What Your Controls Tell Your Auditor

Cyber Updates Ireland

John Duffy - HLB Ireland Audit Services Ltd

What Your Controls Tell Your Auditor

Every audit ends with a management letter. Most finance teams read it as a list of housekeeping points to tidy up before next year.

It is worth reading the details carefully. The points in it reflect a view your auditor formed much earlier during the first walkthroughs, the first data requests and the first conversations with process owners. By the time the letter is written, that view has already shaped where the audit team looked hardest and how much evidence it asked for.

Your internal controls are, in effect, the first thing your auditor audits. Strengthening them before fieldwork begins is one of the most practical ways to make the rest of the audit run well.

Why controls matter, even when your auditor isn't relying on them

A common assumption is that controls only matter if the auditor plans to rely on them. For many Irish private companies, the audit approach is largely substantive, so controls can seem like a secondary concern.

That assumption misses three things.

First, auditing standards require auditors to understand the controls relevant to the audit, including IT controls, whatever approach they then take.

Second, weaknesses identified along the way are reported to those charged with governance, and they land in front of the board.

Third, directors have their own responsibility under company law to keep adequate accounting records. That responsibility doesn't depend on the audit approach.

There is also a practical point. Where controls are weak, the auditor has to get comfort another way. That usually means larger samples, more queries and more time from your team.

Four areas worth your attention before fieldwork

1. Align documentation to actual processes and how the business is run

Businesses change faster than their documentation does. A new revenue stream, a system upgrade or a restructured team can leave risk assessments and process notes describing how things worked three years ago. Refresh the risk assessment first, starting with last year's management letter. Then walk through the main cycles, such as revenue, purchasing and payroll, and update the process notes so they match reality. Ask the process owners to confirm them.

2. Review areas to enhance existing processes

Segregation of duties remains one of the simplest and most effective controls. The person who sets up a supplier or enters the invoice should also not be able to approve the payment. In practice, most of these boundaries now live in system access rights rather than in job descriptions. Review user access in your finance systems, confirm that leavers lose access promptly, and limit administrator rights to the people who genuinely need them. Pay particular attention to whoever can post manual journals, and make sure non-standard entries are approved by someone independent.

3. Show the review, not just the signature

Many important controls are reviews: a manager checking a reconciliation, or a finance director reviewing a provision. A signature or initials on its own says little about what was reviewed. Good evidence shows what was looked at, the threshold used to investigate differences, the questions raised and how they were resolved. Every balance sheet reconciliation should tie to the ledger, carry its supporting detail and show a timely review. Old, unexplained reconciling items are among the first things an auditor will notice.

4. Test yourself first

Pick a sample of transactions for your key controls and check that the controls operated as intended. Where something has broken, fix it and record the fix. A short mock walkthrough is also useful: ask a colleague from outside the process to question the process owner and request supporting documents. It quickly shows where explanations are unclear or evidence is hard to find. Finally, set up a single, clearly organised folder for audit requests, with one person coordinating the flow of information.

A word on proportionality

Much of the published guidance on internal controls is written with large, listed groups in mind. Many Irish companies don't look like that. A finance team of three cannot separate every duty, and nobody should pretend otherwise.

The answer is compensating controls, clearly recorded. That might be a director reviewing the bank statements and the payments listing each month, or an owner signing off supplier changes. What matters is that the gap is recognised, the compensating step is real, and there is evidence it happened.

Auditors generally respond well to a business that understands its own limitations. They respond far less well to controls that look complete on paper but don't happen in practice.

Where to start

If time is short, three steps will give you the most value before the auditors arrive.

1

Reread last year's management letter. Check whether each point has been resolved, and be ready to show the evidence.

2

Run a user access review on your finance systems. Focus on leavers, administrator rights and who can post manual journals.

3

Spot-check your reconciliations. Look for old reconciling items, missing support and reviews that were signed late or not at all.

Controls as a signal

Strong controls don't guarantee a smooth audit, and weak ones don't guarantee a difficult one. But they are one of the clearest signals a finance function sends about how it runs. They also protect the business all year round, not just during audit season.

The work is rarely glamorous: access reviews, updated process notes, evidenced reviews. Done in the autumn, it changes the tone of the audit that follows.

Get in touch

If you would like to discuss your controls ahead of your audit, get in touch with us.

John Duffy

Partner, Audit & Assurance

[email protected]