Connect Support Advance

White Paper

Control
Assessment: A
Framework
Updated 2023

Level 5, 580 George Street, Sydney NSW 2000 | PO Box A2311, Sydney South NSW 1235
T +61 2 9267 9155 F +61 2 9264 9240 E [email protected] www.iia.org.au

© 2022 - The Institute of Internal Auditors - Australia

 Control Assessment:
A Framework
Contents Background

Background 2 A control is any action taken by management to enhance

the likelihood that objectives will be achieved. A control
- Purpose 2
is intended to manage risk. Controls can be classified in
- Background 2
many ways. These classifications help us understand the
Discussion 3 nature and purpose of the control.
- Adequate Control 3
Controls may be:
- Reasonable Assurance 3
› Preventive – to deter undesirable events from
- Control Framework 3
occurring.
- Assessment Model 4
- Documentation 4 › Detective/Corrective – to detect and correct
undesirable events that have happened.
Conclusion 5
- How to proceed 5 › Directive – to cause or encourage a desirable event
to occur.
- Summary 5
- Conclusion 5 Controls may be ‘hard controls’ or ‘soft controls’:
Bibliography 5 › Hard controls are formal controls such as policies and
Acknowledgement 5 procedures, reconciliations of accounting records,
Purpose of White Papers 5 management sign-offs, a documented business plan,
Author’s Biography 5 written code of conduct, separation of duties, and
safety procedures.
About the Institute of Internal Auditors–Australia 6
Copyright 6 › Soft controls are informal and include competency,
knowledge and understanding of employees, ethical
Disclaimer 6
behaviour of management and staff, relationship
Background building, and employee understanding of procedures.
Purpose Soft controls are more difficult to audit than hard controls
Internal auditors are frequently called upon to assess because generally there are no clear and definitive
whether a set of controls is ‘adequate’ to address risk. methods of testing them.
This is a process that requires considerable professional Controls may be:
judgement, but there is little literature available to assist
› Automated – technological controls that are designed
the internal auditor in making this assessment.
to function in a specific way under predetermined
This judgement is an early, critical, decision point in the conditions.
internal audit process. Getting the assessment wrong can
› Manual – controls that require the intervention of a
lead to non-achievement of audit objectives and wasted
person or group of people.
resources.
To manage risks, organisations apply both controls that
This White Paper outlines a structured approach to
typically fall into three layers:
analysis of individual controls against relevant risks, and
points to a way that the auditor can make the necessary › Systems and processes.
assessment.
› Capability.
The same process can be applied in assessing whether a
› Culture – leadership, behaviour, attitudes.
proposed control will address an identified gap.

© 2023 - The Institute of Internal Auditors - Australia 2

 Control Assessment:
A Framework
Discussion Reasonable Assurance

In this context, a control system is ‘adequate’ if: According to Committee of Sponsoring Organizations
(COSO):
“…. management has planned and organized (designed)
in a manner that provides reasonable assurance that “The term ‘reasonable assurance’ rather than ‘absolute
the organization’s risks have been managed effectively assurance’ acknowledges that limitations exist in all
and that the organization’s goals and objectives will be systems of internal control, and that uncertainties
achieved efficiently and economically”. and risks may exist, which no one can confidently
predict with precision. Absolute assurance is not
Source: Glossary to the ‘International Professional Practices possible. Reasonable assurance does not imply that an
Framework’, IIA–Global. organisation will always achieve its objectives”.

Adequacy of design is a different issue from effectiveness Source: Committee of Sponsoring Organizations, 2013.
of operation. A test of adequacy makes no comment on The question that is not addressed is: what does
whether the control is operating as intended. ‘reasonable’ mean? Dictionary meanings include: ‘fair and
Internal auditors are obliged by Standard 2320 (Analysis sensible’ or ‘as much as is appropriate’. These definitions
and Evaluation) to “base conclusions and engagement do not help much, because they rely on the meaning of
results on appropriate analyses and evaluations”. ‘appropriate’: suitable or proper in the circumstances.

This approach provides the internal auditor with a In other words, what is reasonable is a matter of judgment.
framework for making the necessary analyses and To make the judgement, one must ask: how much does the
evaluations. objective matter? Controls that affect life or safety must be
stronger than controls that manage a small inventory.
Adequate Control
The auditor must decide for themselves how much control
Looking closer at the definition of adequate, we note a
provides reasonable assurance. This is a decision that
number of phrases:
requires conscious thought.
› ‘Control system’ – The definition applies to groups of
Control Framework
controls: not to individual controls. While it is possible
that a single control may form an adequate control COSO (Committee of Sponsoring Organizations, 2013)
system, it is highly unlikely. has provided a useful control framework that teaches us
that controls are always in relation to a risk, and that risk
› ‘Planned and organised’ – The statement is about the
is always in relation to objectives in the context of the
design of the control system: not about its operation. A
organisation. Controls exist in a framework that has five
control does not necessarily have the intended effect
components:
and any effect must be verified by testing.
1. Control Environment – the set of standards, processes,
› ‘Reasonable assurance – Controls are designed to
and structures that provide the basis for carrying out
reduce uncertainty (variation) in performance but they
internal control across the organisation.
cannot eliminate it.
2. Risk Assessment – a dynamic and iterative process
› ‘Efficiently and economically’ – This implies that
for identifying and analysing risks associated with the
inefficient control – even if effective – is not adequate.
organisation’s objectives.
Recognising that risk is only an expression of the
3. Control Activities – actions established by policies
uncertainty organisations face in achieving objectives,
and procedures to help ensure that risks to the
control systems, too, are focused on objectives. An
achievement of objectives are managed.
adequate control system promotes the achievement of
objectives by managing specific risks. 4. Information and Communication – information is
necessary for the organisation to carry out internal

© 2023 - The Institute of Internal Auditors - Australia 3

 Control Assessment:
A Framework
control responsibilities in support of its objectives. 4 Reactivity Does the control operate quickly enough to
Communication provides the organisation with the minimise adverse consequences?

information needed to carry out day-to-day controls; A control intended to limit the effects of, or take
it enables personnel to understand internal control advantage of, an event, must operate at an
appropriate speed. If the action is too late, it is
responsibilities and their importance. ineffective.
5 Resource Does the organisation have the competence or
5. Monitoring Activities – monitoring activities ascertain availability resources to operate the control? Is it an addi-
whether each of the five components of internal tional piece of work for an already busy person?
control is present and functioning. These are design questions with a direct perfor-
mance implication. Some controls are intrinsi-
This model makes it clear that control design is not only cally complex and require expertise to perform
about so-called hard controls – processes and procedures correctly. Giving the responsibility to a person
without that expertise reduces or eliminates the
– but also encompasses soft controls such as competency, value of the control. Similarly, if an individual,
or group of individuals, is given too much to
ethics, and internal discipline and culture. It is also clear
do, they will set priorities that may eliminate or
that procedures to monitor the performance of controls are reduce the control’s operation.
a necessary part of the control design. 6 Exception Is the operation of the control monitored and
analysis analysed? What happens to rejected items?
Assessment Model
There should be a mechanism in place to
In the assessment model, control design is assessed manage unusual circumstances. There might be
performance reports that help the organisation
against six independent characteristics, and in relation to detect changes in risk profile.
specific objectives and their associated risks.
It is unlikely a single control will meet all the
No. Factor Description characteristics when considered in relation to a particular
1 Relevance Does the proposed control address a risk that risk. Consequently, it is usual to use a combination of
matters? Does the listed control actually
address the risk that it is listed against?
controls. For example, reconciliations are put in place to
detect when other accounting controls, that depend on
The control may be valuable for other reasons,
but it is not contributing to the control of the
the activities of individuals, have not operated correctly.
specified risk(s). It does not therefore contribute Similarly, audible alarms are used to alert people should a
to the adequacy of the control system in the
process under consideration. security door be left open.
2 Coverage Does the proposed control address part of a risk, This assessment framework still relies on the judgement
all of a risk, or a number of risks?
of the auditor. It provides the auditor with a mechanism
Where a control is addressing only part of a risk, to formally consider each aspect of control design, and
it may be best to restructure the risk so that the
part where the control is function is separate provides a basis for making the assessment of whether a
from the rest. It is quite common for a particular
control to address more than one risk and this,
control system is adequate.
when possible, can have cost advantages.
Documentation
3 Strength/ Will the control work every time – is it inde-
Reliability pendent of the process, is it automated, does it You may consider documenting your assessment of
prevent an issue, correct an issue or just identify
an issue? controls in the following manner:

A preventive control is clearly preferable, but is

not always possible. A detective control always Risk Control Control Analysis Test
Control?
requires some response mechanism. Automated
controls always perform as constructed – this Relevance Coverage Strength Reactivity Resource Exception Y/N
may be desirable if the construction is sound, but
some circumstances may require human judge- xxx xxx Yes Full Strong Sufficient No Yes Yes
ment and this aspect should not be ignored.
xxx Yes Full Weak Fast Yes Yes Yes

This documentation will help you to decide whether

particular controls should be tested. Clearly there is only
limited value in testing the operation of controls that have
been assessed as not being adequate.

© 2023 - The Institute of Internal Auditors - Australia 4

 Control Assessment:
A Framework
This formal approach and associate documentation Conference in Kuala Lumpur in 2011. The Poste Italiane
will also assist in determining what additional control is framework has been more fully developed in an IIA
needed. Research Foundation publication (Dittmeier & Casati, 2014).

Conclusion References

How to proceed Committee of Sponsoring Organizations. (2013, May).

Internal Control - Integrated Framework. COSO. Retrieved
This technique can be integrated with your existing service
from https://www.coso.org/Shared%20Documents/
offerings.
Framework-Executive-Summary.pdf
› In reviews of existing systems or processes, the
Dittmeier, C., & Casati, P. (2014). Evaluating Internal
technique may be used to consider the control design
Control Systems: A Comprehensive Assessment Model
before testing is undertaken. Testing can be focused
for Enterprise Risk Management. Altamonte Springs FL,
on those controls that are most important in the
United States of America: The Institute of Internal Auditors
context of the review.
Research Foundation.
› Similarly, in the review of proposed systems, the
Institute of Internal Auditors. (2016, October). International
control design may be formally assessed against the
Standards for the Professional Practice of Internal Auditing.
system risks. The decision about adequacy can be
(IIASB, Ed.) Retrieved from The Institute of Internal Auditors
based on structured analysis.
- Global: https://www.theiia.org/en/standards/what-are-the-
› It may be used in the development of new controls standards/mandatory-guidance/standards/
– when developing recommendations or when
Purpose of White Papers
advising on new activities – by choosing controls with
appropriate characteristics. A White Paper is a report authored and peer reviewed
by experienced practitioners to provide guidance on a
Summary
particular subject related to governance, risk management
This White Paper outlines a structured approach to or control. It seeks to inform readers about an issue and
analysis of individual controls against relevant risks, and present ideas and options on how it might be managed. It
points to a way that the auditor can make the necessary does not necessarily represent the position or philosophy
assessment. of the Institute of Internal Auditors–Global and the Institute
The same process can be applied in assessing whether a of Internal Auditors–Australia.
proposed control will address an identified gap. Author’s Biography
Conclusion Written by: Michael Parkinson
By assessing internal controls, whether in place or BSc (Hons), GradDipComputing, PFIIA CIA, CISA, CRMA,
proposed, against the six characteristics in this framework, CRISC
the internal auditor is taking a structured approach to Michael is an internal auditor and risk management
analysis and evaluation of the controls. consultant in private practice. He has more than 40
This will facilitate collection of necessary evidence, and years of experience in a range of government and
assist in answering the question of whether controls are, or non-government environments. He has been active
can be made, ‘adequate’. in the development of risk management and internal
auditing standards and guidance for more than 15 years.
Bibliography and References Michael has practiced in Australia and South-East Asia,
Acknowledgement and currently serves on a number of Audit and Risk
Management Committees.
This approach is based upon a framework developed
by Poste Italiane, and presented to the IIA International Michael has been the recipient of the IIA–Australia Bob
McDonald Award and the IIA–Global Victor Z Brink Award

© 2023 - The Institute of Internal Auditors - Australia 5

 Control Assessment:
A Framework
for services to the profession of internal auditing. Copyright
Edited by: Andrew Cox This White Paper contains a variety of copyright material.
MBA, MEC, GradDipSc, GradCertPA, DipBusAdmin, Some of this is the intellectual property of the author, some
DipPubAdmin, AssDipAcctg, CertSQM, PFIIA, CIA, CISA, is owned by the Institute of Internal Auditors–Global or the
CFE, CGAP, CSQA, MACS Snr, MRMIA  Institute of Internal Auditors–Australia. Some material is
owned by others which is shown through attribution and
About the Institute of Internal Auditors– referencing. Some material is in the public domain. Except
Australia for material which is unambiguously and unarguably in
the public domain, only material owned by the Institute
The Institute of Internal Auditors (IIA) is the global of Internal Auditors–Global and the Institute of Internal
professional association for Internal Auditors, with global Auditors–Australia, and so indicated, may be copied,
headquarters in the USA and affiliated Institutes and provided that textual and graphical content are not
Chapters throughout the world including Australia. altered and the source is acknowledged. The Institute of
As the chief advocate of the Internal Audit profession, Internal Auditors–Australia reserves the right to revoke
the IIA serves as the profession’s international standard- that permission at any time. Permission is not given for any
setter, sole provider of globally accepted internal auditing commercial use or sale of the material.
certifications, and principal researcher and educator. Disclaimer
The IIA sets the bar for Internal Audit integrity and Whilst the Institute of Internal Auditors–Australia has
professionalism around the world with its ‘International attempted to ensure the information in this White Paper is
Professional Practices Framework’ (IPPF), a collection of as accurate as possible, the information is for personal and
guidance that includes the ‘International Standards for the educational use only, and is provided in good faith without
Professional Practice of Internal Auditing’ and the ‘Code of any express or implied warranty. There is no guarantee
Ethics’. given to the accuracy or currency of information contained
The IIA-Australia ensures its members and the profession in this White Paper. The Institute of Internal Auditors–
as a whole are well-represented with decision-makers and Australia does not accept responsibility for any loss or
influencers, and is extensively represented on a number damage occasioned by use of the information contained in
of global committees and prominent working groups in this White Paper.
Australia and internationally.

The IIA was established in 1941 and now has more than
200,000 members from 190 countries with hundreds of
local area Chapters. Generally, members work in internal
auditing, risk management, governance, internal control,
information technology audit, education, and security.

Historians have traced the roots of internal auditing to

centuries BC, as merchants verified receipts for grain
brought to market. The real growth of the profession
occurred in the 19th and 20th centuries with the expansion
of corporate business. Demand grew for systems of control
in companies conducting operations in many locations
and employing thousands of people. Many people
associate the genesis of modern internal auditing with the
establishment of the Institute of Internal Auditors.

© 2023 - The Institute of Internal Auditors - Australia 6