Reaching a Consensus on Management Review Controls
Management review controls are often subjective, complex to analyze, and harder to audit than other kinds of financial information.
Requirements from the Public Company Acccounting Oversight Board are causing auditors to require a level of precision and specificity for management review controls beyond prior years. Auditors are also reviewing far more documentation than they use to. At the same time, there is a lack of clarity on what exactly is sufficient in management review controls and how precise they need to be. This is troubling, since MRCs are crucial to the financial reporting process.
Management review controls (MRCs) are the reviews conducted by management of estimates and other kinds of financial information for reasonableness. They require significant judgment, knowledge, and experience. These reviews typically involve comparing recorded amounts with expectations of the reviewers based on their knowledge and experience. The reviewer’s knowledge is, in part, based on history and, in part, may depend upon examining reports and underlying documents. MRCs are an essential aspect of effective internal control.
Any review of analyses involving an estimate or judgment (examples: estimating a litigation reserve or estimating the percentage of completion for long-term construction projects);
- Reviews of financial results for components of a group;
- Comparisons of budget to actual; and
- Reviews of impairment analyses.
MRCs are significantly different from other kinds of controls, however. In particular, MRCs have a higher-level focus than transaction controls, as they examine aggregated results rather than individual transactions. Also, MRCs are inherently subjective. Unlike transaction controls, which are “yes/no,” MRCs typically involve some level of subjectivity and uncertainty (i.e., shades of grey, not black and white). In addition, they require knowledgeable and experienced reviewers who have an understanding of the business at a level of detail that enables them to identify issues for follow-up. What’s more, MRC reviewers often rely on data from other sources, not data they personally create or have direct control over.
Since MRCs are often subjective, they can be complex to analyze and harder to audit than other kinds of financial information that are more objective and concrete. However, despite their inherent challenges, MRCs are absolutely essential to the financial reporting process and usually cannot be replaced by other types of controls.
Management reviews provide a unique and crucial perspective and reality check that transcends the details of normal transaction controls (i.e., seeing the forest, not just the trees). No amount of detailed scrutiny can ever replace the valuable big picture insights gleaned from a higher-level management review. Nor can automated or transactional reviews ever take the place of detailed management reviews of estimates or results of components. Read more on CFO.