Operating Effectiveness is Still in There

I made a mistake in an earlier post about the 2021 technical update to the 2018 Yellow Book. I thought, that since the term ‘operating effectiveness’ had been taken out of one paragraph, that it was erased from the Yellow Book entirely.

Unfortunately, it was not. The concept of operating effectiveness is still in paragraph 8.50 and 8.52.

The GAO says within section 8.50 that the levels of internal control assessment that may be performed based on the audit objectives are (1) assessing the design; (2) assessing the design and implementation; or (3) assessing the design, implementation, and operating effectiveness of controls that are significant to the audit objective.

Paragraph 8.52 says (bolding added):

The design of internal control is assessed by determining whether controls individually and in combination are capable of achieving an objective and addressing the related risk.

The implementation of internal control is assessed by determining if the control exists and has been placed into operation.

The operating effectiveness of an internal control is assessed by determining whether controls were applied at relevant times during the period under evaluation, the consistency with which they were applied, and by whom or by what means they were applied.

A control cannot be effectively implemented if it was not effectively designed.

A control cannot be operating effectively if it was not effectively designed and implemented.

The word ‘effective’ is overused

Now I am not one to take the word ‘effectively’ lightly! To me, effective is a vague word that causes plenty of problems for auditors and audit clients alike.

As a matter of fact, I scrub it from audit documentations and reports when I get a chance along with the other deadly e words, economical and efficient.

And as you notice, the GAO is throwing the word ‘effectively’ around a lot in paragraph 8.52.

My audit B.S. alarm is sounding off

And this raises my well-honed auditor B.S. alarm.

To me, the term ‘operating effectiveness’ is actually unnecessary as an add on to design and implementation. Because if a control isn’t ‘operating effectively’ then it must not be well designed or implemented.

Audit teams often use the term ‘effective’ as an artifice to cover up how simple and straightforward their work actually is. The terms economical, efficient and effective are often added to audit objectives and to add a little bit of sexiness and punch.

But I notice that while auditors are very happy to put the e words in their objectives, they do not include the e words in their conclusions because they know better than to put their professional reputation behind such a indeterminate concept that cannot be backed up with firm evidence.

Operating effectiveness is being used like a blanket

In this case, the GAO is using the term operating effectiveness as a blanket over what they really want the auditor to determine, which is this laundry list of four qualities of an internal control, “whether controls were applied at relevant times during the period under evaluation, the consistency with which they were applied, and by whom or by what means they were applied.”

I think those four qualities of a good internal control (1. applied at the right time, 2. applied consistently, 3. applied by the right person, and 4. by the prescribed means) are best categorized under ‘implementation’ of controls and do not deserve a separate concept or blanket term.

But just play along

But if you want to comply with all unconditional requirements, presumptively mandatory requirements, and related guidance in the 2018 Yellow Book, you will want to use the term ‘operating effectiveness’ along with design and implementation of controls somewhere in your audit documentation.

Also make sure you have included the following terms from the 2018 Yellow Book regarding internal control in your audit documentation as well:

• Components of internal control
• Principles of internal control
• Entity level vs. transaction level controls
• Key controls
• Magnitude of impact of an internal control deficiency
• Likelihood of occurrence of an internal control deficiency
• Nature of the internal control deficiency

Audit on!

For more on this topic check out:

The GAO Green Book: Standards for Internal Control

The GAO’s Green Book – Video Course

GAGAS Performance Audit Standards – Video Course