Entity-level controls are the controls that operate across an organization rather than inside a single process: the tone set by the board and senior management, the code of conduct and how it is enforced, the risk assessment process, the controls over management override, the period-end financial reporting process, and the monitoring activities, including internal audit, that check whether other controls work. They matter because they shape how every process-level control behaves, and because a few of them are precise enough to catch errors directly. Auditing them well means knowing which kind each one is: most are indirect and set the conditions for everything else, some monitor other controls, and a small number operate at a precision that would prevent or detect a material error on their own. Only the last kind can reduce the testing of process-level controls.
This guide explains what entity-level controls are and where the concept comes from, the categories the PCAOB lists, the difference between indirect, monitoring and precise controls, examples mapped to the five COSO components, how the strength of entity-level controls changes process-level testing, the evidence that shows they operate, a full assessment program, how the idea applies outside SOX, the common failures, and a worked example from a newly listed software company. It sits beside the site’s guide to COSO’s 17 principles, which maps principles to entity-level controls for a bank, and the SOX scoping guide, which covers where entity-level controls enter the top-down approach.
In this guide
- What entity-level controls are
- The categories the PCAOB lists
- Indirect, monitoring and precise: the distinction that matters
- Examples by COSO component
- How entity-level controls change process-level testing
- The evidence that proves an entity-level control operates
- An entity-level control assessment program
- Entity-level controls outside SOX
- Management override: the entity-level risk that matters most
- The disclosure committee
- Entity-level controls in groups and subsidiaries
- Writing entity-level findings
- Common failures
- Worked example: a newly listed software company’s first attestation year
- Questions about entity-level controls
- Related guides
What entity-level controls are
The term comes from auditing standards for internal control over financial reporting, and it is now used well beyond them. The PCAOB’s AS 2201 describes a top-down approach: the auditor starts with the financial statements and the overall risks to internal control, evaluates the controls at the entity level, and then works down to significant accounts, assertions and process-level controls. The standard requires the auditor to test the entity-level controls that are important to the conclusion about whether internal control is effective, and notes that the evaluation of entity-level controls can increase or decrease the testing needed at the process level.
The COSO internal control framework does not use the term, but most of its seventeen principles describe entity-level controls. The control environment principles (integrity and ethics, board oversight, structure and authority, competence, accountability) and the monitoring principles are almost entirely entity-level, while the risk assessment and information and communication principles are partly so. The site’s guide to COSO’s 17 principles lists all seventeen and what each requires.
A practical definition for internal audit work: an entity-level control is a control whose effect reaches across more than one process, business unit or account, and which is owned at the level of the board, a committee, senior management or a central function rather than by a process owner.
The categories the PCAOB lists
AS 2201 gives a list of entity-level controls that auditors should consider. It is the most widely used inventory, and a useful checklist even outside SOX. The descriptions below paraphrase the standard’s categories and add examples.
| Category | What it covers | Typical controls |
|---|---|---|
| Control environment | Management’s philosophy and operating style, integrity and ethical values, and the board’s or audit committee’s oversight | Code of conduct and annual attestation; ethics hotline and investigation process; audit committee charter and meeting cadence; tone-at-the-top communications |
| Controls over management override | The risk that senior people bypass the controls that bind everyone else | Review of senior management’s journal entries and adjustments; audit committee oversight of significant estimates and unusual transactions; fraud risk assessment |
| The entity’s risk assessment process | How the organization identifies and responds to risks to its objectives | Annual enterprise risk assessment; fraud risk assessment; assessment of changes in the business |
| Centralized processing and controls | Controls operated once for many units, including shared service centers | Shared service center controls; group-wide system configurations; central treasury |
| Controls to monitor results of operations | Management’s review of performance against budgets, forecasts and prior periods | Monthly business performance reviews; board reporting; key indicator dashboards |
| Controls to monitor other controls | Activities that check whether controls work | Internal audit; the audit committee’s oversight of internal audit; self-assessment programs; the SOX program office; compliance monitoring |
| The period-end financial reporting process | How the books are closed and the financial statements prepared | Close calendar and checklist; journal entry controls; consolidation; disclosure committee; financial statement review |
| Policies addressing significant business control and risk management practices | The rules that govern how the organization operates | Delegation of authority; accounting policies; treasury and investment policies; IT security policy |
The period-end financial reporting process deserves its own mention, because the standard singles it out: it is where the numbers for the financial statements are finally assembled, and errors or manipulation there escape every process-level control. The site’s guide to auditing the financial close covers it in depth.
Indirect, monitoring and precise: the distinction that matters
AS 2201 makes a distinction that is the key to auditing entity-level controls well. Entity-level controls vary in how directly they affect the likelihood that an error will be caught.
| Type | How it works | Example | What testing it can do |
|---|---|---|---|
| Indirect | Affects the likelihood of error indirectly, by shaping the environment in which process controls operate | The code of conduct; the audit committee’s oversight; hiring and competence standards | Cannot replace any process-level test; can affect how much reliance is placed on management’s own work and how testing is designed |
| Monitoring | Monitors whether other controls are operating, and may detect their failure | Internal audit; the SOX program office’s testing; a controller’s review of reconciliation status | Can detect control failures, but usually not individual errors; may support conclusions about the control system |
| Precise | Operates at a level of precision that would prevent or detect a material error on a timely basis | A detailed monthly review of account-level results against expectations, with a low threshold and documented follow-up | Can address a risk directly, and may reduce or replace testing of some process-level controls |
Most entity-level controls are indirect, and that is not a weakness: an organization with a strong control environment has process controls that are more likely to operate as designed, and an auditor who knows the environment is weak should test process controls harder. The mistake is to treat an indirect control as if it were precise. A board that reviews quarterly results is exercising oversight; it is not detecting a 3-million-dollar misstatement in a subsidiary’s revenue.
The test for precision is the same one used for compensating controls and management review controls: what size of error would this control actually catch, and is that below the amount that matters? The site’s guides to management review controls and compensating controls explain how to establish it.
Examples by COSO component
| COSO component | Entity-level controls | What evidence usually shows |
|---|---|---|
| Control environment | Board and audit committee oversight; code of conduct with annual attestation; ethics hotline reporting to the audit committee; defined authority matrix; competence requirements for finance roles; performance measures that include control objectives | Minutes, charters, attestation completion rates, hotline case logs and their resolution, delegation records, job descriptions, incentive plan terms |
| Risk assessment | Enterprise risk assessment; fraud risk assessment; assessment of significant changes such as acquisitions, new systems and new products | The risk register and its review, the fraud risk assessment and its refresh date, change assessments with decisions |
| Control activities | Group-wide policies and procedures; general IT controls over central systems; delegation of authority | Policy approvals and review dates; ITGC test results; authority matrix and exceptions |
| Information and communication | Financial reporting policies; whistleblowing and escalation channels; communication with the board; report inventory and ownership | Policy manuals, escalation logs, board packs, the report inventory |
| Monitoring activities | Internal audit; audit committee oversight of internal audit and the external auditor; SOX or controls testing program; deficiency tracking and escalation | Audit plans and reports, committee minutes, testing results, the deficiency log and its aging |
How entity-level controls change process-level testing
The practical value of entity-level work is in what it does to the rest of the audit. The effect depends on the type of control and on whether it was found effective.
| Entity-level result | Effect on process-level testing |
|---|---|
| Strong control environment and monitoring | More confidence in management’s own testing and self-assessment; testing can be planned at interim with roll-forward; the external auditor may place more reliance on internal audit’s work |
| Weak control environment | Process-level testing should increase in extent, move closer to year-end, and include more unpredictable elements; management’s representations carry less weight |
| Precise entity-level control operating effectively | May address some risks directly, allowing fewer or no process-level controls to be tested for those risks |
| Precise-looking control that fails the precision test | Treated as indirect; no reduction in process-level testing |
| Weak controls over management override | More journal entry testing, more attention to estimates and unusual transactions, and fraud-focused procedures |
| Ineffective audit committee oversight | An indicator of a material weakness under AS 2201, and a signal that everything else deserves more skepticism |
The last row is worth knowing. AS 2201 lists ineffective oversight of financial reporting and internal control by the audit committee among the indicators that a material weakness may exist. An entity-level assessment that finds the audit committee is not exercising oversight is not a routine observation.
The evidence that proves an entity-level control operates
Entity-level controls are harder to test than transaction controls, because they operate through meetings, policies, attitudes and decisions rather than through repeated transactions. They are assessed rather than sampled, which makes the choice of evidence more important. The site’s guide to writing control descriptions makes the same point about how entity-level controls should be described.
| Control | Weak evidence | Strong evidence |
|---|---|---|
| Audit committee oversight | The committee charter | Minutes showing questions asked, challenges made, and follow-up requested and received |
| Code of conduct | The code, and a record that it was issued | Attestation completion by population, follow-up of non-attesters, cases arising under the code and how they were resolved |
| Ethics hotline | The hotline’s existence | Case volume, categories, time to resolve, reporting to the committee, and cases that led to action |
| Fraud risk assessment | A document labeled fraud risk assessment | A dated assessment covering the organization’s actual schemes and changes, reviewed by the committee, with controls mapped to each risk |
| Management’s monitoring of results | A board pack | Evidence that variances were investigated below a stated threshold and that the investigations led to corrections |
| Internal audit as a monitoring control | An approved audit plan | Plan completion, findings, validation of closed actions, and the committee’s use of the results |
| Tone at the top | A CEO message | Consistency between the message and decisions: how control breaches by senior people were handled, what incentives reward |
The last row is the hardest, and the one where auditors most often settle for weak evidence. The strongest evidence about tone is what happened when someone senior broke a rule. The site’s guide to auditing corporate culture covers the techniques for gathering that evidence, including surveys, interviews and data on how cases were resolved.
An entity-level control assessment program
The program below covers an entity-level assessment for an organization of moderate size. Each step names the procedure and the evidence; the hours are typical for a first assessment and fall in later years.
| # | Step | Procedure | Evidence | Typical hours |
|---|---|---|---|---|
| 1 | Inventory | List the entity-level controls, map each to a COSO principle and an AS 2201 category, and classify as indirect, monitoring or precise | The inventory, mapped | 16 |
| 2 | Governance | Read a year of board and audit committee minutes and packs; interview the committee chair | Minutes, packs, interview notes | 24 |
| 3 | Code and hotline | Test attestation completion; analyze hotline cases, resolution times and outcomes | Attestation data, case log | 16 |
| 4 | Risk and fraud assessment | Evaluate the risk and fraud assessments for currency, coverage of the business’s actual changes, and use | The assessments, their review records | 16 |
| 5 | Management override | Test controls over senior management’s entries, estimates and unusual transactions; run journal entry analytics | Entry data, review evidence, analytics output | 24 |
| 6 | Period-end reporting | Walk through the close, consolidation and disclosure process; test the disclosure committee’s operation | Close calendar, committee minutes, review evidence | 24 |
| 7 | Monitoring | Evaluate internal audit, the controls testing program and deficiency tracking | Plans, reports, deficiency log | 16 |
| 8 | Precision testing | For each control classified as precise, establish its actual operating precision and test it as a key control | Review evidence, thresholds, follow-ups | 24 |
| 9 | Conclusion | Conclude on each principle and component, and on whether the components operate together | Assessment memo | 12 |
Two warnings apply. Internal audit is itself an entity-level monitoring control, so an internal audit function cannot objectively assess its own effectiveness; step 7 is usually limited to documenting internal audit’s role, with the audit committee and the external quality assessment providing the evaluation. And step 8 is where most precise-looking controls turn out to be indirect, which is a useful finding in itself, because it corrects an overstatement in the control documentation.
Entity-level controls outside SOX
The concept is useful in any organization, listed or not. A private company, a public body or a charity has a control environment, a risk assessment process, controls over its senior people and a way of closing its books, and assessing them tells an internal audit function where to focus. Three uses are common.
- Risk-based planning. An annual entity-level assessment is a practical input to the audit plan: a weak control environment raises the risk of every process audit, and a strong one allows more reliance on management’s own monitoring. The site’s guide to the annual risk assessment shows where it fits.
- UK and other governance codes. Provision 29 of the 2024 UK Corporate Governance Code asks the boards of companies reporting against the Code to declare the effectiveness of their material controls, for financial years beginning on or after 1 January 2026, and many of those controls are entity-level. The site’s guide to Provision 29 covers the declaration.
- Culture and conduct reviews. The IIA’s Topical Requirement on organizational behavior, covered in the site’s conformance workbook, is in large part an entity-level assessment of how an organization’s culture and conduct are governed.
Management override: the entity-level risk that matters most
Of all the risks entity-level controls address, management override is the one that defeats every other control, because the people who can override are the people the controls report to. Auditing standards treat it as present in every organization. The PCAOB’s standard on fraud in a financial statement audit, AS 2401, requires auditors to respond to it in every audit by examining journal entries and other adjustments, reviewing accounting estimates for bias, and evaluating the business rationale for significant unusual transactions. Those three procedures are also a good map of the entity-level controls an organization should have.
| Override route | The entity-level control that addresses it | What internal audit tests |
|---|---|---|
| Journal entries and top-side adjustments by senior finance staff | Review of senior management’s entries by someone independent of them; restrictions on who can post top-side entries; journal analytics reviewed by the audit committee or internal audit | Journal entry analytics over the full population, focused on entries by senior users, round amounts, unusual timing and unusual account combinations |
| Estimates shaped to hit a target | Documented estimation methods, changes approved and disclosed, retrospective review of prior estimates against outcomes | Whether estimates moved in the direction of targets, and whether prior-year estimates were accurate |
| Unusual transactions with a thin rationale | Board or committee approval of significant unusual transactions; related-party identification and approval | The rationale, approvals and accounting for transactions outside the normal course of business |
| Pressure through incentives | Compensation committee review of how incentive plans could encourage manipulation | Incentive plan terms against the metrics they reward, and any clawback provisions |
The site’s guides to financial statement fraud and the journal entry analytics catalog cover the schemes and the tests in depth. The entity-level point is that these controls have to exist above the finance function, because the finance function’s own controls are exactly what override bypasses.
The disclosure committee
In US-listed companies, one entity-level control deserves its own mention. When the SEC adopted its rules for the quarterly and annual certifications required by Section 302 of the Sarbanes-Oxley Act in 2002, it recommended, without requiring, that companies form a disclosure committee to consider the materiality of information and determine disclosure obligations. Most listed companies did, and the committee now sits at the center of the process that supports the chief executive’s and finance chief’s certifications.
As an entity-level control, a disclosure committee is usually a monitoring or indirect control rather than a precise one: it considers whether matters need disclosure, rather than detecting numerical errors. What makes it effective is evidence that it actually considers the matters that could require disclosure, such as litigation, regulatory correspondence, control deficiencies and significant judgments, rather than meeting to approve a draft. The site’s guide to SOX 302, 404 and 906 covers the certifications it supports.
Entity-level controls in groups and subsidiaries
In a group with subsidiaries or divisions, entity-level controls exist at two levels: the group’s own, such as the board, the code of conduct and group policies, and each unit’s local version, such as a subsidiary’s own management review and local compliance with group policy. A group-level control that looks strong can be weak in practice at a unit that has a different culture, a recently acquired management team or different systems.
The usual approach is to assess group-level controls directly, and to use a structured questionnaire or self-assessment at each unit, tested by internal audit on a rotation or by risk. Units that were recently acquired, operate in higher-risk jurisdictions, or have had control failures get direct testing. The site’s guide to auditing corporate culture covers the techniques for units where culture is the main question, and the annual risk assessment guide covers how unit-level results feed the audit plan.
Writing entity-level findings
Entity-level findings are among the hardest to write, because they often concern the behavior of senior people, and a finding about tone or oversight can read as a personal criticism of the chief executive or a committee chair. The discipline is the same as for any finding: describe the condition with evidence, name the criteria, identify the cause, and state the effect. The difference is in how carefully the condition is evidenced and worded.
| Weak | Strong |
|---|---|
| “Tone at the top is poor.” | “In two of three cases where senior managers breached the expense policy in the year, no action was recorded, while comparable breaches by staff led to written warnings.” |
| “The audit committee does not provide adequate oversight.” | “Committee minutes for the year record no questions on the four significant estimates, and the committee did not receive the fraud risk assessment.” |
| “The risk assessment is out of date.” | “The fraud risk assessment was last updated before the acquisition of the two distributors and does not address the schemes their cash-based processes make possible.” |
Findings of this kind usually go to the chief audit executive’s conversation with the audit committee chair before they go into a report, both because the chair should not be surprised and because some matters, particularly those concerning the chair’s own committee, need careful handling. The site’s guide to presenting to the audit committee covers the private session where such conversations often start.
Common failures
| Failure | What it looks like | Why it matters |
|---|---|---|
| Treating indirect controls as precise | The board’s quarterly review cited as addressing revenue risk | Process-level testing is reduced on a control that could not catch the error |
| Testing the existence of documents, not the operation of controls | “The code of conduct exists” as the test of integrity and ethics | Nothing about whether the code shapes behavior has been tested |
| Ignoring management override | No specific controls identified over senior management’s entries and estimates | The risk that defeats every other control goes unaddressed |
| Stale risk and fraud assessments | Assessments not refreshed after acquisitions, new systems or new products | The controls map to yesterday’s risks |
| Internal audit assessing itself | The monitoring component concluded effective on the function’s own say-so | A self-assessment presented as independent assurance |
| No link to process-level testing | The entity-level assessment filed separately and never used | The main benefit of the work is lost |
Worked example: a newly listed software company’s first attestation year
A US software company with about 600 million dollars of revenue listed its shares two years before this example, and was approaching its first year of auditor attestation over internal control. Internal audit, three people with a co-sourced partner, was asked to assess the entity-level controls before the external auditor’s interim work. The assessment inventoried 28 entity-level controls and classified them.
| Type | Count | Examples |
|---|---|---|
| Indirect | 17 | Code of conduct and attestation; audit committee oversight; delegation of authority; competence requirements for finance roles |
| Monitoring | 7 | Internal audit; the SOX program office’s testing; the controller’s monthly reconciliation status review; the deficiency log |
| Claimed as precise | 4 | Monthly revenue review by the CFO; monthly flux review by the controller; quarterly disclosure committee; quarterly review of stock compensation expense |
The precision test changed the picture. Of the four controls documented as precise, only one survived: the quarterly review of stock compensation, performed by the controller against a recomputation of every grant, with a threshold well below materiality and a record of corrections made. The monthly revenue review looked at revenue by product line against forecast and investigated variances above 10 percent; with revenue of about 50 million dollars a month, that let errors of several million dollars pass without question, well above the level the external auditor would regard as material. The flux review had a similar threshold and little evidence of follow-up. The disclosure committee met as scheduled, but its minutes recorded discussions, not reviews of specific disclosures. All three were reclassified as indirect or monitoring controls, and the process-level testing of revenue, which management had hoped to reduce, stayed at its full extent.
Two other findings came from the indirect controls. The fraud risk assessment had been written for the listing and not refreshed, although the company had since introduced usage-based pricing, which changed where revenue could be manipulated. And the ethics hotline received a handful of cases a year, all resolved, but none had ever been reported to the audit committee in anything more than a count. Both were fixed before year-end: the fraud assessment was refreshed with the usage-based pricing schemes mapped to controls, and the committee began receiving a summary of every case with its outcome.
The company received a clean attestation in its first year. The internal audit lead’s summary of what mattered most was the reclassification: the precise-looking controls had been documented in the listing process by consultants who described what the reviews were meant to do, and nobody had checked what they actually did. The site’s guide to pre-IPO SOX readiness describes the same risk from the other end of the timeline.
Questions about entity-level controls
What is the difference between entity-level and process-level controls?
Entity-level controls operate across the organization and are owned by the board, committees, senior management or central functions. Process-level controls operate inside a specific process, such as payables or payroll, and are owned by process managers. The first shape the environment; the second prevent or detect specific errors in specific transactions.
Can entity-level controls replace process-level controls?
Only precise entity-level controls, and only for the risks they address at sufficient precision. Most entity-level controls are indirect and cannot replace any process-level test, though they affect how testing is designed.
Is the code of conduct a control?
It is part of the control environment, and its annual attestation, training and enforcement are controls. The document alone is not; what matters is whether it is communicated, attested, and enforced when it is breached.
How often should entity-level controls be assessed?
Annually in most programs, with interim updates when something significant changes, such as an acquisition, a new system, a change of CEO or CFO, or a serious incident.
Is internal audit an entity-level control?
Yes: it is one of the monitoring activities the PCAOB’s list names. That is also why internal audit cannot objectively assess its own effectiveness, which is left to the audit committee and the external quality assessment.
Do entity-level controls need to be in the risk and control matrix?
Yes, if they are relied on. Many programs keep a separate entity-level matrix mapped to the COSO principles, linked to the process-level matrices. The site’s risk and control matrix template can hold both.
Are entity-level controls the same as company-level controls?
Yes. Entity-level, company-level and organization-level controls are used interchangeably. Some firms also speak of “pervasive controls”, which usually means the same thing, although some use it to include general IT controls because their effect reaches many applications.
Who owns entity-level controls?
Each one needs a named owner, like any other control: the board or a committee for oversight controls, the chief executive or chief financial officer for tone and the financial reporting process, the chief risk officer or equivalent for risk assessment, the general counsel or compliance officer for the code of conduct and the hotline. An entity-level control owned by “the organization” is owned by nobody, which the site’s guide to control ownership explains.
Related guides
- COSO’s 17 principles — the framework entity-level controls map to, with a bank’s assessment.
- SOX scoping — where entity-level controls enter the top-down approach.
- SOX 404 — management’s assessment and the auditor’s attestation.
- Compensating controls — the same precision test, applied to a gap.
- Key vs non-key controls — deciding which controls carry the risk.
- Management review controls — establishing the precision a review really has.
- Control deficiency evaluation — including the audit committee indicator of a material weakness.
- Auditing corporate culture — evidence for the hardest entity-level controls.
- The fraud risk assessment — the entity-level control most often left stale.
- How to audit the financial close — the period-end reporting process in depth.
- Pre-IPO SOX readiness — building entity-level controls before listing.
- The Organizational Behavior Topical Requirement — culture and conduct governance as an entity-level assessment.
Leave a Reply