The Auditor’s Viewpoint
Once engaged, your auditors will spend a large amount of time and effort scoping out and assessing risk for all of the areas that feed into the financial statements. Once planning is complete, they will perform substantive detailed testing* and control-specific testing to ensure that your processes are tight.
Are there controls in place to ensure that the financial statements are materially correct? How did the team performing these controls ensure completeness and accuracy over the reports and spreadsheets used in the process? Is the process repeatable and documented so that anyone performing the associated controls will follow the same steps?
These are the core questions that the audit team will ask themselves when determining how to audit the process and where to (try to) poke holes.
Preventive controls are the best, but detective controls can also catch errors, so marrying the two to round out your control environment is essential.
Your Control Environment
When developing a control environment, keeping your audit in mind is critical. The audit team should feel comfortable that the control environment is robust enough to catch errors that could produce a material misstatement. Preventive controls are the best, but detective controls can also catch errors, so marrying the two to round out your control environment is essential.
Here, we will focus on pain points that come up specifically as it relates to the revenue process control environment and audit.
Industry best practices for data integrity and completeness include some automated controls such as system change management controls, but still mostly rely on the manual matching of data from multiple sources.