## Components of Internal Control

SA 315 divides internal control into five components:

1. Control Environment

2. Entity's Risk Assessment Process

3. Information System and Communication

4. Control Activities

5. Monitoring of Controls

---

## Component 1: Control Environment

The control environment is the foundation for all other components. It sets the tone of the organisation, influencing the control consciousness of its people.

The auditor evaluates whether:

Management has created a culture of honesty and ethical behaviour
Control environment elements collectively provide an appropriate foundation for other components

### Elements of the Control Environment — Mnemonic: MOTI CA HAI

Letter	Element	Key Points
M	Management's philosophy and operating style	Attitudes toward financial reporting, approach to accounting estimates, risk appetite
O	Organisational structure	Key areas of authority, reporting lines, appropriateness for entity's size and nature
T	Those charged with governance (participation)	Independence from management, experience, extent of involvement, information they receive, scrutiny of activities
I	Integrity and ethical values (communication and enforcement)	Ethical standards, how they are communicated, management actions to eliminate dishonest incentives
C	Commitment to competence	Competence levels for jobs, how they translate into required skills and knowledge
A	Assignment of authority and responsibility	How authority for operating activities is assigned, authorisation hierarchies
H	Human resource policies and practices	Recruitment, training, evaluation, promotion, compensation, remedial actions
(A)	(Implied: Accountability mechanisms)
I	(Integrated with integrity element above)

### Important Nuance: Control Environment ≠ Fraud Prevention

A satisfactory control environment reduces fraud risk but is not an absolute deterrent.
Deficiencies in the control environment (e.g., poor IT security) undermine effectiveness of all other controls.
The control environment does not directly prevent or detect material misstatements — but it influences the auditor's evaluation of other controls and, thereby, the overall risk assessment.

Worked example

### Example 1

M – Management's philosophy: An entity's CEO aggressively pushes for meeting analyst earnings forecasts. The auditor notes this as a cultural pressure that may motivate aggressive accounting estimates. This heightens risk related to provisions, contingencies, and revenue cut-offs.

### Example 2

T – Those charged with governance: An audit committee where all members are related to promoters raises concerns about independence. The auditor increases professional skepticism about management representations, since the oversight mechanism is weakened.

### Example 3

H – Human resource policies: An entity has no formal background verification for its accounts payable team and no training on fraud awareness. The auditor considers this a weak HR policy element, increasing the risk of errors and intentional misappropriation.

### Example 4

Control environment not absolute: A company with a strong code of ethics and whistleblower policy still experiences a payroll fraud when two HR employees collude to add ghost employees. The control environment reduced risk but did not eliminate it — demonstrating 'reasonable, not absolute' assurance.

⚠️ Common exam mistakes

Treating the control environment as sufficient on its own — it is only a foundation; the other four components must also function effectively.
Confusing 'Commitment to competence' (C) with 'Human resource policies' (H) — competence relates to defining skill requirements; HR policies relate to implementing them through recruitment and training.
Stating that a strong control environment prevents fraud — the correct position is that it reduces risk but is not an absolute deterrent.
Omitting the role of 'those charged with governance' (T) as an element — students often only list management-related elements.

Reference:

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →

Components of Internal Control – Control Environment (MOTI CA HAI)

Worked example

⚠️ Common exam mistakes