Auditing Top-Ten List: Internal Controls

In this one-hour webcast, Sunish Mehta walks through a practical top-10 framework for understanding, documenting, and evaluating internal control in nonpublic entity audits. Framed by the audit pipeline and the audit risk model, the course shows how an updated understanding of internal control drives your risk assessment and further audit procedures, with a clear focus on audit effectiveness first and efficiency second.

Using the COSO framework as a backbone, Mehta distinguishes entity-level and activity-level controls, explores control environment, the client’s own risk assessment, information and communication, monitoring, IT general controls (operations, security, and change management), and application controls. He then demonstrates how to identify significant transaction cycles (including required attention to revenue and period-end), develop “what can go wrong” scenarios, match risks to controls, perform design and implementation walkthroughs, and evaluate deficiencies under AU-C 265—linking control deficiencies, significant deficiencies, and material weaknesses to appropriate communication in management and internal control letters.