Advanced Auditing, Assurance and Professional Ethics · Materiality, Risk Assessment and Internal Control

Components of Internal Control under SA 315

Updated 5 October 2026 · Fact-checked

Under SA 315 (Revised 2019), the entity's system of internal control has five components: control environment, the entity's risk assessment process, the process to monitor the system of internal control, the information system and communication, and control activities. To answer a question, identify the component, state what the auditor understands, then link the weakness to the risk of material misstatement.

Understand Components of Internal Control under SA 315

Internal control is the system that management and those charged with governance design, implement and maintain to give reasonable assurance that the entity meets its objectives: reliable financial reporting, effective and efficient operations, and compliance with laws. It gives reasonable assurance, never absolute assurance, because of inherent limits such as human error, collusion and management override.

SA 315 (Revised 2019) asks the auditor to understand this system in order to identify and assess the risks of material misstatement. It groups the system into five components: the control environment, the entity's risk assessment process, the process to monitor the system of internal control, the information system and communication, and control activities. The auditor's work differs by component. For the control environment, the risk assessment process and the monitoring process, the auditor understands and evaluates the component. For the information system and communication, the auditor understands the component. For control activities, the auditor identifies controls and evaluates their design and implementation.

Think of it as a building. The control environment is the foundation: the attitude, awareness and actions of management and those charged with governance. Risk assessment is how management spots what could go wrong. The information system captures and reports transactions. Control activities are the specific policies and procedures, such as approvals, reconciliations and access restrictions, that respond to risks. Monitoring checks that the whole system keeps working over time.

The auditor must understand all five components. For the control environment, the entity's risk assessment process and the process to monitor the system of internal control, the auditor understands the component and evaluates it, for example whether the control environment supports the other components. For the information system and communication, the auditor understands the component. Identifying controls and evaluating their design and implementation applies to the control activities component. There the auditor identifies the controls relevant to the audit, for example controls addressing significant risks, journal entries, and risks for which substantive procedures alone cannot give sufficient appropriate evidence. For those identified controls (and the relevant IT general controls that support them) the auditor evaluates design and determines whether they have been implemented.

Understanding a control is different from testing it. For identified controls, understanding means evaluating design and determining implementation. Testing operating effectiveness is done only when the auditor plans to rely on controls, or when substantive procedures alone are not enough.

Key rules to remember

Five components of the system of internal control: Control environment + Entity's risk assessment process + Process to monitor the system of internal control + Information system and communication + Control activities; For the first, second and third, the auditor understands and evaluates the component. For the information system and communication, the auditor understands the component. For control activities, the auditor identifies controls and evaluates design and implementation. Use the SA 315 (Revised 2019) names.
Understanding versus testing: Understanding of identified controls = evaluate design + determine implementation. Testing = check operating effectiveness; Understanding of the system is always required. Testing is needed when relying on controls or when substantive procedures alone are insufficient.
Limitation of internal control: Reasonable assurance, not absolute assurance; Limits include human error, collusion, management override and cost-benefit considerations.
Manual versus automated controls: Manual = performed by people, prone to error and override. Automated = performed by IT, consistent, depends on general IT controls; An automated control works consistently only if general IT controls are effective.
Controls relevant to the audit: Significant risk controls + journal entry controls + controls where substantive procedures alone are not sufficient + others judged relevant; For these identified controls the auditor evaluates design and determines implementation.

How to solve Components of Internal Control under SA 315 questions

Use this method for any case or theory question on components of internal control.

1Read the facts and underline each control feature or weakness mentioned.
2Match each fact to one of the five components. Culture, integrity, governance and oversight point to the control environment. Management's identification of business risks points to risk assessment. Reviews of controls by internal audit or management point to monitoring. Recording and reporting of transactions point to the information system. Approvals, reconciliations, segregation of duties and access controls point to control activities.
3State what SA 315 requires the auditor to understand for that component.
4Classify the control as manual or automated, preventive or detective, where the question gives you enough to do so.
5Judge the effect: does the weakness or strength affect the risk of material misstatement at the financial statement level or the assertion level?
6Conclude with the impact on the audit approach: the nature, timing and extent of further audit procedures, and whether controls will be tested.
7If a deficiency is found, add that it must be communicated under SA 265.

Quickest way: Fact, Component, Risk, Response

When to use it: Use it for short case MCQs and for 4-5 mark written answers when time is tight.

Write the component name next to each fact in one or two words.
Say whether it is a strength or a deficiency.
Link it to a risk of material misstatement in one line.
Close with the audit response: more substantive work, or reliance on controls after testing.
For lists, write the five components using the SA 315 (Revised 2019) names and give one example under each.

Common mistakes in Components of Internal Control under SA 315

Using the short forms 'risk assessment' and 'monitoring' instead of the revised names for the components.
Earlier versions of the standard and older notes use shorter wording, such as 'monitoring of controls'.
Fix: The short forms are imprecise but not wrong. Prefer the SA 315 (Revised 2019) names: the entity's risk assessment process and the process to monitor the system of internal control, which is the revised name for 'monitoring of controls'. The order of listing is not a requirement of the SA, so do not lose time on it.
Placing a control activity, such as bank reconciliation, under monitoring.
Both involve checking, so they look alike.
Fix: Control activities operate on transactions and balances. Monitoring evaluates whether the control system itself is working over time.
Saying the auditor must test every control in every component.
Confusing understanding with testing.
Fix: The auditor understands the system and evaluates design and implementation of relevant controls. Operating effectiveness is tested only when reliance is planned or substantive procedures alone are insufficient.
Claiming that effective internal control eliminates the risk of material misstatement.
Overlooking the inherent limitations.
Fix: State that controls give reasonable assurance only, and that management override and collusion can defeat them.
Assuming automated controls need no further evaluation once found to be working.
Automated controls are consistent, so students treat them as reliable by default.
Fix: Add that the reliability depends on general IT controls, such as program change and access controls.
Writing a theory answer with no link to the audit.
Students describe the components as management topics.
Fix: Always end with the effect on risk assessment and on the nature, timing and extent of audit procedures.

Worked examples

Example 1

Case: In Rao Textiles Ltd, the promoter-directors often override approval limits for purchases. The audit committee meets rarely. Purchase orders above ₹5,00,000 are approved in the ERP only by the purchase head, who also records goods receipt. The company has no internal audit function. Identify the components of internal control affected and state the impact on the auditor's approach.

Show the solution

Override of limits by the promoters and a rarely meeting audit committee are weaknesses in the control environment, which covers management's attitude and the oversight by those charged with governance.
The purchase head approving orders and also recording goods receipt is a lack of segregation of duties. This is a deficiency in control activities.
No internal audit function means the entity has no formal process to monitor the system of internal control. This is a weakness in the monitoring component.
A weak control environment is pervasive. It raises risks of material misstatement at the financial statement level, and it affects the reliability of other controls.
Response: the auditor is unlikely to plan reliance on controls. The auditor will increase substantive procedures, perform more of them at or near year-end, and apply greater professional skepticism, for example on purchases and payables cut-off.
The auditor should communicate the deficiencies in writing to those charged with governance under SA 265.

Answer: Weaknesses exist in the control environment (override, weak oversight), control activities (no segregation of duties) and monitoring (no internal audit). Because the control environment weakness is pervasive, the auditor will not rely on controls and will extend substantive procedures. The deficiencies must be communicated under SA 265.

Example 2

Case: Meera Pharma Ltd's sales invoices are generated by its ERP. The system automatically blocks any invoice that exceeds the customer's credit limit. Meera's finance manager reviews a monthly exception report of blocked invoices. IT staff can change credit limits in the master data, and there is no log of such changes. Explain the type of controls and whether the auditor can rely on the credit-limit block.

Show the solution

The automatic block on invoices over the credit limit is an automated control, which is a control activity. It works consistently once programmed.
The finance manager's review of the exception report is a manual control, also a control activity. Here it is a detective control that depends on the judgment of a person.
IT staff can change credit limits in the master data with no log of changes. The unrestricted IT access and the absence of change logs are weaknesses in general IT controls, which are part of control activities. They undermine the automated credit-limit control.
Because of this weakness, the auditor cannot assume the automated block works as intended. Limits could have been changed without authorisation.
Response: the auditor should evaluate the access and change controls. If they cannot be relied on, the auditor will not rely on the automated block and will extend substantive procedures on receivables, such as confirmations and subsequent receipts.
The deficiency in general IT controls should be communicated under SA 265.

Answer: The block is an automated control and the report review is a manual control, both control activities. The unrestricted access and lack of change logs over the credit-limit master data are weaknesses in general IT controls, which are part of control activities, so the auditor cannot rely on the automated block without further evaluation. Substantive procedures on receivables should be extended, and the deficiency communicated.

Exam tips

In case MCQs, first name the component. Most options differ only in the component, so naming it eliminates wrong choices fast.
In written answers, give the SA 315 (Revised 2019) names of the five components, then apply them to the facts.
Always add the audit response: how the finding changes the nature, timing and extent of procedures.
Separate understanding from testing. Examiners often set a statement that the auditor must test all controls; it is wrong.
For manual versus automated questions, give a pair of advantages and risks of each, and mention general IT controls.

Practice questions from Materiality, Risk Assessment and Internal Control

Components of Internal Control under SA 315 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Components of Internal Control under SA 315: frequently asked questions

What are the five components of internal control under SA 315?

They are the control environment, the entity's risk assessment process, the process to monitor the system of internal control, the information system and communication, and control activities. The auditor must understand each to assess the risks of material misstatement.

What is the difference between control environment and control activities?

The control environment is the tone set by management and those charged with governance, including integrity, ethics and oversight. Control activities are the specific policies and procedures, such as approvals and reconciliations, that address identified risks. The first is pervasive, the second works at the transaction or balance level.

Does the auditor have to test all internal controls?

No. The auditor must understand the system and, for relevant controls, evaluate design and determine implementation. Tests of operating effectiveness are required only when the auditor plans to rely on controls or when substantive procedures alone cannot give sufficient appropriate evidence.

What is the difference between manual and automated controls?

Manual controls are performed by people and are more prone to error and override. Automated controls are performed by IT systems and operate consistently, but they depend on effective general IT controls. Many entities use a mix of both.