CHAPTER 11

AUDIT PROCEDURES IN
RESPONSE TO ASSESSED RISKS:
TEST OF CONTROLS

I Putu Wibaksha Aditya P.

Putri Ayu Dwi Lestari

125020307121027
125020307121011

Assessing control risk is the process of evaluating

the effectiveness of an entitys internal control in
preventing or detecting material misstatement in
the financial statements.
The design of
internal control

The operation of
internal controls

5 Steps In Assessing Control Risk :

1. Consider the knowledge acquired from procedures to
obtain the understanding of internal controls
2. Identify potential misstatement that could occur in an
assertion
3. Identify necessary controls that would likely prevent or
detect and correct misstatements
4. Perform tests of controls to determine the effectiveness
of design and operation
5. Evaluate the evidence and assess control risk

Assessing Control Risk in an

Information Technology
Environment

There are strategies for performing

tests of controls:
1. Assessing control risk based on user controls
2. Planning for a low control risk assessment
based on application controls
3. Planning for a high control risk assessment
based on general controls and manual followup

Computer-assisted audit techniques

(CAATs) is using computer directly to
test application controls and also
known as auditing through the
computer.

When developing an audit strategy for testing computer

controls, Auditor should choose CAATs to test the
operation of specific programmed application controls:

1. Parallel simulation
2. Test data
3. Integrated test facility
4. Continuous monitoring of online real time
systems

Designing Tests of Controls

Tests of controls are designed to evaluate the

operating effectiveness of a control.
How the control was applied
The consistency with which it was applied during
the period
By whom it was applied.

Nature of Tests of Controls

1. Inquiries of appropriate entity personnel
2. Inspection of documents, reports, or electronic
files, indicating performance of the control
3. Observation of the application of the control
4. Reperformance of the application of the control
by the auditor, including the use of computer
assisted audit techniques (CAATs)

Timing of Tests of Controls

Determines the period of reliance on tests of
controls.
Auditor tests
controls only
at a particular
point in time

Auditor obtain
evidence that
control operated
effectively at that
point in time
Auditor tests
controls
throughout
the period

Auditor obtains
evidence about
operating
effectiveness
during the period
of time

Extent of Tests of Controls

Auditor should consider the following factors:
1.The nature of control
2.Frequency of operation
3.Importance of control

Staffing Tests of Controls

A final audit decision involves staffing of tests of
controls or who should perform tests of cotrols.

Audit Programs for Tests of Controls

The program lists the procedures to be used in
performing the tests pertaining to the indicated
assertions and provides columns to indicate:
1.Cross-references to the working papers where the
results of the tests are documented
2.Who performed the tests
3.The date the tests were completed

Dual Purpose Tests

Some firms use dual-purpose testing because it
may be more cost efficient to perform the tests
simultaneously rather than separately.

Additional Consideration

Assessing Control Risk For Account Balance

Assertions Affected By A Single Transaction Class
The process of assessing control risk is straight
forward for accounts that are affected by a single
transaction class.

Assessing Control Risk For Account Balance Assertions

Affected By Multiple Transaction Class
Many balance sheet accounts are significantly affected by more
than one transaction class.
The existence and occurance of accounts receivable is affected by
three transactions:
Existence and occurance of sales
Completeness of cash receipts
Completeness of sales returns and allowances
Completeness of accounts receivable is also affected by three
transactions:
Completeness of sales
Existence and occurence of cash receipts
Existence and occurence of sales returns and allowances

Documenting The Assessed Level of

Control Risk
The test of control must be documented.
Open book page 498

Communicating Internal Control Matters

The auditor is required to identify and report to the
audit committee, or other entity personnel with
equivalent authority and responsibility, certain
conditions that relate to an entitys internal control
observed during an audit of the financial
statements.