Testing the Design Effectiveness of Internal Controls
4-CPE Live Webinar for Internal Auditors, SOX Professionals, Compliance Teams and Control Owners
An internal control can be performed consistently and still fail because it was poorly designed. Before auditors test whether a control operated effectively, they must determine whether the control—if performed as intended—is capable of preventing or detecting the identified risk.
This live, instructor-led CPE webinar provides a practical approach to evaluating the design effectiveness of internal controls. Participants will learn how to connect organizational objectives, risks and controls; identify control design gaps; evaluate entity-level, process-level and IT controls; and document conclusions that can withstand management, external-auditor and regulatory review.
The course incorporates concepts from the COSO Internal Control—Integrated Framework and applies them to financial reporting, operational, compliance and technology-related controls.
Attendees can earn 4 CPE credits while developing skills they can immediately apply to internal audits, SOX assessments, compliance reviews and control-improvement projects.
Why Attend This Internal Control Webinar?
A control should not be tested for operating effectiveness until its design has been evaluated. Testing a poorly designed control wastes audit resources and may produce a false sense of assurance.
This webinar will help participants:
- Distinguish design effectiveness from operating effectiveness.
- Connect business objectives, risks, control activities and evidence.
- Determine whether a control adequately addresses an identified risk.
- Recognize missing, redundant or improperly designed controls.
- Evaluate preventive, detective, manual, automated and IT-dependent controls.
- Assess entity-level and process-level controls.
- Document design conclusions using clear and defensible audit evidence.
- Communicate control deficiencies and practical corrective actions.
- Improve the quality and efficiency of subsequent operating-effectiveness testing.
Practical Questions Addressed During the Webinar
- What makes an internal control properly designed?
- Can a control operate consistently but still be ineffective?
- How much evidence is required to support a design conclusion?
- Is inquiry alone sufficient to evaluate control design?
- When should an auditor conduct a walkthrough?
- How should the auditor evaluate the precision of a management review control?
- What should be considered when a control relies on a system-generated report?
- How are design gaps distinguished from failures in control performance?
- When can a compensating control address a design deficiency?
- How should control design deficiencies be documented and communicated?
Register for the 4-CPE Webinar
Strengthen your ability to determine whether internal controls are properly designed before investing time in operating-effectiveness testing.
Register for Testing the Design Effectiveness of Internal Controls and learn how to evaluate risk coverage, identify design gaps, document defensible conclusions and recommend practical improvements.
Earn 4 CPE credits while building internal control assessment skills that can be applied immediately.
Details on Event Presentation
Offered every eight weeks on Mondays at 10:00 a.m. to 2:30 p.m. Central Time in four CPE-Credit event.
We can schedule private events on your timetable for two or more attendees.
CPE Event Highlights
Internal Control Design: Learn the essential characteristics of a properly designed control, including its purpose, owner, frequency, precision, evidence and relationship to an identified risk.
COSO Internal Control Framework: Apply the five COSO components and relevant principles when evaluating control design across the organization.
Risk and Control Alignment: Determine whether each control addresses the correct risk and whether the combination of controls reduces that risk to an acceptable level.
Entity-Level Controls: Evaluate governance, management oversight, ethical expectations, risk assessment, communication and monitoring controls.
Business-Process Controls: Analyze control design within transaction cycles such as revenue, purchasing, accounts payable, payroll, financial close and reporting.
IT General Controls and Automated Controls: Consider access security, change management, computer operations, system configurations, automated controls and information used in control performance.
Control Deficiencies: Identify design deficiencies, determine their consequences and develop practical recommendations for remediation.
Audit Documentation: Prepare design-effectiveness workpapers that establish the objective, risk, control, procedures performed, evidence obtained and conclusion reached.
Learning Objectives
Upon completion of this webinar, participants should be able to:
- Explain the difference between control design effectiveness and operating effectiveness.
- Apply COSO concepts when evaluating the design of internal controls.
- Connect organizational objectives, risks and control activities.
- Identify the characteristics of a properly designed control.
- Evaluate whether a control is capable of preventing or detecting a material error, fraud, compliance failure or operational breakdown.
- Assess preventive, detective, manual, automated and IT-dependent controls.
- Evaluate the design of entity-level, transaction-level and IT general controls.
- Use inquiry, observation, inspection and walkthroughs to obtain evidence about control design.
- Identify gaps, overlaps and weaknesses within a system of internal controls.
- Document and communicate control design deficiencies and corrective actions.
Key Issues on the Agenda
1. Internal Control Design Fundamentals
- Purpose and limitations of internal controls.
- Objectives, risks, controls and evidence.
- Preventive versus detective controls.
- Manual, automated and IT-dependent controls.
- Key controls versus secondary controls.
- Design effectiveness versus operating effectiveness.
- Why operating-effectiveness testing should follow design evaluation.
2. Applying the COSO Framework
- COSO’s five components of internal control.
- Relevant COSO principles.
- Entity-level and process-level controls.
- The relationship between objectives, risks and controls.
- Considering fraud risk in control design.
- Evaluating whether controls work together as an integrated system.
3. Performing a Design-Effectiveness Assessment
- Understanding the process and control objective.
- Identifying the risk addressed by the control.
- Evaluating the control owner’s authority and competence.
- Assessing control frequency, timing and precision.
- Determining what evidence the control produces.
- Using walkthroughs to confirm control design.
- Evaluating information used in the performance of a control.
- Determining whether the control could work as described.
4. Evaluating Common Control Areas
- Governance and entity-level controls.
- Revenue and accounts-receivable controls.
- Purchasing and accounts-payable controls.
- Payroll and personnel controls.
- Financial-close and reporting controls.
- Access-management and segregation-of-duties controls.
- Change-management and computer-operations controls.
- Automated controls and system-generated reports.
5. Documenting and Reporting Results
- Developing risk and control matrices.
- Recording walkthroughs and design-testing procedures.
- Supporting conclusions with sufficient evidence.
- Distinguishing design deficiencies from operating failures.
- Evaluating compensating controls.
- Writing clear control-deficiency statements.
- Developing practical corrective-action recommendations.
- Preparing for operating-effectiveness testing.
NASBA Program Disclosure
Program Level of Understanding: Basic
Prerequisites: None
Advance Preparation: None
Delivery Format: Seminar (Group Internet Based)
NASBA Field(s) of Study: Auditing
CPE Credits: 4, based on 50 minutes of instruction per hourSummary of the Subject Matter
Testing control design effectiveness is a critical first step in any internal control assessment. The auditor must determine whether the control, individually or together with other controls, is capable of addressing the identified risk when performed as intended.
This 4-CPE webinar presents a structured method for examining control objectives, risk alignment, control ownership, frequency, precision, evidence and technology dependencies. Participants will learn how to evaluate entity-level, process-level and IT controls using inquiry, observation, inspection and walkthrough procedures.
The webinar also addresses how to recognize design deficiencies, evaluate compensating controls, document audit conclusions and develop useful recommendations. The course is appropriate for internal audit, SOX, compliance, risk-management and control-improvement programs.