls that came out of that discussion that caught my attention were these -
One of the best controls is the use of a close calendar to ensure that everything that needs to be done as part of a close process is scheduled and completed.
The use of close checklists where staff must sign off as they complete their month-end tasks has a high correlation with the tasks being completed in a timely and accurate manner. In other words, when people know that they are being held accountable for the timeliness and accuracy of their work, they perform better and execute their controls better.
-
So key controls are not mutually exclusive from DELCs, right? In fact, would you say ELCS (direct or not) are a subset of key controls?
Thank you.
-
So key controls are not mutually exclusive from DELCs, right? In fact, would you say ELCS (direct or not) are a subset of key controls?
Thank you.
Not all ELCs are necessarily key. Most DELCs would be considered key in order to reduce identification and testing of lower-level controls. Key controls will include other than DELCs as well. Therefore, DELCs are generally a subset of key controls.