Key control — Modern Auditing

A control relied on to address a risk to the point that its failure would, on its own, mean the risk is not adequately mitigated.

The designation matters because it determines where testing effort goes. Key controls get tested; non-key controls generally do not. That makes the key/non-key call one of the highest-leverage judgments in a control programme, and one of the least examined.

Two failure modes recur. The first is designating too many, usually out of caution — a programme with 900 key controls has not been careful, it has failed to make a decision, and the testing burden it created is why nobody has time to test anything well. The second is designating too few, or designating around difficulty: a control quietly becomes non-key because testing it is painful.

A useful discipline is to require the reasoning to be written next to the designation, not stored in the head of whoever made it three years ago. “This is key because it is the only control addressing completeness of the revenue population” is checkable. “Key — per prior year” is how a programme drifts.