## Component 4: Control Activities

### Definition

Control activities are policies and procedures that help ensure that management directives are carried out.

---

### Scope of Auditor's Understanding

The auditor obtains an understanding of control activities relevant to the audit — specifically those related to:

Significant classes of transactions
Account balances
Disclosures in the financial statements
Assertions the auditor considers relevant in the risk assessment process

> The auditor does not need to understand all control activities — only those tied to significant areas and relevant assertions.

---

### Five Types of Control Activities

Type	Description	Example
Authorization	Transactions require proper approval	Expense approval limits; authorization matrix
Performance Reviews	Comparing actual results against expectations	Budget vs. actual variance analysis; trend comparison
Segregation of Duties	Separating authorization, recording, and custody	Different people raising PO, receiving goods, approving payment
Physical Controls	Restricting physical access to assets	Locked warehouses, safes, access-controlled server rooms
Information Processing	IT and manual controls over data accuracy	Edit checks, reconciliations, batch totals

---

### Segregation of Duties — Key Principle

The three functions that should be separated to reduce fraud/error risk:

1. Authorization of transactions

2. Recording of transactions

3. Physical custody of assets

> When one person handles two or more of these functions, risk of undetected fraud or error rises significantly.

Worked example

### Example 1

Multiple control activities in one process: In a payables cycle — (a) Purchase manager raises PO [Authorization], (b) Warehouse staff record goods received [Segregation + Recording], (c) Accounts team matches PO × GRN × invoice before payment [Information processing], (d) CFO reviews monthly AP ageing report [Performance review], (e) No single person controls all steps [Segregation of duties]. This illustrates all five types of control activities operating together.

### Example 2

Segregation failure and audit response: In a small firm, Ramesh alone orders raw materials, receives deliveries, and approves supplier invoices for payment. All three functions — authorization, custody, and recording — sit with one person. Ramesh could fabricate purchases and siphon funds. The auditor has no control to rely on here and must perform extensive substantive procedures: confirm supplier balances independently, vouch purchases to underlying delivery documentation, and perform cut-off testing.

⚠️ Common exam mistakes

Thinking the auditor must understand all control activities — only those related to significant transaction classes and relevant assertions are required
Forgetting 'Performance Reviews' as a type of control activity — students often list only authorization and segregation of duties, missing three of the five types
Confusing control activities (one component of IC) with internal controls as a whole — control activities are the fourth of five components, not a synonym for all of IC

Reference:

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →

Components of Internal Control — Control Activities

Worked example

⚠️ Common exam mistakes