Modern Auditing:

Assurance Services and the Integrity of Financial Reporting, 8th Edition

William C. Boynton
California Polytechnic State University at San Luis Obispo

Raymond N. Johnson
Portland State University

Chapter 11 Audit Procedures in Response to Assessed Risks: Tests of Controls

Chapter 11 Overview

Assessing Control Risk

In assessing control risk, the auditor must evaluate the effectiveness of : Design of internal controls Operation of internal controls

Steps in Assessing Control Risk

Process for Assessing Control Risk

Consider Knowledge Acquired from Procedures to Obtain an Understanding

Identify Potential Misstatements

Process for Assessing Control Risk

Identify Necessary Controls
Nature of controls to prevent or detect and correct misstatements Nature of controls implemented by management
Significance of each control Risk that designed controls may not operate effectively

Control Design for Specific Assertions

Completeness Assertion Existence or Occurrence Assertion Valuation and Allocation Assertion Presentation and Disclosure Assertion

Identify Necessary Controls

Process for Assessing Control Risk

Perform Tests of Controls
Evidence about effectiveness of the design and operation of controls

Evaluate Evidence and Make Assessment

Matter of professional judgment Identify strengths and deficiencies Express quantitatively or qualitatively

Strategies for Performing Tests of Controls in an IT Environment

User Controls

Application Controls

General Controls and Manual Followup Procedures

Overview of Computer Controls

Computer-Assisted Audit Techniques (CAATs)

Auditing through the computer Advantageous when:
Significant part of internal controls is imbedded in a computer program Significant gaps in visible audit trail Large volumes of records to be tested

Types of CAATs
Parallel Simulation Test Data Integrated Test Facility Continuous Monitoring of On-line Real-time Systems

Parallel Simulation versus Test Data

Continuous Monitoring of OnLine Real-Time Systems

Continuous Monitoring Audit Hook Tagging Transactions Audit Log

Methodologies for Meeting the Second Standard of Fieldwork

Study Break
1. This step in assessing control risk allows the auditor to consider the points at which errors or fraud could occur. A. Evaluate Evidence B. Perform Tests of Controls C. Identify Potential Misstatements D. Identify Necessary Controls C. Identify Potential Misstatements

Study Break
2. This CAAT uses dummy transactions that are processed under auditor control by the clients computer system and the output is evaluated against expectations. A. Parallel Simulation B. Test Data C. Integrated Test Facility D. None of the above B. Test Data

Effects of Preliminary Audit Strategies

Primarily Substantive Approaches

Lower Assessed Level of Control Risk

Designing Tests of Controls

Designed to evaluate the operating effectiveness of a control concerned with:

How the control was applied Consistency with which it was applied By whom it was applied

Nature of Tests of Controls

Inquiries of entity personnel Inspection of items indicating performance of the control Observation of the application of the control Reperformance of the application of the control by the auditor

Timing of Tests of Controls

One Occasion versus Multiple Occasions Timing Issues
Interim Period

Remaining Period
Results from Prior Periods

Extent of Tests of Controls

Nature of the Control

Frequency of Operation

Importance of the Control

Designing Tests of Controls

Staffing Tests of Controls

Audit Programs for Tests of Controls

Dual-Purpose Tests

Additional Considerations
Assessing Control Risk for Account Balance Assertions Affected by a Single Transaction Class Assessing Control Risk for Account Balance Assertions Affected by Multiple Transaction Classes

Account Balance Assertions and Transaction Class Assertions

Account Balance Assertions and Transaction Class Assertions

Documenting the Assessed Level of Control Risk

Control Risk Assessed at the Maximum
Only the conclusion is documented

Control Risk Assessed at Below the Maximum

Basis for assessment must be documented

Communicating Internal Control Matters

Internal Control Deficiency

Significant Deficiency

Material Weakness

Study Break
3. While evaluating the operating effectiveness of a control, the tests of controls are concerned with all of the following except: A. How the control was applied B. The consistency with which it was applied C. When it was applied D. By whom it was applied C. When it was applied

Study Break
4. Auditors are required to report a deficiency in internal controls to management and the audit committee when there is a(n): A. Internal Control Deficiency B. Significant Deficiency C. Material Weakness D. No Deficiencies B. Significant Deficiency and C. Material Weakness