ABC Retail & Logistics Ltd. has established several internal controls to safeguard its assets and ensure reliable financial reporting. Cash and…

CA Intermediate · Auditing and Ethics · MTP · September 2026
ABC Retail & Logistics Ltd. has established several internal controls to safeguard its assets and ensure reliable financial reporting. Cash and cheque books are required to be kept in a locked safe, with access restricted to authorized personnel. The company has also installed fire extinguishers and smoke detectors in all warehouses to protect inventories from fire hazards. In addition, an imprest petty cash system has been introduced, under which only expenditure below ₹10,000 can be paid through petty cash. During the statutory audit, the auditor observed that the safe containing cash and cheque books was often left unlocked during office hours, some fire extinguishers had expired and several smoke detectors were non-functional, and petty cash vouchers exceeding ₹10,000 had been processed through the imprest system without approval. The engagement partner remarked that although the entity had established appropriate controls, there was a possibility that these controls were not operating effectively. Explain the concept of Control Risk with examples. Also comment on the situations identified by the auditor in the above case.

Suggested Answer and Working Notes:

Control risk In accordance with SA-200, control risk is the risk that a misstatement that could occur in an assertion about a class of transaction, account balance or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity's internal control. Control risk is a risk that internal control existing and operating in an entity would not be efficient enough to stop from happening, or find and then rectify in an appropriate time, any material misstatement relating to a transaction, balance of an account or disclosure required to be made in the financial statements of that entity. Therefore, in a way, it can be said that there exists an inverse relation between control risk and efficiency of internal control of an entity. When efficiency of internal control of an entity is high, the control risk is low and when efficiency of internal control of that entity is low, the control risk is high. Examples of control risk could include: A company has devised control that cash and cheque books should be kept in a locked safe and access is granted to authorized personnel only. There is risk that control is not being followed. An entity has devised a control that fire extinguishers and smoke detectors are in place and are in working condition at all times to reduce the risk of damage to inventories caused by fire. There is a risk that fire extinguishers in place are expired and are not being refilled. Similarly, there is a possibility that smoke detectors are not working. A company has devised a control relating to petty cash that items of expenditure of only less than ₹10,000 should be routed through imprest system of petty cash. There is a risk that control is not being followed. In the given case, the deficiencies observed by the auditor indicate that although appropriate internal controls have been designed by the entity, they are not operating effectively. Consequently, the entity is exposed to a higher level of control risk, which the auditor needs to consider while planning and performing further audit procedures.

Topics: Risk Assessment and Internal Control

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic