Guide to Using International Standards on Auditing in - IFAC

128
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Purpose
Tests of controls are tests designed <strong>to</strong> obtain audit evidence about the operating effectiveness of controls.
Controls can prevent material misstatements at the assertion level from occurring al<strong>to</strong>gether, or detect and
then correct them after they have occurred. The controls selected for testing would be those that provide
necessary audit evidence for a relevant assertion.
CONSIDER POINT
A walk-through procedure <strong>to</strong> determine whether a control has been implemented is not a test of
controls. It is a risk assessment procedure, the results of which may determine whether tests of controls
would be useful, and if so, how they would be designed.
Tests of controls are considered by the audi<strong>to</strong>r when:
• The risk assessment is based on an expectation that internal control operates effectively; or
• Substantive procedures alone will not provide sufficient appropriate audit evidence at the assertion
level. This might apply where sales are made over the Internet and no documentation of transactions is
produced or maintained, other than through the IT system.
Selecting sample sizes for tests of controls is addressed in Volume 2, Chapter 17 on the extent of testing.
Tests of controls are designed <strong>to</strong> obtain audit evidence about:
• How internal control procedures were applied throughout, or at relevant times during, the period under
audit. If substantially different controls were used at different times during the period, each control
system should be considered separately;
• The consistency with which internal control procedures were applied; and
• By whom or by what means controls were applied.
CONSIDER POINT
When auditing smaller entities, audi<strong>to</strong>rs often plan <strong>to</strong> perform substantive procedures, on the
assumption that tests of existing control activities would not be practical due <strong>to</strong> limited segregation of
duties, etc. Before jumping <strong>to</strong> that conclusion, consider:
• The strength of the control environment and other elements of internal control;
• Existence of control activities over assertions where it would be more efficient <strong>to</strong> gain evidence
through tests of controls; and
• Assertions where substantive procedures alone will not reduce the risks of material misstatement
<strong>to</strong> an acceptably low level. For instance, this may be the case for the completeness of revenues.