Internal Control, Audit Evidence and Testing
Understanding internal control
The auditor obtains an understanding of the five components of internal control: the control environment, the entity's risk assessment process, the information system and communication, control activities, and monitoring. Control activities include authorisation, segregation of duties, reconciliations, physical controls, and IT general controls. Candidates must distinguish preventive from detective controls and know that segregation of duties prevents one person from initiating, recording and authorising a transaction.
Tests of controls versus substantive procedures
A test of controls evaluates operating effectiveness; a substantive procedure detects material misstatement. Substantive procedures comprise tests of detail and substantive analytical procedures. If controls are effective, the auditor may reduce substantive testing - but some substantive work is always required for material classes of transactions, account balances and disclosures.
Evidence quality
Evidence must be sufficient (quantity) and appropriate (relevance and reliability). Reliability hierarchy: external evidence > internal; original documents > copies; auditor-obtained > client-provided; documentary > oral. Know the procedures: inspection, observation, external confirmation, recalculation, re-performance, analytical procedures and inquiry. Inquiry alone is never sufficient.
Sampling and IT
Understand statistical vs non-statistical sampling, sampling risk vs non-sampling risk, and the effect of population size and tolerable misstatement. For IT, know application controls (input, processing, output) and general IT controls (access, change management, operations).
Traps
- Assuming a walkthrough test proves operating effectiveness - it does not.
- Believing strong controls eliminate the need for substantive testing.
- Treating inquiry as sufficient evidence.
- Confusing sampling risk (sample not representative) with non-sampling risk (human error, wrong procedure).
Rule of thumb
Ask: does this procedure test the control, or the number? If it tests the number, it is substantive.