A significant class of transactions in auditing is a grouping of similar economic events — the sales cycle, payroll, purchasing, and the like — where a misstatement could reasonably be large enough or sensitive enough to mislead investors, which is why that class must be scoped into the internal control over financial reporting (ICFR) evaluation. Significance is judged on two tracks at once: the dollar size of what flows through the class, and qualitative risk factors like estimation, judgment, related parties, and fraud exposure. Getting the list right determines what gets documented, what gets tested, and where the audit’s attention concentrates.
What a Class of Transactions Actually Is
A class of transactions is a group of individual economic events that share common characteristics and flow through the accounting system in the same way. Sales transactions drive revenue and accounts receivable. Purchasing transactions drive expenses and accounts payable. Payroll drives wage expense and related liabilities. Grouping similar events this way lets a company design standardized controls rather than policing every individual entry.
Not every class carries the same weight. The whole point of the ICFR evaluation is to concentrate on classes where a misstatement could actually matter to a reader of the financial statements. Those are the significant classes. Everything downstream — control documentation, walkthroughs, operating effectiveness testing — follows from that scoping decision.
How a Class Earns the “Significant” Label
The SEC’s interpretive guidance tells management to use a top-down, risk-based approach: start at the financial-statement level, identify where a material misstatement could occur, and work downward to the controls that address those risks.1U.S. Securities and Exchange Commission. Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting A transaction class gets flagged as significant through a combination of quantitative size and qualitative risk. Both tests apply, and either one on its own can bring a class into scope.
Quantitative Size
The starting point is materiality. If a class generates account balances that are large relative to benchmarks like total revenue, pre-tax income, or total assets, it is quantitatively significant. A common preliminary screen uses something around 5% of pre-tax income, but the SEC has made clear that a percentage threshold is the beginning of the analysis, not a safe harbor.2U.S. Securities and Exchange Commission. SEC Staff Accounting Bulletin No. 99 – Materiality A misstatement that looks small against income could still be material if it trips a loan covenant or distorts a ratio investors rely on.
Volume matters as much as size per transaction. Payroll is the standard example: thousands of recurring entries that collectively represent a substantial expense and liability. Rapid growth in volume, or a sudden change in the nature of transactions within a class, is itself a trigger to reassess significance.
Qualitative Risk
Qualitative factors frequently override the numbers. A class is qualitatively significant when it involves complex accounting estimates, heavy management judgment, or non-routine entries. Revenue recognition is almost always in this category because it requires interpreting contract terms, allocating variable consideration, and judging when performance obligations are satisfied. The dollar amount is almost beside the point; the complexity itself creates the risk.
Related-party transactions are inherently higher risk. The competitive, arm’s-length pricing dynamics that discipline ordinary dealings may not exist, and these transactions carry specific disclosure requirements, so controls have to address both recognition and disclosure.
Classes dominated by estimation — fixed assets and depreciation, inventory valuation, the allowance for doubtful accounts — tend to qualify as significant for the same reason. For manufacturers, inventory and fixed assets almost always qualify. FASB requires inventory to be measured at the lower of cost and net realizable value, which means controls have to catch obsolete or slow-moving stock before the balance is overstated.3Financial Accounting Standards Board. Accounting Standards Update 2015-11 Inventory Topic 330 Simplifying the Measurement of Inventory
Non-Routine Events
Non-routine classes — business combinations, asset impairments, debt restructurings — pose disproportionate risk because the people processing them have less practice with them and the accounting often involves one-off judgments. The SEC has specifically noted that nonroutine transactions can raise challenging classification issues and that companies should identify them early enough in the reporting cycle to allow proper evaluation.4U.S. Securities and Exchange Commission. The Statement of Cash Flows – Improving the Quality of Cash Flow Information Provided to Investors Many ICFR failures trace back to a non-routine event that nobody ran through the standard control framework until it was too late.
Mapping a Significant Class to Financial Statement Assertions
Calling a class significant is only useful if it points the evaluation at the right risks. Each significant class gets linked to the specific assertions where a misstatement is reasonably possible.5PCAOB. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Assertions are the implicit claims management makes every time it publishes financial statements.
For transactions, the key assertions are:
- Occurrence: Recorded transactions actually happened. Testing sales for occurrence means confirming each recorded sale corresponds to a real delivery or service.
- Completeness: All transactions that should have been recorded were recorded. Weak controls over cash disbursements can leave liabilities off the books entirely.
- Accuracy: Amounts and supporting data were recorded correctly. Miscalculations in inventory costing violate this assertion.
- Cutoff: Transactions landed in the correct accounting period. This matters most near period end.
- Classification: Transactions were recorded in the appropriate accounts.
For balances tied to those classes, the focus shifts to existence, rights and obligations, completeness, and valuation and allocation. A third group covers presentation and disclosure.
The pairings aren’t abstract. Inherent fraud risk tends to concentrate around occurrence for revenue (fictitious sales) and completeness for liabilities (unrecorded obligations), so those are typically where testing is most rigorous. If you’ve determined that the highest risk in the purchasing cycle sits with completeness, that is where controls over receiving documentation, three-way matching, and independent review need to be strongest.
Classes That Are Always Significant Because of Fraud Risk
Some classes come into scope automatically. Cash handling, related-party transactions, and manual journal entries are always treated as significant because of their susceptibility to manipulation. PCAOB standards require specific procedures to test journal entries recorded in the general ledger and other adjustments made during financial statement preparation, directly targeting the risk that management overrides otherwise sound controls.6PCAOB. AS 2401 – Consideration of Fraud in a Financial Statement Audit
When selecting journal entries to test, auditors look for red flags: entries to unrelated or seldom-used accounts, entries made by people who don’t normally post them, entries recorded at the end of the period or as post-closing adjustments with little explanation, and entries containing round numbers or a suspiciously consistent ending digit.6PCAOB. AS 2401 – Consideration of Fraud in a Financial Statement Audit None of these characteristics proves fraud, but each flags an entry that deserves scrutiny. Testing typically focuses on the end of the reporting period, though entries throughout the year may also be examined depending on assessed risk.
What You Do With a Significant Class
Once a class is on the list, three things happen: the processes are documented, the controls are walked through for design, and the controls that matter are tested for operating effectiveness.
Document the Process and Identify Key Controls
For each significant class, the company builds process flowcharts that trace a transaction from initiation through authorization, processing, and posting. Every point where a human intervenes or an automated control operates gets identified. The documentation typically culminates in a control matrix that links each key control to the process step it governs, the assertion it addresses, the person responsible, and how often it runs.
A key control is one whose failure would create a reasonable possibility of a material misstatement not being prevented or detected in time.7PCAOB. Auditing Standard No. 5 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Not every control in the process makes the cut. The goal is to find the controls whose absence would leave a gap big enough for a material error to pass through.
Walk the Controls Through for Design
A walkthrough confirms the controls are designed correctly. It traces one or a few transactions through the full documented process. Under PCAOB AS 2201, walkthroughs usually combine inquiry, observation, inspection of relevant documentation, and re-performance of the control.5PCAOB. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements A control is effectively designed if it is capable of preventing or detecting a material error in the relevant assertion. If a walkthrough shows that an approval can be bypassed or that no one actually reviews the exception report the system generates, the design is ineffective and must be remediated before operating effectiveness testing begins.
Test Whether the Controls Actually Worked
Design effectiveness asks whether a control could work. Operating effectiveness asks whether it did work, consistently, throughout the period. Four testing methods carry the weight:
- Inquiry: Asking the control owner and others how the control works and whether they’ve encountered exceptions.
- Inspection: Examining documents, system logs, or reports for evidence the control was performed — a signature on a purchase order, a timestamp on an approval workflow, a reconciliation with review sign-off.
- Observation: Watching the control performed in real time, needed for controls that leave no documentary trail.
- Re-performance: Independently executing the control to verify the same result. Strongest evidence, most time-intensive.
Sample sizes track how often the control runs and the confidence needed. A daily control generates hundreds of instances a year and requires a larger sample than a quarterly one. Automated controls, when the underlying IT general controls are effective, can often be tested with very small samples because they perform the same way every time; weak IT general controls can undo that assumption and pull every dependent automated control back into question.
If the deviation rate exceeds the tolerable rate, the control is ineffective. Management then remediates and may need to expand substantive testing on the related account balance to see whether the weakness actually produced a misstatement.
Significant Classes Processed by a Service Organization
Outsourcing a significant class does not take it out of scope. Payroll providers, loan servicers, and cloud-based accounting platforms frequently process transactions that feed directly into the financial statements, and the controls at those organizations fall within the ICFR evaluation.
The standard mechanism for seeing into a service provider’s controls is a SOC 1 report, which focuses specifically on outsourced services that could affect financial reporting. A SOC 1 Type 2 report is the most useful because it covers both the design and operating effectiveness of the provider’s controls over a specified period.
Reading the report is not enough. SOC 1 reports almost always identify complementary user entity controls — controls the service organization expects the client to maintain on its end. A payroll provider may process calculations accurately while assuming the client controls who can authorize payroll changes and who reviews the output. Missing these complementary controls is one of the most common ICFR failures in outsourced environments. If a provider cannot furnish a SOC 1, management has to find another route to evaluate the controls, whether through direct testing, contractual audit rights, or alternative assurance procedures.
What Happens If a Significant Class Is Missed or Mishandled
Section 404 of the Sarbanes-Oxley Act requires each annual report filed by a public company to contain a management assessment of the effectiveness of its ICFR.8GovInfo. Sarbanes-Oxley Act of 2002 Public Law 107-204 Material weaknesses existing as of the year-end assessment date must be disclosed publicly, and any material changes to internal controls must be disclosed in subsequent quarterly and annual reports.9U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports
Disclosure alone does not satisfy the obligation. In 2019, the SEC brought settled enforcement actions against four public companies that had reported ICFR material weaknesses for seven to ten consecutive years without meaningfully remediating them. Penalties ranged from $35,000 to $200,000, and one company was required to retain an independent consultant to oversee remediation.10U.S. Securities and Exchange Commission. SEC Charges Four Public Companies With Longstanding ICFR Failures The SEC stated that disclosure of material weaknesses is not enough without meaningful remediation.
For accelerated and large accelerated filers — those with a public float of $75 million or more — the external auditor must also issue an opinion on ICFR effectiveness, adding another layer of scrutiny. Smaller reporting companies below that threshold are exempt from the auditor attestation under SOX Section 404(b) but still have to perform and report on management’s own assessment. Correctly identifying the significant classes, mapping them to the assertions that matter, and testing the controls that address the highest risks is how companies stay out of the cycle of disclosure, remediation, and regulatory attention that follows from getting the scoping wrong.