Control - Manager reviewing a report for 'reasonableness' 1454



  • Hello%0AA control description states that a manager reviews report ‘x’ for reasonableness but does not state the basis for reasonableness. Discussions with the reviewer indicates that apart from a fleeting comparison with prior periods he relies on ‘gut instinct’ to spot an error that would lead to a material misstatement.%0ANow my opinion is that the control is therefore not well designed. Shouldn’t there be a documented level of expectation? e.g if balance varies from prior period by more than x% then that balance is investigated; or reviewer reperforms (a sample of) backing documentation to arrive at the same balance and if that balance is not reached then further investigation is carried out?%0AHow would you suggest that a manager reviews say a profit and loss account for ‘reasonableness’?



  • Hi,
    Your question and concern is thought-provoking. How does one assess management review for control design effectiveness?
    I offer the following:

    • If the reviewer is of sufficient capability, I do not concur that a high level review for overall reasonablenss that is not described in detail is unacceptable or necessarily leads to the control not being designed effectively.
      For example, if the CFO reviews the period end FS and the report compares the information to prior period results, it might not be necessary to state the basis for reasonableness. This seems to be more of an auditor judgment issue and should be appropriately assessed in conjunction with assessment of the other ICFR for design effectiveness.
    • I agree that when possible, it is preferable to quantify the criteria used to determine if financial information contains a material mistatement. For example, if the balance in Account 123 in the income statement differs from the previous period by USD123, then further investigation is required. The amount that requires additional follow-up is determined from consideration of materiality for financial reporting purposes during the SOX planning phase.
      However, it should also be noted that a variance of less than the threshold amount might still warrant further investigation if in the aggregate, other significant differences in total may lead to material mistatement in the FS. This is where auditor judgment is necessary.
      In short, in my opinion, I do not believe that a standard approach can be used to assess design effectiveness given the variation in management capabilities, business models, etc. However, it is always preferable to measure and quantify when possible and practical.
      An example of Analytical Requirements:
      'Compile and review an Income Statement Trend Report and a Balance Sheet Trend Report to compare the current month to the last # months on a line-by-line basis.
      If large variances exist, determine:
    • if the variance is explainable
    • if a reclass between line items should be made
    • if an accrual was not made, if an overstatement/understatement exists and the materiality of the difference.’
      If I locate other Analytical Guidelines, I’ll post further.
      Hope this helps,
      Milan


  • Thanks Milan. That makes sense. I suppose in the example you cited for the CFO the basis of reasonableness could be purely his experience in the field or on the job.
    Your thoughts are much appreciated.



  • … for the CFO the basis of reasonableness could be purely his experience in the field or on the job.
    Could be ‘his/her’…a lot of sharp/experienced women CFOs out there.
    Cheers,
    Milan



  • Hi Mocha,
    Please write back with your email and I can send you some discussion items on use of analytical procedures and documentation requirements.
    I will not post here or forward to others since I do not know the source of the materials.
    Milan



  • It is funny that I saw this post, when I was about to post a question about management review.
    Ours is a mid-size company, so we do not have a large accounting staff. The Controller who has been here for 10 years (the company has been public since 2002), is very hands-on, and can just look at the various reports/reconciliations and figure out if there are unusual items, unreasonable items etc. She does not really have any ‘threshold’. So, it is really difficult for us to document the extent of her review. This is our year 2 of SOX, and for the first year, when I was not working here, KPMG, our external auditors had assessed this as a general documentation deficiency for all processes.
    This year, I expanded the language on the review controls. For example, for journal entries, we have a control: ‘Journal entries are reviewed and signed off by the Controller before they are entered into the accounting system.’ I have expanded the language to say that she confirms that the entries look correct, there are no obvious misakes, and all necessary journal entries are included. I had planned to include additional information in the testing, in addition to testing that the journal entries are signed off by the Controller, inquire if she looked at the account #s, amounts etc, and corroborate this with one of the accoutning staff, if this is what she looks at. KPMG wants all this mentioned in the process flow documentation in the control languauge itself.
    I have worked with PwC before, and also from management side at one of PwC’s clients, and we didnot expect such detail in the process flow.
    I wanted to know what is the experience of other companies, especially, KPMG clients about this documentation.
    Thanks,
    SP



  • Hi Mocha - I agree with the good points Milan has made 🙂 … Just to add a few thoughts:

    1. Judgement calls where the underlying goal is ‘reasonableness’ are always subject to interpretation and would certainly vary from company to company (e.g., it’s more of art than science)
    2. However, you can still view this like writing performance objectives for the employees for the year ahead. You want these reviews to be specific and measureable .
    3. In thinking about the review a profit and loss account, you want to establish specific goals for reviewing the accuracy and quality of data .
    4. This includes:
      – a check of the reconciliation process with source systems
      – documenting the approach and findings
      – reviewing all audit trails
      – sampling the balancing process
      – setting timeliness standards for completion
      In other words, you’ve got to do more than look a total number and guess whether it’s reasonable or not.


  • Interesting replies. I guess my concern was also to do with testing. How do you test the control when the basis is purely someone’s experience and gut instinct. This has been addressed partly by harrywalden. Thanks for that.
    Milan, my email address is hawkinge_babe_at_yahoo.com 🙂



  • To add my tuppence worth:

    1. You have to be careful with ‘reasonableness reviews’ in terms of what risks you are mapping them to. If that review is relatively cursory it may not be sufficiently well designed to meet some risks. You do need to consider what level of error that the control mayr easonably be expected to prevent or detect.
    2. Management review, in general, can benefit from a more formalised description of the control. Not least because a manager may not carry out all the checks that they intended due to time pressure or just forgetting a component. However, in my experience, this can almost always be adressed by giving consideration to the evidencing of the control e.g. developing a month-end checklist for the controller, one of the tasks being to review report x for a, b and c.


  • Hi Mocha - I made some editorial changes to my original post and this might read a little better.
    As a bottom line, Reasonableness checking can’t be on assumptions or best guesses, but it’s going to take some digging into the numbers and checking other systems that feed into the process to ensure there’s quality in the #'s. As Denis wisely shares the responsible areas might need some complementary help on this as well.
    Good luck on this 🙂



  • If the only review of the financials is that of the CFO or Controller and there are no steps in the review to verify the validity of the numbers, then I would say that the control design is not effective.
    However, if multiple clerks prepare account reconciliations that are reviewed in detail by their supervisors, who, in turn prepare financial statements that are reviewed by their managers prior to submission to the Controller or CFO for a final review, then one might concur that the cursory review for reasonableness by the Controller or CFO is adequate.
    In isolation, it is hard to draw a conclusion as to the effectiveness of any one control. Taken in context with other controls, it is much easier.



  • following on from Kymike - as our company has lots of ‘lower level’ controls on journals, postings etc once it reaches the CFO he just ‘reviews for reasonableness’
    We have ended up providing a checklist for all the parts he reviews each month/quarter/year to ‘prove’ he does the review.
    Frankly this is to keep the externals happy … - as they know he does the review - internally seems a bit of a farce and is going back to the bad old days of producing paperwork for the sake of it… 8O
    keep plugging away.
    Andrew



  • Hi Mocha,
    Please write back with your email and I can send you some discussion items on use of analytical procedures and documentation requirements.
    I will not post here or forward to others since I do not know the source of the materials.
    Milan
    Hi Milan
    Sorry to be a bother but I haven’t received the info on analytical procedures and documentation requirements? the email address again is hawkinge_babe_at_yahoo.com Please note there is an underscore between the hawkinge and the babe.
    Much appreciated
    Mocha



  • If the only review of the financials is that of the CFO or Controller and there are no steps in the review to verify the validity of the numbers, then I would say that the control design is not effective.
    However, if multiple clerks prepare account reconciliations that are reviewed in detail by their supervisors, who, in turn prepare financial statements that are reviewed by their managers prior to submission to the Controller or CFO for a final review, then one might concur that the cursory review for reasonableness by the Controller or CFO is adequate.
    In isolation, it is hard to draw a conclusion as to the effectiveness of any one control. Taken in context with other controls, it is much easier.
    Hi Kymike
    In this case which would you consider to be the ‘key’ control? I would have thought the review by managers prior to submission to the Controller or CFO and not the CFO’s review. What do you think?



  • In general, I would think that the review of the financials by the managers would be considered more of a key control than that of the CFO. They are closer to the day-to-day transactions than the CFO or Controller would be and generally will review the financials in more detail than would the Controller or CFO. In general, you look for evidence of manager reviews at the account reconciliation or transaction levels.
    The review by the Controller or CFO is generally more important related to the thoroughness of the financials as they may be aware of events that have occurred, but possibly have not been recorded (i.e., decisions to close/sell certain locations leading to impairment charges, settlements of lawsuits, severance agreements, etc.) that are generally confidential in nature up to a certain point before being communicated to the accounting team to record. They also generally look at the financials from a big picture perspective and will question trends in the business which the managers will have to explain as they are closer to the accounting details. These types of reviews generally take place in monthly or quarterly close meetings where the managers will present results to the Controller or CFO and discuss unusual transactions, accounting issues or variances to forecast or prior year. I would suggest that these types of reviews by the Controller or CFO be documented by retaining a meeting calendar for the year (these are generally regularly-scheduled meetings), meeting agendas or presentation decks and a list of invitees or attendees (generally available by keeping the email invites). Trying to document these controls via meeting minutes (quite often not kept) or initials on presentations to evidence reviews is generally cumbersome, especially for a high-level control. I look at this as a communication type of control that is part of entity-level controls.



  • Hi Mocha,
    I apologize but I just saw your earlier message with your e-mail address and request. I forwarded the information requested to the email address noted in your earlier message.
    The guidance provides additional clarity on auditor documentation requirements when analytical procedures are performed during the planning, testing, and reporting phases of an audit.
    Although the guidance applies to analytical procedures conducted in an external audit of the FS, the material should be helpful and addresses the overall documentation requirements and consideration of judgmental factors such as management reviews.
    Regards,
    Milan



  • Got it, Milan. Thanks so much for that. It will be v useful.


Log in to reply