If an Internal Control Was Tested Last Year Does It Have to Be Tested Again

Nearly auditors don't perform a examination of controls? But should they? Beneath I explain when such a examination is required. I too explicate why some auditors choose to use this test even when not required.

One time risk cess is consummate, auditors have three further audit procedures they can use to respond to identified risks:

1. Test of details
2. Noun analytics
3. Test of controls

This article focuses on the third option.

Below you volition see:

• The Right Response
• Not Testing Controls (including video about the aforementioned)
• The Decision Regarding Testing
• How to Test Controls
• Required Tests
• Which Controls to Test
• Three-twelvemonth Rotation of Testing
• Interim or Period-End Testing

The Correct Response

Which responses to risks of material misstatement are best? That depends on what yous discover in risk assessment.

If, for example, your client consistently fails to tape payables, so assess control take a chance for abyss at high and perform a search for unrecorded liabilities (a substantive procedure).

By contrast, if the internal controls for receivables are strong, then appraise control risk for the existence assertion at less than high, and exam controls for effectiveness. (You do, still, have the option to perform noun tests rather than exam controls, even when controls are appropriate. More than about this in a moment.)

Not Testing Controls

Many auditors assess control risk at high (afterwards chance assessment is complete) and use a fully noun approach. That is fine, specially in audits of smaller entities. Why? Because smaller entities tend to take weaker controls. As a result, controls may non be effective. Therefore, y'all may non be able to assess control run a risk at less than high.

Control take chances assessments of less than high must be supported with a test of controls to prove their effectiveness. But if controls are not constructive, you must assess control take chances at high. This is ane reason why you might bypass testing controls: you know, either from prior experience or from electric current-year walkthroughs, that controls are not effective. If your test reveals ineffectiveness, you lot are back to square one: a command take a chance assessment of high. And then substantive procedures are your only option. In such a situation, the initial test was a waste of time.

The Decision Regarding Testing

But if controls are effective, why not test them? Doing so allows you to reduce your substantive procedures. There is one reason, still, why you lot might not test controls even though they appear advisable: noun tests may take less time.

Once risk cess is complete, your responses—the farther audit procedures—are based on efficiency and effectiveness. If control testing takes less time, then use this pick. If substantive procedures takes less time, and then perform a exam of details or use substantive analytics. But, regardless of efficiency considerations, accost all risks with advisable responses.

How to Test Controls

Suppose you've decided to test controls for effectiveness. Merely how? Let's wait at an case starting with risk cess.

Hazard Assessment

Your approach to testing controls depends on risk.

For example, suppose your billing and collections walkthrough reveals appropriate segregation of duties. Yous see that authorized personnel issue receipts for each payment received. Additionally, you decide that total daily cash inflows are reconciled by the collections supervisor to the online depository financial institution statement, and she signs off on a reconciliation sheet as show of this procedure. Lastly, you lot note that a person non involved in greenbacks collections reconciles the monthly bank statement. In other words, controls are properly designed and in use.

Furthermore, you believe abyss is a relevant assertion. Why? Theft of incoming cash is a concern since the business handles a loftier volume of client checks. If checks are stolen, cash collections would non be complete. Consequently, the inherent risk for abyss is loftier. The fraud hazard is a significant gamble which requires a test of details in add-on to the test of controls.

Test Supports Effectiveness

Now it's time to examination for effectiveness.

Test the receipt controls on a sample basis. Merely before doing so, document the controls you desire to test and the sample size determinations. (See AICPA's Audit Sampling standard, AU-C 530.)

The commencement control you are testing is the issuance of receipts by an authorized person and your sample size might exist sixty.

The second control yous are testing is the daily reconciliation of cash to the bank statement. For case, you could agree total daily receipts to the banking company statement for twenty-five days. As y'all exercise so, you review the daily sign-offs on the reconciliation sheets. Why? The collection supervisor's sign-off is the testify that the control was performed.

The third control you are reviewing is the reconciliation of the banking concern business relationship by a person not involved in the receipting process. So, you lot review the year-stop bank reconciliation and confirm that the person that reconciled the bank argument was non involved in cash collections.

Once the tests are performed, determine whether the controls are effective. If they are, assess control chance for the completeness assertion at less than high. Now you have support for that lower assessment.

And what about substantive tests?

You need to perform a test of details since a meaning risk (the fraud risk) is present. Yous might, for example, reconcile the daily total receipts to the general ledger for a calendar month.

Test Doesn't Back up Effectiveness

If your tests do non support effectiveness, aggrandize your sample size and examine additional receipts. Or skip the tests (if you believe the controls are non effective) and move to a fully noun approach. Regardless, if controls are non effective, consider the need to communicate the command deficiency to direction and those charged with governance.

So, when should you test controls? Kickoff let'southward wait at required tests and so optional ones.

Required Audit Tests of Controls

Here are ii situations where you lot must test controls:

• When there is a significant risk and you lot are placing reliance on controls related to that risk
• When substantive procedures don't properly address a run a risk of cloth misstatement

Permit me explain.

Auditing standards allow a 3-yr rotation for command testing, as long as the area tested is non a significant gamble. Merely if the auditor plans to rely on a test of controls related to a significant take a chance, operating effectiveness must be tested annually.

Likewise a test of controls is necessary if substantive procedures don't properly address a chance of cloth misstatement. For example, consider the controls related to reallocation of investments in a 401(k). The participant goes online and moves funds from one account to another. Other than the participant, there are no humans involved in the process. When processes are fully automated, substantive procedures may not provide sufficient audit evidence. If that is your state of affairs, you lot must test of controls. Thankfully, a type two service organization control report is usually available in audits of 401(m)s. Such a report provides evidence that controls have already been tested past the service organization's accountant. And you tin can place reliance upon those tests. In near cases, noun procedures can properly address risks of material misstatement. And then this exam requirement is usually not relevant.

Optional Audit Test of Controls

We but covered the two situations when testing is required.All other control testing is optional.

Prior to making the decision nearly testing, consider the following:

• Do you anticipate effectiveness? At that place's no need to test an ineffective command.
• Does the command relate to an exclamation for which you desire a lower control risk?
• Will it take less time to test the control than to perform a noun process? Sometimes yous may non know the reply to this question until you perform the exam of controls. If the initial exam does not show effectiveness, then you accept to expand your sample or just punt—in other words, use a fully substantive approach.
• Volition you use the control testing in conjunction with a exam of details or substantive analytics? How would effective controls reduce these substantive tests? In other words, how much noun testing time would you salvage if the control is constructive?
• Is the control evidence physical or electronic? For example, are the entity'due south receipts in a physical receipt book or in a computer? Information technology's ordinarily easier to test electronic show.
• How large will your sample size be? Some controls occur once a month. Others, thousands of times in the menses. The larger the population, the larger the sample. And, of course, the larger the sample size, the more fourth dimension it will accept to perform the test.
• Can you test the population as a whole without sampling? Data analytics software—in some instances—tin can be used to test the entire population. For example, if a purchase gild is required for all payments higher up $5,000, it might exist easy to compare all payments higher up the threshold to purchase orders, assuming the buy orders are electronic.

Iii-Yr Rotation of Testing

Every bit I said earlier, audit standards allow a three-year rotation for testing. For instance, if you test accounts payable controls in 2020, then y'all tin wait until 2023 to examination them again. In 2021 and 2022, you demand to ensure that these controls have non changed. You also want to determine that those controls have standing relevance in the current audit. How? Encounter if the controls go on to address a take chances of cloth misstatement. And every bit you perform your almanac walkthroughs, enquire about changes, notice the controls, and inspect documents. Why? You want to know that everything is working as it was in 2020, when the initial test was performed. And, aye, yous practise need to perform those walkthroughs annually , if that is how you approve your understanding of controls.

In brusque, testing for effectiveness tin, in near cases, occur every three years. But walkthroughs are necessary each year. If yous tested sixty transactions for an appropriate purchase order in 2020, so you can wait until 2023 to practice so again. Simply review of the purchase society process each year in your annual walkthroughs.

So should you test controls at acting or after year-end?

Interim or Period-Terminate Testing

Some auditors examination controls after the period-end (afterwards year-end in almost cases). Others at interim. Which is best?

It depends.

Perform interim tests if this fits better in your work schedule. Hither's an example: You perform an acting exam on November one, 2021. Later, say in February 2022, consider whether controls have changed during the terminal two months of the yr. See if the same people are performing those controls. And consider performing boosted tests for the Nov 1 to December 31 catamenia. Once done, decide if the controls are effective.

Testing on an interim date is not ever the reply. For example, if direction is inclined to dispense earnings near year-end, then interim tests may not be appropriate.

If you choose to exam after menstruum-end, then do so for the total catamenia existence audited. Your sample should be representative of that timeframe.

Then should you e'er test controls at a point in time and non over a menstruum of time? Yes, sometimes. For example, test inventory count controls at year-cease only. Why? Well those controls are just relevant to the yr-end count, a point in time. Nearly controls, withal, are in use throughout the period you are auditing. Therefore, you demand to test those controls over that period of time (e.g., year).

Conclusion

Equally I said above, many auditors tend to rely fully on noun responses to the risks of fabric misstatement. But, in some cases, that may not be the best or wisest arroyo. If controls are designed well and functioning, why non examination them? Especially if it takes less time than noun procedures.

Finally, take a look at my 2 related articles regarding responses to the take a chance of fabric misstatement: (one) Examination of Details: Noun Procedures and (2) Substantive Analytical Procedures: Ability Upwards.

potterpossloved.blogspot.com

Source: https://cpahalltalk.com/test-of-controls/#:~:text=In%20short%2C%20testing%20for%20effectiveness,2023%20to%20do%20so%20again.

Share this post