Auditing standards encourage a "top down" approach to understanding an entity's internal control, i.e. focusing on key controls first. The design and operation of key controls, of course, can prevent risks of material misstatement from occurring and going undetected. Auditing standards also recognize such controls can be informal and operated by one or a few persons in smaller entities.
As discussed in a previous blog, the owner or manager (director, CEO, superintendent, etc.) of a small entity is that entity’s control environment. If he or she has good character, is committed to performing key controls and is diligent in carrying out day-to-day responsibilities, it is possible for a small entity to have a good system of internal control. On the other hand, an ineffective owner/manager may increase the risk of material misstatements at both the entity and assertion levels.
Boards of directors for small entities, especially non-profit organizations, may not be knowledgeable of business operations, accounting and tax activities or internal control over financial reporting. In such cases, the caliber of the owner or manager will be even more important in the auditor’s evaluation of risk of material misstatement. A knowledgeable board, on the other hand, can serve to reduce the risk of material misstatement when the owner or manager’s capabilities are not strong.
An informal organization structure of a small entity may result in control deficiencies due to a lack of segregation of duties in operations and accounting. Because employees may be trained to perform many different functions, the resources and accounting records could be at risk of misstatement. Highly effective key controls would be necessary to mitigate these risks to prevent errors or fraud.
Many of the key controls performed by an owner or manager depend on the physical presence of the person. Prolonged absences from the work place by the owner or manager decrease the effectiveness of key controls and increase the risk of material misstatements. The physical presence of an owner or manager of a small entity can, however, facilitate the operation of a good system of internal control. For smaller entities, a good internal control system depends on an effective owner/manager!