All 18 Internal Controls Evaluation questions
More in Internal Controls Evaluation
How do you document the understanding of internal controls? What are compensating controls and how do they affect the audit? What is the difference between a deficiency, a significant deficiency, and a material weakness? What are IT general controls (ITGCs) and why do they matter? How do you evaluate controls in a system that uses a service organization (SOC reports)? What is the auditor's responsibility for reporting internal control deficiencies?
Advertisement
Auditing & Assurance › Internal Controls Evaluation

How does management override of controls create risk, and how do auditors address it?

Advanced

Answer

Even good controls can be overridden by management, who can post fraudulent entries, bias estimates, or engineer transactions—an unpredictable risk present in every audit (ISA 240). Auditors respond by testing journal entries (especially unusual/late ones), reviewing estimates for bias, evaluating the business rationale of significant unusual transactions, and incorporating unpredictability into procedures.
Real-world example The team scrutinizes manual top-side journal entries near year-end to detect management override of the normal controls.

Common follow-ups: Why is override a pervasive risk? | What specific procedures address it?

Fraud & Error Responsibilities Audit Evidence & Procedures Internal Controls Evaluation
All 18 Internal Controls Evaluation questions