AS5 outlines the processes for “An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements.” Paragraph 24 of this document lists eight entity- level controls. Entity- level controls are comparable to the pervasive controls covered in this chapter. List A contains entity- level controls from AS5, and List B contains specific control plans. Match the control plans to the correct entity- level controls.
List A: Entity- Level Controls
1. Controls related to the control environment.
2. Controls over management override.
3. The company’s risk assessment process.
4. Centralized processing and controls, including shared service environments.
5. Controls to monitor the results of operations.
6. Controls to monitor other controls, including activities of the internal audit function, the audit committee, and self- assessment programs.
7. Controls over the period- end financial reporting process.
8. Policies that address significant business control and risk management practices.
List B: Specific Control Plans
A. A file of signed code-of-conduct letters.
B. A report of all employees not taking required vacation days.
C. A report on IT risks and a risk action plan.
D. Access control software.
E. A systems development life cycle methodology (SDLC).
F. Budgetary controls.
G. Development of a business interruption plan.
H. Establishment of a code of conduct.
I. Not covered.
J. Program change controls.
K. Segregation of duties.
L. Selection and hiring control plans.
M. Service- level agreements and reporting processes.
N. Supervision.
O. Use of control frameworks such as COBIT and COSO.