What does management override mean on the CPA exam?
Last reviewed
Management override. Management using its authority to bypass controls that otherwise work. Presumed a risk on every audit, because no control can be designed to stop the people who design the controls.
Defined against AU-C 240.31.
Worked example
A family-owned manufacturer has well-designed controls, a stable finance team and no fraud history, and the auditor assesses the fraud risk on the engagement as low. The chief financial officer can post journal entries directly to the general ledger. On December 31 the CFO posted a $250,000 entry crediting revenue and debiting an unbilled receivable, outside the normal invoicing process.
Which procedures does the auditor perform for the risk of management override, and how does that December 31 entry figure in them?
- Examine journal entries and other adjustments for whether they were appropriate. Entries made at the period end, posted by senior staff, outside the normal process or to unusual accounts are selected, so the CFO's $250,000 entry is tested against support.
- Review accounting estimates for bias, including a look back at how last year's estimates actually turned out.
- Evaluate the business reason for any significant unusual transactions, which an off-cycle revenue entry on the last day of the year may be.
Answer: All three procedures are performed, and the December 31 entry is one of the journal entries selected and examined. The low fraud risk assessment changes none of this.
The trap: Scaling these procedures back because fraud risk was assessed as low. The risk of management override is presumed on every audit, because the people who design the controls can step around them, so the three responses are required regardless.
Based on AU-C 240.31; AU-C 240.32.
Which CPA exam sections use management override?
Management override appears in the AUD section of the CPA exam.
Related terms
- management's specialist: An expert management uses to help prepare the financial statements, such as an actuary or an appraiser.
- analytical procedures: Evaluations of financial information by studying plausible relationships among financial and nonfinancial data.
- written assertion: Management's own signed statement that the description is fair and the controls are suitably designed.
- senior management: The people who direct and control the entity day to day, as distinct from those charged with governance, whose job is to oversee them.
- audit committee: A subcommittee of the board of directors that oversees financial reporting and the external audit.
- further audit procedures: The work done in response to assessed risk: tests of controls and substantive procedures.