What are Entity-Level Controls?
Entity-level controls are controls that operate across the whole organization rather than within a single process or transaction, and they are the starting point of a top-down ICFR assessment.
- Entity-level controls operate across the whole organization and set the foundation for process-level and transaction-level controls.
- PCAOB AS 2201 lists eight categories, from the control environment and management override to period-end reporting, and tells the auditor to test them first.
- Precision decides their weight: an indirect control shapes the audit approach, while a precise monitoring control can address a risk on its own.
- Evidence is mostly annual: codes of conduct, board and audit committee minutes, the fraud risk assessment and the certification process.
- SmartSuite SOX Management holds entity-level controls in the same library as process controls, tagged by COSO component and principle.
What are Entity-Level Controls?
Entity-level controls are controls that operate across the whole organization rather than within a single process or transaction, setting the foundation for the process-level and transaction-level controls beneath them.
PCAOB AS 2201 (paragraphs 22 to 24) tells the auditor to test entity-level controls first, because they can affect the conclusion about whether an effective system of internal control exists. It lists controls related to the control environment, controls over management override, the company's risk assessment process, centralized processing and shared services, controls to monitor results of operations, controls to monitor other controls (internal audit, the audit committee, self-assessment programs), controls over the period-end financial reporting process, and policies that address significant business control and risk management practices. The SEC's 2007 management guidance adds that the more indirect a control's relationship to a financial reporting element, the less effective it may be in preventing or detecting a misstatement.
Why it matters
- They drive the top-down approach. Strong entity-level controls can reduce the testing needed at the process level; weak ones expand it.
- Some of them are controls on their own. A precise monitoring control over results of operations can be the control that addresses a risk.
- They expose culture. Management override, tone at the top and audit committee oversight are entity-level matters, and the PCAOB lists their failure among material weakness indicators.
Direct and indirect entity-level controls
AS 2201 distinguishes three effects. Some entity-level controls, such as the control environment, have an important but indirect effect on the likelihood that a misstatement is prevented or detected. Some are designed to identify breakdowns in lower-level controls but not precisely enough to address a risk alone, such as a monthly review of results that would only catch large variances. And some operate at a level of precision that would prevent or detect a misstatement in a financial reporting element, in which case management may not need to test additional controls for that risk.
The eight categories
- Control environment (integrity and ethical values, board oversight, competence, accountability).
- Controls over management override.
- The risk assessment process.
- Centralized processing and shared service controls.
- Controls that monitor results of operations.
- Controls that monitor other controls, including internal audit and self-assessment.
- Controls over the period-end financial reporting process.
- Policies on significant business control and risk management practices.
How they are tested
Entity-level controls are evaluated through inquiry, inspection of documents such as codes of conduct, board minutes and risk assessments, observation, and where a control is precise enough, reperformance. Evidence tends to be annual: whistleblower log reviews, audit committee charters and agendas, the fraud risk assessment, and the management representation and certification process.
Related terms
- Internal control over financial reporting (ICFR)
- SOX scoping
- Internal controls
- Internal control management
- Risk culture
- SOX compliance
In SmartSuite
SmartSuite SOX Management holds entity-level controls in the same control library as process controls, tagged by COSO component and principle, with their annual evidence requests, so the top-down assessment starts from a documented entity-level conclusion.
Frequently asked questions
Are entity-level controls the same as COSO components?
Not exactly. COSO's five components (control environment, risk assessment, control activities, information and communication, monitoring) describe what an effective system contains. Entity-level controls are the specific controls that operate organization-wide within those components. Mapping each entity-level control to a COSO principle is the usual way to show the framework is covered.
Can an entity-level control replace process-level testing?
Only when it operates at a level of precision that would prevent or detect a material misstatement in the relevant financial reporting element. A monthly variance review with a high investigation threshold usually cannot; a detailed account-level analysis with a low threshold and documented follow-up may. Management has to show the precision, not assume it.
Why does the auditor test entity-level controls first?
Because the results steer the rest of the audit. Effective entity-level controls, especially monitoring and period-end controls, can reduce the nature, timing and extent of testing at the process level. Ineffective ones, particularly around management override or audit committee oversight, are material weakness indicators in their own right.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.