Guide to Using International Standards on Auditing in - IFAC

131
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Address
Reliability of the
Controls
Existence of
Indirect Controls
Nature of Test
<strong>to</strong> Meet Objectives
Description
As a general rule, it is not worth testing controls that may prove <strong>to</strong> be unreliable,
because the small sample sizes commonly used for testing controls are based on no
deviations being found. If any of the following fac<strong>to</strong>rs are significant, it may be more
effective <strong>to</strong> perform substantive procedures (if possible):
• His<strong>to</strong>ry of errors.
• Changes in the volume or nature of transactions.
• The underlying entity-level and general IT controls are weak.
• Controls can be (or have been) circumvented by management.
• Infrequent operation of the control.
• Changes in personnel or competence of people performing the control.
• There is a significant manual element in the control that could be prone <strong>to</strong> error.
• Complex operation, and major judgments involved with its operation.
Does control depend on effective operation of other controls?
This could include non-financial information produced by a separate process, the
treatment of exceptions, and periodic reviews of reports by managers.
Tests of controls usually involve a combination of the following:
• Inquiries of appropriate personnel;
• Inspection of relevant documentation;
• Observation of the company’s operations; and
• Re-performance of the application of the control.
Note that inquiry alone would not be sufficient evidence <strong>to</strong> support a conclusion
about the effectiveness of a control. For example, <strong>to</strong> test the operating effectiveness
of internal control over cash receipts, the audi<strong>to</strong>r might observe the procedures for
opening the mail and processing cash receipts. Because an observation is pertinent
only at the point in time at which it is made, the audi<strong>to</strong>r would supplement the
observation with inquiries of entity personnel and inspection of documentation
about the operation of such internal control at other times.
CONSIDER POINT
Determine what constitutes a control deviation.
When designing a test of control, spend time <strong>to</strong> define exactly what constitutes an error or exception
<strong>to</strong> the test. This will save time spent by audit staff in determining whether a seemingly minor exception
(such as an incorrect telephone number) is, in fact, a control deviation.
Au<strong>to</strong>mated Controls
There may be some instances where control activities are performed by a computer and supporting
documentation does not exist. In these situations, the audi<strong>to</strong>r may have <strong>to</strong> re-perform some controls <strong>to</strong>
ensure the software application controls are working as designed. Another approach is <strong>to</strong> use Computer-
Assisted Audit Techniques (CAATs). One example of a CAAT is a software package that can import an entity’s