Skip to content

Audit and Assurance · The use and evaluation of systems of internal control by auditors

Control Activities and Control Procedures in Audit

Updated 11 October 2026 · Fact-checked

Control activities are the policies and procedures management sets up to stop or catch errors and fraud. Examples are segregation of duties, authorisation, physical controls, arithmetic checks and management review. In the exam, name the control, link it to a specific risk in the scenario, and explain why it works.

Understand Control Activities and Control Procedures

A control activity is an action that responds to a risk. A business knows that goods could be stolen, invoices could be wrong or payments could go to fake suppliers. It puts in a procedure to reduce that risk. The auditor looks at these procedures to decide how much the financial statements can be trusted.

Think of each control as answering one question: what could go wrong here, and what stops it? The thing that could go wrong is the control objective (for example, all sales are recorded). The procedure is the control activity (for example, goods despatched notes are sequence checked against invoices).

The main types are:

  • Segregation of duties: different people authorise, record and have custody of assets, so one person cannot commit and hide fraud alone.
  • Authorisation: transactions are approved by someone with the right authority, such as a manager approving overtime or credit limits.
  • Physical controls: locks, safes, restricted access and security staff that protect assets from theft or damage.
  • IT access controls: password protection and restricted user access to systems and data.
  • Arithmetic and accounting checks: reconciliations, control accounts, inventory counts, sequence checks, batch totals and recalculation.
  • Management controls: budgets, variance review, supervision and review of exception reports.
  • Documentation and records: pre-numbered documents, matching of orders, goods received notes and invoices.

Controls are either preventive (stop the error happening, such as a password) or detective (find it afterwards, such as a bank reconciliation). Controls can also be overridden by management or defeated by collusion, so no control is perfect. Weaker controls mean higher control risk, and the auditor then does more substantive testing.

Key rules to remember

Control objective to activity link
Risk (what could go wrong) → Control objective → Control activity → Test of control
Use this chain to structure any answer. Never give a control without the risk it addresses.
Core segregation of duties
Authorisation ≠ Recording ≠ Custody (independent reconciliation or review is added good practice, not a required fourth person)
If one person does two of these, there is a risk that fraud or error goes unnoticed. It may be a deficiency unless compensating controls exist, for example close management review in a small entity. Independent reconciliation or review strengthens the control but does not need a separate fourth person.
Types of control
Preventive (stop it happening) vs Detective (find it afterwards)
Examiners often ask which type a control is. A bank reconciliation is detective; an approval before payment is preventive.
Sales cycle key controls
Order → credit check → despatch (GDN) → invoice → record → receipt → reconcile
Match documents at each step and sequence check them to check completeness.
Purchases cycle key controls
Requisition → authorised order → goods received note → match order, GRN and invoice → approve → pay
The three-way match is the key control against paying for goods not ordered or not received.
Payroll cycle key controls
HR approves joiners and leavers → hours authorised → payroll prepared → independent review → payment
Targets fictitious employees, wrong rates and unauthorised changes.

How to solve Control Activities and Control Procedures questions

Use this method for any question asking you to identify, describe or recommend controls from a scenario.

  1. 1Read the requirement. Decide whether you must identify controls, state control objectives, recommend improvements or suggest tests.
  2. 2Pick out the cycle (sales, purchases, payroll, cash or inventory) and mark the facts in the scenario that show a weakness or a control.
  3. 3For each point, state the risk or control objective: what could go wrong.
  4. 4Name the control activity that addresses it: segregation, authorisation, physical, arithmetic or management control.
  5. 5Explain how it works in this business, using details from the scenario rather than generic wording.
  6. 6For deficiency questions, use the pattern: deficiency, consequence, recommendation. Make the recommendation specific.
  7. 7If asked for tests of control, state what the auditor would inspect, observe, re-perform or enquire about.
  8. 8Check that each point is separate and that you have enough points for the marks available.

Quickest way: Risk, control, why

When to use it: Use this in Section A OT case questions, and when time is short in a Section B question.

  1. Find the single risk the question is about, such as theft, fictitious payments or unrecorded sales.
  2. Match it to the control type that most directly stops it: for example, fictitious employees point to HR authorisation and independent payroll review.
  3. For multiple choice, eliminate options that are substantive procedures or do not address the stated risk.
  4. Remember all-or-nothing marking: check that the answer fits the exact wording, such as preventive or detective.

Common mistakes in Control Activities and Control Procedures

  • Listing controls without linking them to a risk in the scenario.

    Students memorise lists of controls and write them down generically.

    Fix: Start each point with the problem in the scenario, then give the control and explain how it addresses that problem.

  • Confusing tests of control with substantive procedures.

    Both involve checking documents, so they seem similar.

    Fix: A test of control checks that a control operated (for example, inspecting evidence of approval). A substantive procedure checks the balance or transaction itself (for example, recalculating an invoice total).

  • Saying segregation of duties just means different people do different jobs.

    The definition is learned without the purpose.

    Fix: Say what is separated: authorisation, recording and custody. Then explain that it prevents one person committing and concealing fraud.

  • Recommending vague improvements such as 'improve controls' or 'supervise staff more'.

    Students run out of time or ideas.

    Fix: Give a specific action, such as 'an independent clerk reconciles the bank account monthly and a manager reviews it'.

  • Giving a deficiency but no consequence.

    Students assume the examiner can see why it matters.

    Fix: State what could happen, such as overpayment or misstatement of payables, and then give the recommendation.

  • Treating controls as always effective.

    Students forget limitations.

    Fix: Remember that controls can be bypassed by management override or collusion, and can fail through human error. Mention this when evaluating reliance.

Worked examples

Example 1

A company's purchasing clerk raises purchase orders, receives goods into the warehouse, and enters supplier invoices into the ledger. Explain the control deficiency and recommend improvements.

Show the solution
  1. Deficiency: one person performs ordering, custody (receiving goods) and recording. These should be separated.
  2. Consequence: the clerk could order goods for personal use, take them, and record or hide the invoice. Fraud or error could go undetected, leading to misstatement of inventory and payables.
  3. Recommendation 1: a different employee should receive goods and complete a goods received note.
  4. Recommendation 2: orders should be approved by a manager, and a separate accounts clerk should match the order, GRN and invoice before recording.
  5. Recommendation 3: a manager should review supplier statement reconciliations regularly.

Answer: The deficiency is a lack of segregation of ordering, custody and recording, which allows undetected fraud or error. Separate the roles, require manager approval of orders, use a three-way match by an independent accounts clerk, and have a manager review supplier statement reconciliations regularly.

Example 2

Which ONE of the following is a detective control? A. Passwords to access the payroll system. B. Monthly bank reconciliation reviewed by the finance manager. C. Manager approval of purchase orders. D. Locked storage for inventory.

Show the solution
  1. A password stops unauthorised access before it happens, so it is preventive.
  2. C approval before ordering stops unauthorised purchases, so it is preventive.
  3. D physical lock prevents theft, so it is preventive.
  4. B reconciliation compares records afterwards and finds differences that have already occurred, so it is detective.

Answer: B

Exam tips

  • Always tie the control to the business in the scenario. Generic lists score poorly in Section B.
  • For deficiency questions, use deficiency, consequence and recommendation. Each part earns marks.
  • Know the three cycles well: sales, purchases and payroll. Learn the key documents and who does each step.
  • In OT questions, read for the exact wording such as preventive, detective, test of control or substantive procedure. One wrong word means zero marks.
  • If asked about controls over cash or inventory, include physical controls and independent reconciliation or counts.

Control Activities and Control Procedures in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Control Activities and Control Procedures: frequently asked questions