Audit, Assurance, and Control Testing
This domain tests how assurance is produced: scoping, sampling, evidence quality, and the difference between a control that exists and a control that works. Questions ask you to select a test method, evaluate a deviation, or spot a threat to independence.
Planning and scoping
Risk-based auditing starts from the risk register, regulatory obligations and change activity. Define materiality - the threshold at which a misstatement would change a decision - and audit objectives tied to assertions such as completeness, accuracy, existence, authorization and timeliness. Independence matters: the auditor must not design or operate the control it assesses, and internal audit should report to the audit committee rather than to the function it audits.
Design versus operating effectiveness
- Test of design - is the control capable of preventing or detecting the risk as written? Use walkthroughs and document review.
- Test of operating effectiveness - did it actually run consistently across the period? Use re-performance, inspection of evidence, observation and sample testing. Inquiry alone is never sufficient; it only corroborates.
- Evidence hierarchy: independently obtained, system-generated evidence outranks self-reported or manually prepared evidence.
Sampling
Statistical attribute sampling suits pass/fail controls. Define the population, confidence level, tolerable deviation rate (TDR) and expected deviation rate; these drive sample size. Test the items; if deviations exceed the TDR, the control cannot be relied upon and you expand testing or issue a finding. The conclusion applies to the population, not to individual unselected items.
Reporting
Findings carry condition, criteria, cause, effect and recommendation, with a risk rating, owner and date. SOC reports: SOC 1 covers controls relevant to financial reporting; SOC 2 covers trust services criteria (security, availability, processing integrity, confidentiality, privacy). Type I addresses design at a point in time; Type II addresses operating effectiveness over a period. A carve-out excludes subservice organizations - read the complementary user entity controls.
Worked example
A payment approval control runs monthly for 12 months, so the population is 12. The auditor sets 95% confidence, TDR 10% and expected deviation 0%, and samples all 12. Two approvals lack evidence of second review: deviations = 16.7%, above the 10% TDR. The control is therefore not effective in operation; the auditor reports a deficiency, expands sampling to characterize the rate, and evaluates compensating detective controls.
Traps
- Accepting a walkthrough as proof of operating effectiveness.
- Concluding about individual unsampled items rather than the population.
- Treating a Type I report as evidence of a full period of operation.
- Testing without documented criteria and a defined population.