Management override: a fraud risk on every audit
Why the people who run a client's controls can bypass them, where override shows up in the numbers, and the audit responses that address it.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Controls are designed by management, operated by people management employs and, in a small company, monitored by management itself. That is not a criticism of any client; it is simply how organisations work. It does mean that the people with the most power to misstate the figures are also the people best placed to step around the controls meant to stop them.
So the risk that management overrides controls does not depend on how good the controls look. It is present wherever there is management, which is to say on every audit. This article explains why, where override shows up, and how to respond in a way a reviewer can follow.
The people who run the controls can step around them
Investopedia states that internal controls provide only reasonable assurance of a company's financial accuracy, and can be undermined by management override and by collusion between employees. Its explainer on internal controls sets those limits out next to the main types of control.
Override is different from an ordinary control failure. A failed control did not work as designed. An overridden control worked perfectly until someone with authority chose to bypass it: telling a clerk to post an entry, approving their own request, changing a system setting, or assuring the auditor that a document exists when it does not. Because override relies on authority rather than a gap in the process, testing whether controls are well designed and operating will not reveal it. The response has to be substantive and aimed at where override leaves traces in the numbers.
Those traces tend to appear in three places: journal entries, accounting estimates and significant transactions outside the normal course of business.
Journals that one person can create and approve
AccountingTools advises that the ability to create journal entries should be separate from the authority to approve them. In many owner-managed and mid-sized clients it is not. The financial director both posts and approves, the owner has full system rights, or the package has no approval step at all. Find out who can post, who can approve and whether anyone reviews journals after they are posted. Where one person can do both, the journal population becomes a central evidence area.
Characteristics worth targeting include entries posted after the close or on the last day of the year, round amounts, postings to suspense or rarely used accounts, entries to revenue, provisions and accruals with vague descriptions, entries made by senior people who do not normally post, and entries reversed shortly after year end.
Bias in estimates: override in disguise
Override does not need a fictitious entry. Management can reach the same result by choosing assumptions: a smaller doubtful debt provision, a longer useful life, a brighter forecast in an impairment test. Each assumption may sit inside a reasonable range. Together, always leaning the same way, they move profit.
The IAASB states that ISA 540 (Revised) fosters a more independent and challenging sceptical mindset in auditors when auditing accounting estimates. Two habits put that into practice. Compare last year's estimates with what actually happened, to see whether management's judgements have a pattern. And look at the direction of all the significant judgements together rather than one at a time. Auditing accounting estimates covers the detail.
Unpredictability and the fraud lens
ACCA lists, among overall responses under ISA 330 to risks at the financial statement level, adding unpredictability to the selection of further audit procedures, alongside emphasising professional scepticism, using more experienced staff and changing supervision. A finance team that knows exactly which accounts the auditor tests, above what amount and in which week, knows where not to put an adjustment. Vary the work: include small journals as well as large ones, examine an account not usually looked at, change the timing of a test.
The IAASB states that ISA 240 (Revised) emphasises a fraud lens in the auditor's risk assessment and in the responses to identified risks. For override, that means asking in every area of the plan the same question: if management wanted a particular answer here, how would it get it, and what would we see?
Flagging unusual journals and drawing samples in Achekam
Achekam's Journal Entry Testing takes the client's whole-population journal extract as a CSV file. Staff map its columns, and Achekam flags entries such as manual, weekend, after-hours and post-close postings for the team to select and test. Two habits make that work stand up. Reconcile the extract's totals to the trial balance before relying on it, so the population is known to be complete. And treat the flags as prompts: deciding which entries to test, and what the results mean, stays with the team.
Where the team wants a risk-weighted or statistical selection on top of targeted items, Audit Intelligence risk-scores a loaded population and proposes a sample, a reviewer who did not prepare the plan approves it before it is drawn, and the draw can be reproduced from its stored seed. Many teams combine the two: every post-close manual entry to revenue, say, plus a sample from the rest of the population. Journal entry testing explains the population and selection decisions in more depth.
Documenting the response so a reviewer can follow it
The override paper should let a reviewer trace the reasoning from start to finish:
- Who in the entity could override which controls, and how.
- How the journal population was obtained and shown to be complete.
- The criteria used to select entries, and why they fit this client.
- What was examined for each entry, and the result.
- The estimates reviewed for bias, including the comparison with last year's outcomes.
- Any significant transactions outside the normal course of business, and how their business rationale was assessed.
- The conclusion, in a sentence that says what the evidence showed.
Override is the one fraud risk that never goes away, however small or well run the client. Treat it as a fixed part of every plan, and write the response so the next reviewer does not have to guess what was done.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
