In our new remote work world, are your key controls ready for audit?

As we operate in a more virtual and electronic environment, some of your control system documentation might go by the wayside. While less paper can be good, it's important to keep some evidence of your key controls in action.

What is a key control?

A key control is an action or process that is critical to achieving a certain objective. In managing federal programs, there must be key control(s) for each compliance requirement – something that you do to make sure you are in compliance. For example, a key control might be a secondary review to ensure reports are accurate before they are sent to the grantor. In financial audits, there must be key control(s) over each management assertion (such as existence or completeness) for each class of transactions. For example, a key control that ensures all capital assets exist at the balance sheet date might be an inventory verification process.

Why does my auditor need to understand my key controls and how strong they are?

Auditors need to understand the strength of your control system so they can assess audit risk and properly plan your audit. In some cases, auditors might perform tests of those key controls to gain even more comfort – either because they are required to do so or because it reduces audit work in other areas, such as testing of transactions (substantive testing).

Entities that cannot identify their key controls and/or lack documentation of how they were used, create challenges for the auditor. These situations can result in audit findings for your government, as well as increased audit testing to address high risk areas.

How do I document that electronic controls occurred?

Let's consider the review of an important report. Back when it was a paper hardcopy, it was easy to make notations and initial the report with a review date. Now, when reviewing an electronic report from a computer screen, there might not be a place to document in the same way. The important thing is that the control activity is documented and this documentation is kept. Some examples might be a note to a file or an email, or an item you mark-off on a checklist. You'll also want to capture details like who did the review, what they specifically reviewed and what expectation they were reviewing for, and any results found.

How do I to ensure my employees understand the importance of key controls?

Management needs to be directly involved in the control systems by:

• Establishing expectations in policies and procedures, so that staff know what to do.
• Monitoring control systems as part of daily oversight of key functions.
• Conducting periodic in-depth reviews, especially when there are disruptions or changes to control systems.
• Confirming staff are performing key control activities and documenting them.

So what's the key to key controls? At the end of the day, management is responsible for ensuring key control(s) exist to accomplish each important objective, and that all key controls are operating as designed and documented.

How do I find help?

Remember, we are here to help. If you have specific technical accounting questions, submit them using our help desk in the client portal.

We also have financial management specialists at the Center available to talk through projects you might be working on that affect your internal control systems. For assistance, reach out to the Center@sao.wa.gov.