## Manual vs Automated Elements of Internal Control

### Characteristics Relevant to the Auditor's Risk Assessment

An entity's internal control system typically contains both manual and automated elements. These characteristics affect how transactions are initiated, recorded, processed, and reported.

#### Manual Controls

Include approvals and reviews of transactions
Reconciliations and follow-up of reconciling items
May use paper-based records

#### Automated Controls (IT systems)

Combination of automated controls (embedded in computer programs) and manual controls
Manual controls in an IT environment may:
Be independent of IT
Use information produced by IT
Be limited to monitoring the effective functioning of IT and automated controls
Handle exceptions flagged by the system

---

### Suitability: When to Use Manual vs Automated Controls

#### Manual Controls Are MORE Suitable When:

Situation	Reason
Large, unusual, or non-recurring transactions	Judgment required; cannot be pre-programmed
Errors that are difficult to define, anticipate, or predict	System rules cannot cover unknown scenarios
Changing circumstances requiring response outside existing automated control scope	Automated controls are static; manual can adapt
Monitoring effectiveness of automated controls	Oversight requires human judgment

#### Manual Controls Are LESS Suitable (Automated preferred) When:

Situation	Reason
High-volume or recurring transactions	Speed and consistency of automation outperforms manual
Errors that can be anticipated/predicted	Can be built into control parameters
Control activities where the specific performance can be adequately designed and automated	System enforces it consistently, without fatigue

---

### Key Takeaway for Exam

> Manual controls are about judgment and adaptability; automated controls are about consistency and scale. The auditor must assess which type is present, how reliable it is, and what further procedures are needed.

Worked example

### Example 1

Scenario – Choosing the right control type: A bank processes 1 million ATM transactions daily. Which control type is more suitable – manual or automated? Automated – because the volume is high, transactions are recurring, and errors (e.g., wrong PIN attempts) can be pre-defined and programmed. A manual review of each transaction is impractical.

### Example 2

Scenario – Manual control more suitable: A company is negotiating a one-time merger deal worth ₹500 crores. The CFO manually reviews all financial projections and approves the transaction. Here, manual control is more appropriate because it is a large, unusual, non-recurring transaction that requires judgment, which cannot be built into a programmed rule.

⚠️ Common exam mistakes

Assuming automated controls are always better – manual controls are explicitly more suitable for unusual transactions, changing circumstances, and oversight of automated controls.
Missing the point that manual controls in an IT environment often 'use information produced by IT' (making them IT-dependent controls) – this creates a dependency on GITC effectiveness.
Not linking suitability to the audit procedure – if automated controls are used for high-volume transactions, the auditor can test once and rely on consistent operation; for manual controls, each instance may need separate testing.

Reference:

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →

Manual vs Automated Controls – Characteristics and Suitability

Worked example

⚠️ Common exam mistakes