Management Review Controls: Design, Testing, and Deficiencies

Under PCAOB Auditing Standard 2201, management review controls must be evaluated on two fronts: whether they are designed with enough precision, competence, and reliable data to prevent or detect a material misstatement, and whether they actually operated that way throughout the period. Inspectors keep finding gaps on both. In 2024, deficiencies related to testing controls with a review element made up 27% of all ICFR auditing deficiencies the PCAOB identified, the single largest category of internal control audit failures.¹ The reason is consistent across inspection cycles: engagement teams treat these controls as sign-offs rather than interrogating what the reviewer actually did.

What Counts as a Management Review Control

A management review control is an activity where a qualified person reviews financial or operational data to catch potential misstatements before they reach the financial statements. Unlike automated controls that execute the same logic every time, an MRC depends entirely on the reviewer’s ability to analyze information, spot anomalies, and challenge the assumptions behind the numbers.

These controls show up wherever significant judgment enters the close process. A controller reviewing the allowance for credit losses against historical loss rates and current economic conditions is performing an MRC. So is a CFO evaluating whether the assumptions in a goodwill impairment model still hold. They operate above the transactional level, checking the outputs of the processes that generate the underlying data.

AS 2201 recognizes that entity-level controls vary in precision. Some only indirectly affect misstatement risk, some monitor the effectiveness of lower-level controls, and some operate precisely enough to prevent or detect material misstatements on their own.² Where an MRC lands on that spectrum drives how much additional testing the auditor has to do on the controls beneath it.

Why the PCAOB Keeps Flagging MRCs

The Board’s overview of its inspection program lists deficiencies tied to management review controls alongside revenue recognition, loan loss allowances, and other accounting estimates as among the most common findings.³ The 2024 data confirms the pattern, with testing of controls having a review element generating more deficiency comment forms than any other ICFR category.¹

The failures cluster around a few specific patterns. Engagement teams fail to evaluate the actual review procedures the control owner performed, particularly when assessing the reasonableness of assumptions in valuations. They skip testing whether the methods used by the company to develop estimates conform to the applicable financial reporting framework. And they neglect to evaluate whether the control owner genuinely scrutinized projected amounts for revenue growth and costs used in impairment analyses.¹

PCAOB Staff Audit Practice Alert No. 11 identified a related issue. Some firms, implementing the required top-down audit approach, placed excessive emphasis on testing MRCs and other detective controls without considering whether those controls actually addressed the assessed risks of material misstatement for the relevant account or disclosure.⁴ Heavy reliance on an imprecise review control creates a false sense of audit coverage.

Evaluating Whether the Control Is Designed to Work

Before testing whether a control actually works, the auditor has to determine whether it could work if operated as intended. AS 2201 requires testing design effectiveness by evaluating whether the control, if operated by someone with the right authority and competence, would satisfy the company’s control objectives and prevent or detect errors or fraud that could produce material misstatements. Walkthroughs that combine inquiry, observation, and document inspection are ordinarily sufficient for this purpose.²

Precision of the Control

Precision is the dimension of design that trips up most MRC evaluations. A review that asks a manager to look at a line item and confirm it “looks reasonable” is not precise enough to catch a material misstatement. Staff Audit Practice Alert No. 11 lays out the interrelated factors that determine precision.⁴

Investigation threshold. For detective controls, the threshold that triggers follow-up when actual results deviate from expectations must be sensitive to potential material misstatements. A variance threshold of 20% when materiality is 3% of the balance will not catch much.
Level of detail. A control performed at a granular level is more precise than one performed on highly aggregated data. Reviewing revenue by product line catches problems that reviewing total revenue misses.
Predictability of expectations. The control must develop expectations specific enough to highlight potentially material misstatements. A comparison to prior period is useful only if the reviewer has a basis for expecting a particular relationship between periods.
Connection to the assertion. A control directly related to the relevant assertion is more precise than one only indirectly connected. A review targeting the valuation of a specific portfolio is more precise than a general P&L review that might incidentally catch a valuation issue.
Mandatory follow-up. The design must require documented investigation and resolution when variances exceed the threshold. A review that identifies a discrepancy but requires no action is not functioning as a control.

The core question is whether the MRC, as designed, operates at a level of precision that would adequately prevent or detect material misstatements on a timely basis. If it does, the auditor may be able to reduce testing of lower-level controls. If it does not, additional controls must be identified and tested to cover the gap.²

Competence and Objectivity of the Reviewer

AS 2201 requires the auditor to determine whether the person performing the control possesses the necessary authority and competence to perform it effectively.² For MRCs, this assessment carries extra weight because the entire value of the control rests on the reviewer’s ability to identify problems in complex information. A reviewer who lacks expertise in the applicable accounting standard or the business dynamics driving an estimate cannot meaningfully challenge the preparer’s work.

The auditor evaluates competence by considering job function, relevant experience, professional qualifications, and demonstrated understanding of the account or process under review. In smaller companies with limited accounting staff, the standard acknowledges that management may use third-party specialists to supplement internal competence, and the auditor may consider the combined capabilities when assessing whether the control is adequately staffed.²

Objectivity is the other half. A control where the person who prepared an estimate is also the sole reviewer of that estimate lacks the structural independence needed for genuine challenge. The reviewer must have organizational standing to require adjustments. If preparer and reviewer report to the same person whose incentives are tied to the outcome, the control’s design is compromised regardless of the reviewer’s technical skills.

Reliability of the Information the Reviewer Uses

An MRC is only as good as the data feeding it. A reviewer who performs a flawless variance analysis on inaccurate data has accomplished nothing. AS 1105 sets specific requirements when audit evidence includes information produced by the company. The auditor must either test the accuracy and completeness of that information directly, or test the controls over its accuracy and completeness, including applicable IT general controls and automated application controls.⁵

Management reports cannot be accepted at face value. If an MRC relies on a system-generated report comparing actual results to budget, the auditor needs evidence that the report pulls the right data, that the data is complete, and that no manual manipulation occurred between system output and the reviewer’s desk. AS 1105 further provides that company-produced information and externally sourced electronic data are more reliable when the company’s controls over that information are effective.⁵

For MRCs over accounting estimates, AS 2501 adds another layer. The auditor must evaluate whether the methods used to develop the estimate conform to the applicable financial reporting framework, whether the data is relevant to the measurement objective, and whether the data is internally consistent with how the company uses it elsewhere.⁶

Defined Methodology and Documentation Built Into the Design

A well-designed MRC specifies exactly what the reviewer must do, not just that a review must occur. The methodology should define the comparisons to be made (budget, prior period, industry benchmarks, or independent expectations), the data sources to be used, and the criteria for evaluating results. It must require contemporaneous documentation of the review, including what was analyzed, what was found, and what action was taken.

Design falls short when the control allows an informal or undocumented review process. A signature or initial on a report with no indication of what procedures were performed, what variances were identified, or what conclusions were reached does not demonstrate that a genuine review occurred. The methodology must also explicitly connect the review activity to the financial reporting assertion it addresses, whether existence, completeness, valuation, or another relevant assertion.

Testing That the Control Actually Operated

After confirming design, the auditor has to gather evidence that the MRC worked throughout the audit period. AS 2201 requires testing whether the control operated as designed and whether the person performing it had the necessary authority and competence.² The nature, timing, and extent of that testing depend on risk.

How Risk Drives the Extent of Testing

Not all MRCs require the same depth of testing. AS 2201 ties the necessary evidence to the risk that the control might not be effective and, if ineffective, the risk that a material weakness would result. The more extensively a control is tested, the greater the evidence obtained.² Factors that increase risk include:

Materiality of the account. Controls over accounts with larger financial statement exposure carry higher stakes.
Complexity and judgment. Controls requiring significant judgment in their operation are inherently riskier than mechanical ones.
History of errors. Accounts with past misstatements demand more evidence that the control is working.
Personnel changes. If the person performing the control has changed, the auditor has less basis for assuming consistent operation.
Reliance on other controls. An MRC that depends on effective IT general controls or lower-level transaction controls inherits the risk of those dependencies.

Different combinations of inquiry, observation, document inspection, and re-performance can satisfy the evidence requirement for a given risk level. A lower-risk quarterly review might be adequately tested through document inspection and targeted inquiry. A high-risk year-end impairment review typically demands re-performance alongside detailed examination of the reviewer’s work.²

Re-Performance

Re-performance means the auditor independently executes the control activity using the same data and criteria management used, then compares the result. For quantitative MRCs this might involve recalculating a key ratio, independently developing an expectation for a financial metric, or re-evaluating the reasonableness of a specific assumption in a valuation model.

Re-performance is the most persuasive test of operating effectiveness because it directly confirms whether the control reached the right conclusion. Any discrepancy between the auditor’s independent result and management’s documented conclusion is a deviation that must be evaluated. This is where auditors commonly fall short in inspections: they accept management’s conclusion without independently testing it against the underlying data.

Examination of Evidence

Document inspection is the workhorse procedure for most MRC testing. The auditor reviews the evidence management retained, looking for clear signs that the review happened, happened on time, and included appropriate follow-up. Useful evidence includes completed checklists, dated sign-offs, meeting minutes, variance analyses with written explanations, and documented resolutions for identified issues.

The documentation must connect the dots: what variance was identified, what investigation was performed, what conclusion was reached. A review where the reviewer identified a 15% variance but documented no follow-up is a control failure, not merely weak documentation. The absence of evidence that the reviewer acted on anomalies undermines the entire premise of the control.

Walkthroughs

Walkthroughs serve double duty. They are ordinarily sufficient to evaluate design effectiveness, and in some cases they provide evidence of operating effectiveness as well, depending on the risk associated with the control and the specific procedures performed during the walkthrough.² During a walkthrough, the auditor follows a transaction from origination through the company’s processes, using the same documents and systems company personnel use, and asks probing questions at each point where important processing occurs.

For MRCs, the walkthrough should go beyond narrow tracing of a single transaction. The auditor should ask the reviewer to explain how they develop expectations, what thresholds trigger investigation, how they handle unexpected variances, and what happens when they disagree with the preparer’s conclusions. These questions reveal whether the reviewer genuinely understands and executes the control or merely follows a routine without meaningful analysis.

Timing and Roll-Forward Procedures

Auditors often test controls at an interim date to gain efficiency and identify problems early enough to address them before year-end. When controls are tested before the as-of date, the auditor must perform roll-forward procedures to extend the conclusion through the end of the period.²

The nature of the roll-forward work depends on four factors: the risks associated with the specific control tested and the results of those interim tests, the sufficiency of the interim evidence, the length of the remaining period between the interim date and year-end, and whether any significant changes to the control or the control environment occurred after the interim date.² When these factors indicate low risk that the control stopped working during the remaining period, inquiry alone may suffice as a roll-forward procedure. Controls that address year-end specific transactions or significant non-routine estimates are typically tested as of the balance sheet date rather than relying on interim testing with a roll-forward.

Classifying MRC Deficiencies

When auditors identify problems with a management review control, the next step is deciding how severe those problems are. AS 2201 requires the auditor to evaluate every control deficiency that comes to attention and determine whether the deficiencies, alone or in combination, constitute a material weakness as of the assessment date.²

Significant Deficiency vs. Material Weakness

A material weakness is a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement in the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe than a material weakness but important enough to warrant the attention of those overseeing the company’s financial reporting.⁷

Severity hinges on two dimensions: the likelihood that the company’s controls will fail to catch a misstatement, and the magnitude of the potential misstatement that could result. Severity does not depend on whether a misstatement actually occurred. A control can be materially weak without ever producing an error, if the conditions make one reasonably possible.²

Factors That Drive Severity

Several risk factors influence whether a deficiency in an MRC crosses the material weakness line. AS 2201 identifies the nature of the financial statement accounts involved, the susceptibility of the related assets or liabilities to loss or fraud, the degree of subjectivity or judgment required to determine the amount, and the interaction of the deficiency with other controls.² MRC deficiencies tend to score high on several of these factors at once because the controls typically cover the most subjective accounts in the financial statements.

Multiple deficiencies affecting the same account or assertion can combine into a material weakness even though none would qualify individually. An MRC with an imprecise threshold, operated by a reviewer who lacks relevant expertise, using unvalidated data, creates compounding risk that may well cross the line. The auditor also considers whether compensating controls elsewhere mitigate the weakness, but those compensating controls must themselves operate at a level of precision sufficient to catch material misstatements.²

What Happens When It’s a Material Weakness

When the auditor identifies a material weakness, AS 2201 requires an adverse opinion on the company’s internal control over financial reporting.² The adverse opinion must define the term “material weakness,” identify the specific weakness, and describe its actual and potential effect on the financial statements. The auditor must then determine whether the material weakness affects the opinion on the financial statements themselves.

If management’s own assessment fails to disclose or properly identify the material weakness, the auditor’s report must say so, and the auditor must communicate this to the audit committee in writing.² An adverse ICFR opinion signals to investors and regulators that the company’s financial reporting infrastructure has a gap serious enough for material errors to slip through undetected.

Documentation Both Sides Must Keep

Documentation is the evidence trail for both management’s assertion about ICFR effectiveness and the auditor’s opinion on it. Weak documentation is one of the fastest ways to turn a functioning control into an audit deficiency.

What Management Must Retain

Management’s documentation has to demonstrate that the MRC was actually performed, not just that someone signed a report. For a review control, this means retaining evidence of the analysis performed, the data reviewed, the variances identified, the investigation conducted for any variance exceeding the threshold, and the conclusion reached. For controls involving calculations or models, management should retain the underlying calculation support and the rationale for key assumptions.

A date matters. A sign-off without a date does not establish that the review occurred within the timeframe the control requires. A signature without any indication of the scope or depth of the review performed provides little comfort that the control operated as designed.

What the Auditor Must Document

PCAOB standards establish a clear principle for audit documentation: the quality and integrity of an audit depends on maintaining a complete and understandable record of the work performed, the conclusions reached, and the evidence obtained.⁸ For MRC testing specifically, the working papers must document the scope of testing, the selection methodology, the specific control instances tested, and the results.

Any deficiencies identified must be documented along with an assessment of their severity. Documentation of findings inconsistent with the auditor’s final conclusion must be retained, not discarded. If documentation is absent and it later appears that procedures may not have been performed, the auditor must demonstrate through other persuasive evidence that the work was done. Oral explanation alone is not enough.⁸

1
Public Company Accounting Oversight Board. Staff Update on 2024 Inspection Activities Spotlight
2
Public Company Accounting Oversight Board. AS 2201 An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
3
Public Company Accounting Oversight Board. Basics of Inspections
4
Public Company Accounting Oversight Board. Staff Audit Practice Alert No. 11
5
Public Company Accounting Oversight Board. AS 1105 Audit Evidence
6
Public Company Accounting Oversight Board. AS 2501 Auditing Accounting Estimates Including Fair Value Measurements
7
Public Company Accounting Oversight Board. Auditing Standard No. 5 Appendix A Definitions
8
Public Company Accounting Oversight Board. AS 1215 Audit Documentation Appendix A