Entity-Level Controls vs. Transaction-Level Controls

Two levels, one risk picture

Entity-level controls influence how an organization governs, sets expectations and monitors its activities. Transaction-level controls address more specific risks within a process. The distinction helps design assurance, but the label alone does not prove a control is effective.

Entity-level examples include oversight, accountability, risk assessment and monitoring of other controls. Some influence the environment indirectly. Others operate with enough detail and timely follow-up to address a particular risk directly. Their precision matters as much as their organizational reach.

Transaction-level examples include verifying a purchase approval, matching receipt evidence to an invoice, or reviewing a payment exception. They focus on what can go wrong within an activity and leave evidence of the response.

Ask what the control can detect

In a hypothetical business, management reviews total monthly purchasing spend against budget. That review may identify a large variance. It may not detect a duplicate invoice hidden within an otherwise acceptable total. A specific invoice/payment check can address that different risk.

A more detailed management review could be designed to inspect duplicate-payment exceptions across the entity and follow them to resolution. Its reach is broad, but its design can be precise. Assess what is actually reviewed rather than assuming every management review is either strong or weak.

Connect design to evidence

For either level, identify the objective, risk, owner, frequency, inputs, threshold and escalation. Check whether the inputs are reliable, whether the reviewer investigates exceptions, and whether the action occurs soon enough. A sign-off shows that something was acknowledged; the supporting evidence must show what was done and why it was sufficient.

Use the two levels together in the risk-and-control map. Broad governance can support good process controls, while process exceptions can reveal weaknesses that need an entity response. Reliance depends on the actual risk coverage and operating evidence, not the control's title.

PCAOB AS 2201 provides an explanatory ICFR audit reference in a US context. This original comparison is a practical guide, not a claim that its requirements apply universally to every engagement.

Beyond the numbers. Inside the business.