All 18 Internal Controls Evaluation questions
More in Internal Controls Evaluation
What are entity-level controls versus process-level (transaction) controls? What is the difference between manual and automated controls? When does the auditor decide to test controls versus take a fully substantive approach? How do you document the understanding of internal controls? What is the difference between a deficiency, a significant deficiency, and a material weakness? What are IT general controls (ITGCs) and why do they matter? How does management override of controls create risk, and how do auditors address it? How do you evaluate controls in a system that uses a service organization (SOC reports)? What is the auditor's responsibility for reporting internal control deficiencies?
Advertisement
Back to results for “Fraud & Error Responsibilities”
Auditing & Assurance › Internal Controls Evaluation

What are compensating controls and how do they affect the audit?

Intermediate

Answer

Compensating controls are alternative controls that reduce the risk from a deficiency in another control—e.g., where segregation of duties is impossible in a small entity, a detailed independent management review compensates. Auditors consider whether compensating controls adequately mitigate the risk before concluding a deficiency is significant or a material weakness.
Real-world example In a small firm lacking segregation, the owner's detailed review of all payments serves as a compensating control.

Common follow-ups: When are compensating controls relevant? | Can they mitigate a significant deficiency?

Audit Risk & Materiality Fraud & Error Responsibilities Internal Controls Evaluation
All 18 Internal Controls Evaluation questions