Guide to Using International Standards on Auditing in - IFAC

132
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
data file (such as sales or payables), which can then be tested. Such programs can analyze client data <strong>to</strong>
provide the audit evidence needed. In addition, they provide the potential <strong>to</strong> perform much more extensive
testing of electronic transactions and account files. Some possible uses of CAATs are outlined below.
Exhibit 10.5-4
Use of CAATs
Typical Types of
Procedures
Extract specific records such as payments more than a specified amount or
transactions before a given date.
Extract <strong>to</strong>p or bot<strong>to</strong>m records in a database.
Identify missing and duplicate records.
Identify possible fraud (using Benford's Law).
Select sample transactions from electronic files which match predetermined
parameters or criteria.
Sort transactions with specific characteristics.
Test an entire population instead of a sample.
Recalculate (add up) the <strong>to</strong>tal monetary amount of records in a file (such as inven<strong>to</strong>ry)
and check extensions such as pricing.
Stratify, summarize, and age information.
Match data across files.
Smaller entities often use off-the-shelf packaged accounting and other relevant software without
modification. However, many software packages actually contain proven application controls that could be
used by the entity <strong>to</strong> reduce the extent of errors and possibly deter fraud. Audi<strong>to</strong>rs might want <strong>to</strong> ask their
clients whether these controls are being used and, if not, whether there would be value in using them.
Timing of Tests of Controls
Paragraph #
Relevant Extracts from ISAs
330.11 The audi<strong>to</strong>r shall test controls for the particular time, or throughout the period, for which the
audi<strong>to</strong>r intends <strong>to</strong> rely on those controls, subject <strong>to</strong> paragraphs 12 and 15 below, in order <strong>to</strong>
provide an appropriate basis for the audi<strong>to</strong>r’s intended reliance. (Ref: Para. A32)
330.12 If the audi<strong>to</strong>r obtains audit evidence about the operating effectiveness of controls during an
interim period, the audi<strong>to</strong>r shall:
(a) Obtain audit evidence about significant changes <strong>to</strong> those controls subsequent <strong>to</strong> the
interim period; and
(b) Determine the additional audit evidence <strong>to</strong> be obtained for the remaining period. (Ref:
Para. A33-A34)
330.15 If the audi<strong>to</strong>r plans <strong>to</strong> rely on controls over a risk the audi<strong>to</strong>r has determined <strong>to</strong> be a significant
risk, the audi<strong>to</strong>r shall test those controls in the current period.
Tests of controls may provide evidence of effective operation:
• At a particular point in time (i.e., physical inven<strong>to</strong>ry count); or
• Over a period of time, such as the period under audit.