Auditing Management Override of Controls

1. The Inherent Risk of Management Override

Before we jump into the procedures, let's reinforce why this risk is so important. SA 240 considers management override a significant risk due to fraud. This isn't a risk that you assess and potentially conclude is low; it's a risk presumed to be present in all entities.

Why? Because management:

• Can bypass controls that appear to be operating effectively.
• Can direct employees to record transactions incorrectly or conceal information.
• Can manipulate accounting records and prepare fraudulent financial statements directly.

The way management might override controls is unpredictable, making it a pervasive risk that requires specific, non-negotiable audit responses.

To get the precise language from the standard, let's read the paragraph that establishes this principle.

This establishes the foundation for the mandatory procedures we will now explore in detail.

2. The Three Mandatory Procedures: A Deep Dive

SA 240, Paragraph 32, mandates that irrespective of your risk assessment, you shall design and perform specific audit procedures. Let's break down each one.

A. Journal Entry Testing

Fraud is often perpetrated through inappropriate or unauthorized journal entries used to manipulate financial results, especially near the end of a reporting period. Your job is to look for these.

How to perform the test:

1. Make inquiries: Talk to individuals involved in the financial reporting process about any inappropriate or unusual activity they've noticed.
2. Select and test entries: Focus on journal entries and other adjustments made at the end of the reporting period (e.g., year-end and post-closing entries).
3. Consider testing throughout the period: Don't assume all fraudulent entries happen on March 31st. You may need to test entries made throughout the year.

What to look for (Characteristics of Fraudulent Entries):

• Entries made to unrelated, unusual, or seldom-used accounts.
• Entries recorded by individuals who typically do not make them (e.g., the CEO or a sales manager).
• Entries with little or no explanation or description.
• Entries made outside of business hours or on holidays.
• Entries containing round numbers or a consistent ending number (e.g., always ending in '999').

To get the full technical detail, let's turn to the standard.

B. Reviewing Accounting Estimates for Bias

Financial statements are full of estimates (e.g., provision for doubtful debts, warranty provisions, fair value estimates). Management's judgment in making these estimates is a natural point of vulnerability for bias. They might intentionally understate or overstate provisions to either smooth earnings or achieve a specific profit target.

How to perform the review:

1. Evaluate management's judgments: Even if individual estimates seem reasonable, when you look at them as a whole, do they show a pattern of optimism or pessimism that benefits management? For example, are provisions always at the lowest end of the reasonable range?
2. Perform a retrospective review: This is a powerful technique. Compare the significant accounting estimates made in the prior year to the actual outcome. For example, if the provision for warranty claims last year was ₹1 Crore, but actual claims paid were ₹2 Crore, it might indicate an optimistic bias. This review isn't to second-guess your prior year's audit, but to inform your current year's assessment of management's estimation process.

Let's read the specific guidance on this.

C. Evaluating Significant Unusual Transactions

Transactions that are outside the entity's normal course of business, or that appear unusual, warrant deep scrutiny. They can be used to engage in fraudulent financial reporting (e.g., creating off-balance-sheet structures) or to conceal the misappropriation of assets.

How to perform the evaluation:
Your key task is to understand and evaluate the business rationale (or the lack thereof) for the transaction. You need to ask "Why?"

• Does the transaction make commercial sense?
• Is the accounting treatment reflecting the economic substance, or is management more focused on achieving a particular accounting outcome?

Indicators of potentially fraudulent unusual transactions:

• The transaction's form seems overly complex (e.g., involves multiple entities in a group, or unrelated third parties for no clear reason).
• Management has not discussed the transaction's nature and accounting with Those Charged with Governance (TCWG).
• The transaction involves previously unidentified related parties or parties that lack the financial strength to support the transaction on their own.

Let's review the standard for the official list of indicators.

3. Application Exercise

Let's put this into practice with a short scenario.

Scenario:
You are the auditor of a manufacturing company. While reviewing the year-end closing process, you identify the following:

• A single, large journal entry dated March 31st transfers a significant amount from "Salaries and Wages" to "Capital Work-in-Progress".
• The entry was posted by the CFO's executive assistant, who does not have accounting responsibilities.
• The description simply states: "To capitalize project labour."
• In the same year, you note that management’s bonus is tied to achieving a certain Net Profit target, which the company was on track to narrowly miss before this entry.

Your Task:
Based on what we've just discussed, answer the following:

1. Which of the three mandatory procedures is immediately triggered?
2. What characteristics of a potentially fraudulent journal entry are present here?
3. What specific audit steps would you take in response?

Conclusion

Today we went beyond simply knowing the 'JEO' mnemonic and explored the practical application of the mandatory procedures required to address the risk of management override. By understanding the 'why' behind each test and the specific steps involved, you are better equipped to apply these concepts in your exams and in practice.

Key Takeaways:

• Management override of controls is a presumed significant risk in every audit due to management's unique position.
• SA 240 mandates three specific procedures in response:
  1. Testing journal entries, looking for specific characteristics of fraudulent entries.
  2. Reviewing accounting estimates for bias, including performing a retrospective review.
  3. Evaluating the business rationale of significant unusual transactions.
• Applying these procedures requires a high degree of professional skepticism and a questioning mind.

Preview of the Next Lesson

In our next lesson, we will continue our deep dive into SA 240 by focusing on another area that the standard identifies as a presumed fraud risk: revenue recognition. We will explain the presumption of fraud risk in revenue recognition and the audit procedures to address it.