Testing Controls in a Controls Reliance Audit Dr. Donald K. McConnell Jr. CPA, CFE, Ph.D. 11/24/2018
When Testing Controls in a Controls Rely Audit: [The following comments are based on the audit program guide (APG) steps 2-a through 2-h listed on packet page 14-1.] Auditors select a sample of transactions throughout the period to be tested, e.g.: 50 sales invoices, checks, etc., randomly or haphazardly selected For the nine months ended September 30, ten months ended October 31, etc. Intent is to see if all the prescribed controls were properly applied [controls placed in operation were operating effectively] 11/24/2018
Testing Controls in a Controls Rely Audit (con) Such tests are actually “dual tests,” part substantive tests (ST) of details and part tests of controls (TC): [SAS 110.33] Examples: Verifying sales invoice amount agrees with entry to sales journal or system: ST Mathematics of sales invoices correct: ST A shipping document exists for each sale invoice in the sample: TC A customer P.O. exists: TC Documentation exists for credit evaluation of each sale in sample: TC 11/24/2018
Testing Controls in a Controls Rely Audit (con) Though dual testing, primary objective is testing controls as opposed to substantive testing!* If no control deviations found in sample, control risk can be assessed less than maximum Thereby allowing auditor to reduce extent of year-end substantive procedures Think of it this way: seeing that a control was performed correctly 50 times in a sample 50 sales invoices indicates a strong likelihood that the control is operating effectively. On the other hand, if one sales invoice in 25,000 has a material misstatement, what is the probability it would be found in your sample of 25 sales invoices? 11/24/2018
Sales and Collection Cycle Financial Statements General ledger Sales journal or file (Recorded entry) Sales invoices Shipping documents (Source document), customer P. O.’s, price lists Occurrence Cpl. 11/24/2018
Important to Understand Concept of Directional Testing! [SAS 110.56] Dual testing (transactions level testing) for occurrence assertion, versus Dual testing (transaction level testing) for completeness assertion 11/24/2018
Testing Occurrence Assertion Vouching from recorded entry [financial statement amount] to source document [relevant audit evidence] In sales cycle: Recorded entries are in sales journal or file Most elementary source document evidencing transaction occurred is shipping document Therefore vouch sample of 50 sales invoices [underlying entry in sales journal or file] to related shipping documents for 9 months ended Sept. 30 Auditing direction: top-down 11/24/2018
Testing Completeness Assertion Tracing from source document [relevant audit evidence] to recorded entry [financial statement amount] Therefore trace sample of 50 shipping documents to related sales invoices [underlying entry in sales journal or file] for 9 months ended Sept. 30 Auditing direction: bottom-up 11/24/2018
Does It Make Sense to Test in Both Directions? Greater risk for a public company usually is overstated sales (occurrence transaction assertion violation) and therefore receivables (balances existence assertion violation): Sample for testing transaction controls emphasizes occurrence assertion Completeness assertion risk (being lower) addressed through analytical procedures, i.e. gross profit test Greater risk for a private entity often understated (skimmed) sales: Sample for testing transaction controls emphasizes completeness assertion Occurrence assertion risk (being lower) addressed through analytical procedures, i.e. gross profit test 11/24/2018
What Is the Audit Implication? Where sales and receivables overstatement is greater risk: Test transaction controls for occurrence assertion (testing is top-down) Ordinarily would not test controls for completeness assertion (APG step 2-f would not be done) Completeness assertion for transactions, being less risky, tested through analytical procedures (gross profit test) 11/24/2018
What Is the Audit Implication? (Con.) Where sales and receivables understatement is greater risk: Test transaction controls for completeness assertion (testing is bottom-up) Ordinarily would not test transaction controls for occurrence assertion (APG step 2-c would not be done) Existence and occurrence assertions, being less risky, tested through analytical procedures (gross profit test) 11/24/2018
Pudge REALLY Looked Weird In a Marlins Uniform! 11/24/2018
11/24/2018
11/24/2018