Design your audit to achieve a low assessed level of control risk | AccountingWEB

Design your audit to achieve a low assessed level of control risk

Thanks, again, AICPA for your wacky legalistic language. When I hit this sentence in the standards, I get so annoyed… October 1, 2009 Audit Guide Government Auditing Standards and Circular A-133 Audits section 9.22… the auditor should plan the test of internal control over compliance for major programs to support a low assessed level of control risk for the assertions relevant to compliance requirements for each major program. “

Why don’t you just say that on a Single Audit you must gain an understanding of controls and you must determine if they are well designed and implemented. Why don’t you just say: “Document and test controls.  PERIOD”? Why do you have to be so vague and legalistic?
Are you trying to hide something? Trying to keep the average person from becoming an auditor?  Look, you really don’t have to worry, AICPA. Not many people dream of being an auditor when they are in fifth grade. Most auditors don’t even want to be auditors. It isn’t exactly like we couldn’t use more help here!
That turned around language makes auditing seem like some sort of science – and it isn’t. All that low, high, moderate hoo-hah and that crazy formula AR=DRxCRxIRxFR is making our work seem like it involves algebra. And it soooo doesn’t. 
I do appreciate how the terms inside of that formula let us articulate our gut reaction to areas that deserve our attention.   IR (inherent risk) and FR (fraud risk) help us articulate how headline worthy a particular issue is. And CR (control risk) lets us articulate how good of a handle we feel the client has on the area. IR,FR, and CR combine to tell us how messy the client is and then DR says how we respond to that mess as auditors. In more messed up the client is, the more we have to work it to get assurance that everything is OK. 
But when the standards say “Design your audit to achieve a low assessed level of control risk” they are taking away the auditor’s ability to assess, on their own, where the clients controls lie in the spectrum of strong to weak. We don’t get to rate the controls – we get to hit the controls hard, period. So the formula becomes useful only when it comes to inherent and fraud risk.
Does the AICPA talk like this to make up for past mistakes – like the disastrous SAS 55 that caused most auditors to bypass control testing and get right on to substantive testing in the sake of efficiency? Is the AICPA sort of like Toyota – adding a safety package to all of their cars but still unable to admit any wrong doing? Does the AICPA refuse to speak English because they also refuse to have their Tylenol moment where they recall their products? 
Even though it sort of negates a significant component of the risk formula, I am glad that the Single Audit doesn’t let auditors get away with bypassing controls. Have you ever paid for a horrible meal in a restaurant that got good reviews? The reviewer obviously did a substantive test on the restaurant – announcing before the meal that they were with the paper and were there to review the restaurant.   Anyone can get their act together given enough warning. But controls make sure they are able to get their act together over and over and over. McDonalds, while bland, is also unbelievably consistent. Why? Super-duper controls! The feds, understandably, want good controls in place over their programs so that things work well most of the time, not just when the auditor visits.
 So, bottom line – “designing your audit to achieve a low assessed level of control risk” – means work those controls. Work ‘em, baby!

This blog

Governmental auditors unite! Leita Hart-Fanta, CPA, CGFM, and CGAP is the author of “The Yellow Book Interpreted” and owner of a website devoted to training for governmental auditors. Whether you are an internal auditor or monitor for a government entity or a CPA doing grant audits, you will enjoy Leita’s humorous take on the complexity of auditing in the government environment.

More from this blog

Bloggers crew

Steve Knowles has spent 25 years in business and practice in the UK, but he also worked in the states and the years haven't dulled his way of seeing an alternative view to everyone else, and every day is a new adventure.


Joel M. Ungar, CPA is a lifelong resident of the Detroit area and a graduate of The University of Michigan. He is a principal with Silberstein Ungar, PLLC, a Top 15 auditor of SEC public reporting companies.


Allan Boress, CPA, with over 25 years as a practitioner and consultant to the accounting profession. Mr. Boress is the author of 12 published books in 6 different languages, including a best-seller, The "I-Hate-Selling" Book.


Larry Perry, CPA, CPA Firm Support Services, LLC, is the author of accounting and auditing manuals, author and presenter of live staff training seminars, and author of webcast and self-study CPE programs. He blogs about small audits, reviews, and compilations.

Sandra Wiley, COO and Shareholder, is ranked by Accounting Today as one of the 100 Most Influential People in Accounting as a result of her prominent role as an industry expert on HR and training as well as influence as a management and planning consultant. She is also a founding member of The CPA Consultant's Alliance. Sandra is a certified Kolbe™ trainer who advises firms on building balanced teams, managing employee conflict and hiring staff.

Maria Calabrese, CIR, Human Resources manager for Fazio, Mannuzza, Roche, Tankel, LaPilusa, LLC in Cranford, New Jersey, Maria's topics revolve around the world of: Mentoring, Performance management, and The "Y Generation," a.k.a. "The whY generation".


William Brighenti is a CPA, Certified QuickBooks ProAdvisor, and Certified [Business] Valuation Analyst, operating an accounting, tax, and QuickBooks consulting firm in Hartford, Connecticut, Accountants CPA Hartford.


Ken Garen, CPA, is the co-founder and President of Universal Business Computing Company (, a software development firm of high-volume, high-productivity accounting and payroll technology.


Eva Rosenberg, MBA, EA, is the publisher of, and author of the weekly syndicated Ask TaxMama column. She provides answers to tax questions from taxpayers and tax professionals worldwide.


Amy Vetter, CPA, CITP is the CPA Programs Leader for Intacct Corporation responsible for leading the CPA/BPO Partners nationally.

Brian Strahle is the owner of LEVERAGE SALT, LLC where he provides state and local tax technical services to accounting firms, law firms and tax research organizations across the United States. He also writes a weekly column in Tax Analysts State tax Notes entitled, "The SALT Effect." For more info, visit his website:
Scott H. Cytron, ABC, is president of Cytron and Company, known for helping companies and organizations improve their bottom line through a hybrid of strategic public relations, communications, marketing programs and top-notch client service. An accredited consultant, Scott works with companies, organizations and individuals in professional services (accounting, finance, medical, legal, engineering), high-tech and B2B/B2C product/service sales.

Rita Keller is a nationally known CPA firm management consultant, speaker, author, mentor and blogger. She has over 30 years hands-on experience in CPA firm management, marketing, technology and administrative operations.

Stacy Kildal is the mom of two fantastic kids, an Advanced Certified QuickBooks ProAdvisor, Certified Enterprise Solutions ProAdvisor, Sleeter Group Certified Consultant, a nationally recognized member of the Intuit Trainer and Writer Network, and co-host of RadioFree QuickBooks.
Michael Alter's blog specializes in providing practical advice to those who seek greater profitability and practice management tactics that enhance deeper client relationships.

Sally Glick, CMO, Principal, Marketer of the Year in 2003 and AAM Hall of Famer in 2007, leads a lively discussion of the constantly expanding roles of marketing and the professional marketers that drive this initiative in accounting firms of all sizes.


The IMA Young Professionals Blog features the insights of IMA’s Young Professionals Committee. Committee members share advice and experiences on careers, continuing education, work/life balance, and other issues affecting young accounting and finance professionals.


FEI Financial Reporting Blog provides highlights from SEC, PCAOB, FASB, IASB, and other regulatory news, including reporting under Sarbanes-Oxley Sect 404. It is written by Edith Orenstein, Director of Technical Policy Analysis at FEI.


Sue Anderson has 30 years of experience in continuing education for accountants. Currently she is the program director for online CPE provider CPE Link.


Jim Fahey is COO of Apple Growth Partners, a regional CPA firm in Ohio. His focus is on the effective and efficient use of technology within the firm by all team members.

Caleb Newquist is the Editor-in-Chief of Sift Media US, overseeing content for both AccountingWEB and Going Concern.

Leita Hart-Fanta, CPA, CGFM, and CGAP is the author of "The Yellow Book Interpreted" and owner of a website devoted to training for governmental auditors.


AccountingWEB is more than just a U.S. team of journalists and financial and technology experts - we have an international side, too! Members of our British team who publish share their ideas, insights, and perspectives from across the pond.