4024 Develop the testing strategy

Dec-2022

OAG Guidance

We develop and apply an appropriate audit strategy in order to obtain reasonable assurance about whether the financial statements as a whole are free of material misstatement. Part of determining the audit strategy is to develop our testing strategy, which means how, in broad terms, we expect to obtain our audit evidence. Our testing strategy consists of a combination of expected controls reliance and planned substantive evidence. As described in OAG Audit 5043.3, we consider both likelihood and magnitude in assessing the risk of material misstatement for FSLI’s and document our conclusion as to the level of inherent risk using a range that we describe as a “normal,” “elevated” or “significant” level of inherent risk. It is our initial risk assessment that drives the development of our testing strategy, including the nature, timing, and extent of procedures to be performed. Through executing our testing strategy for each identified risk of material misstatement (RoMM) we intend to obtain sufficient appropriate audit evidence to reduce audit risk to an acceptably low level. Professional judgment is required in determining the testing strategy and the corresponding amount of audit evidence that we deem necessary to address the identified risk(s) of material misstatement. The testing strategy for each identified RoMM will vary based on the level of inherent risk. For example, the testing strategies for two accounts with individual risks of material misstatement at different points along the inherent risk spectrum (e.g., normal and elevated) are likely to have a different audit response in terms of the nature, timing and extent of combinations of expected controls reliance and planned substantive evidence.

Sufficient appropriate audit evidence for each relevant assertion may be achieved either through a combination of test of controls and substantive procedures or through a single or multiple substantive procedures. Sufficient appropriate evidence is evaluated from the aggregate of evidence obtained from all testing performed over relevant assertions for a particular FSLI such that multiple testing procedures performed to achieve different levels of assurance can aggregate to sufficient appropriate evidence.

OAG Guidance

In developing our testing strategy, it may be efficient and effective to place reliance on the continued effective operation of the entity’s controls and consequently take credit for the reliability of the management information that results in the entity’s external financial reporting. Once we have determined how much evidence we have from testing the operating effectiveness of controls in respect of each relevant assertion, we can determine the nature, timing and extent of our substantive testing. Considering the risk of material misstatement and the nature of the FSLI, we decide whether substantive analytics or tests of details would be the most effective and efficient way to obtain the necessary substantive evidence. Because the risk of material misstatement takes account of internal control, the extent of substantive procedures may need to be increased as a result of unsatisfactory results from tests of the operating effectiveness of controls. Alternatively, we may decide early on that controls are likely to be ineffective and we will need to obtain all or most of our evidence from substantive testing.

The diagram below shows the principal questions to consider in deciding whether our audit plan will allow us to obtain sufficient appropriate audit evidence to address the assessed risks at an assertion level for a class of transactions, account balance, or disclosure. Although the diagram shows a linear flow, gathering and evaluating audit evidence is an iterative process and decisions on whether sufficient appropriate evidence has been obtained are taken at many different stages throughout the audit.

Decisions on whether or not we have sufficient appropriate audit evidence are based on our judgment, considering the materiality and inherent risk factors against the quality of the evidence provided, the rigor of our testing and the results of all our work. When making these decisions we consider that certain audit procedures may be more appropriate for some assertions than others.

View actual size

† When responding to a significant risk, it is unlikely that audit evidence obtained from testing controls and performing substantive analytics alone will be enough, and some tests of details responding specifically to the significant risk are likely to be necessary. When our approach to a significant risk consists only of substantive procedures, CAS 330 requires us to include tests of details in our audit plan. Tests of details are normally required for various account balances and classes of transaction (e.g., cash, marketable securities, accounts receivable, long‑term debt, etc. (confirmations) and inventories (physical observation)).

† † Note that substantive analytics are generally more applicable to large volumes of transactions that tend to be predictable over time. The suitability of a particular analytic will depend on our assessment of how effective it will be in detecting a material misstatement. Substantive analytics would normally provide more evidence when applied to income statement accounts, rather than balance sheet accounts. Risk assessment analytics and completion analytics need to be performed on all audits.

Related Guidance

See OAG Audit 6050 for guidance on the development of the controls test plan.

See OAG Audit 7010 for guidance on the development of the substantive test plan.

OAG Guidance

Expected controls reliance is the level of evidence (expressed as None, Partial or High) we expect to obtain from testing the entity’s controls for operating effectiveness, including controls evidence gathered in prior audits, if appropriate. Our decision to place reliance on controls takes into account both our assessment of control risk and view on the efficiency of obtaining evidence from controls testing compared to substantive testing. For example, when we assess control risk as low (i.e., our understanding of controls to this point indicates the entity has implemented controls that appear effective in addressing risks related to relevant financial statement assertions) and it is considered more efficient to obtain assurance from controls testing rather than performing only substantive procedures, we may consider expected controls reliance as High or Partial. Alternatively, when controls appear effective in mitigating the risk but we judge it more efficient to obtain all our evidence through substantive testing, expected controls reliance is considered as None.

High controls reliance

We plan to achieve high controls reliance when we expect to be able to obtain sufficient appropriate audit evidence that the control(s) in place operated effectively throughout the period of reliance and will significantly mitigate the risk to which they/it relates. Compared to a strategy of—no controls reliance, a high controls reliance strategy will significantly reduce the level of substantive evidence necessary to be satisfied that overall sufficient appropriate audit evidence has been obtained. When considering what further substantive evidence will be necessary, consider the extent to which the controls evidence has addressed all the assertions that are relevant to the risk. It may be appropriate to plan for high controls reliance for a risk even if the controls to be tested do not address P&D (where it is a relevant assertion) provided sufficient appropriate substantive evidence is obtained for the P&D assertion.

Partial controls reliance

We plan for partial controls reliance when we consider that the control (or controls) on which we intend to place reliance will only partially mitigate the risk to which they/it relates; or when the extent of our planned controls testing does not achieve a High level of assurance over the tested control(s) (i.e., the controls on which we intend to place reliance).

Examples of situations where partial controls reliance will be appropriate are as follows:

• The number of items we test for a control upon which we plan to rely achieves a Moderate (not High) level of assurance (refer to OAG Audit 6053)

• The RoMM relates to multiple assertions and we cannot achieve controls reliance over all of them, e.g., the risk may relate to completeness and rights and obligations; we plan to get controls reliance on Completeness and perform substantive procedures to address Rights and Obligations.

• The risk is a composite of lower level risks and the control addresses only some of these risks, e.g., in relation to a risk of revenue being inaccurate, a control may address the pricing of goods, but not the quantity, on the invoices

• A control may operate at an entity level and therefore is not sufficiently detailed to provide high controls reliance over transactions, e.g., business performance reviews alone may not provide high controls reliance

• Assuming a calendar year, when the entity information system changes on 1 October, we may have controls reliance for 9 months but have to perform substantive testing for the remainder of the year.

In order that our subsequent development of the detailed testing plan responds appropriately to the relevant strategy considerations, be clear why the expected controls reliance is partial, discussing this with the team manager and/or engagement leader if necessary. Documentation of the rationales underlying the level of expected controls reliance would typically be included in related planning activities Procedure steps, but may also be included elsewhere in the audit documentation.

No controls reliance

We plan for no controls reliance when we have determined that there is a weak control environment, controls are not considered to be operating effectively for the period, or it will be more efficient and effective to obtain all audit evidence through substantive procedures.

OAG Guidance

Planned substantive evidence is the level of evidence (expressed as Low, Medium or High) we expect to obtain from performing substantive procedures as a whole in order to reduce audit risk to an acceptably low level. The judgment takes into account both our assessed level of inherent risk and the evidence we expect from testing controls.

We determine and document the level of planned substantive evidence for each significant FSLI where a risk of material misstatement was identified at the FSLI assertion level. If an FSLI is not determined to be significant but it is material (i.e., there is no reasonable possibility of material misstatement for the FSLI and therefore no relevant assertions are identified, but it is quantitatively material), CAS 330.18 requires us to perform substantive procedures irrespective of the assessed risk of material misstatement. For further guidance on our procedures over material but not significant FSLIs, refer to OAG Audit 5042.

For significant risks, CAS 330.21 also requires the auditor to perform substantive procedures that are specifically responsive to the risk. Therefore, if the planned substantive procedures responding to a significant risk consist solely of substantive analytical procedures, consider if those analytics are specifically responsive to the risk (i.e., address the relevant assertions and are sufficiently disaggregated to reduce the risk to an acceptably low level). For guidance on determining nature, timing and extent of substantive procedures, see OAG Audit 7020.

Consider the following guidelines when selecting the level that best reflects our planned approach to gathering substantive evidence:

OAG Guidance

The table below illustrates potential testing strategy options for expected controls reliance and planned substantive evidence in response to assessed risks. These testing strategy options are consistent with common testing strategies based on CAS and OAG methodology. It shows what level of planned substantive evidence we would normally seek depending on our expected controls reliance and risk assessment. For example, when the risk is significant and the expected controls reliance is Partial, we will ordinarily plan to obtain a Medium or a High level of substantive evidence.

Crosses in the table below indicate the options that are not consistent with common testing strategies based on CAS and OAG methodology.

Professional judgment is required to determine if we will achieve the right balance between controls testing and substantive procedures in the individual circumstances of the engagement. Consider the following points that relate to testing strategy options when particular judgment may be needed to develop an appropriate response to the assessed risks.

High controls reliance and low substantive evidence: This strategy option may be effective and efficient for normal risks. When we choose to apply it to significant or elevated risks, be satisfied that our controls testing is effective enough to provide evidence that the risk is mitigated to allow for only low assurance from substantive tests to provide sufficient evidence and reduce the risk to an acceptably low level. Also, note that significant risks require substantive procedures that are specifically responsive to the risk.

Partial controls reliance and low substantive evidence: Whether this combination will be appropriate, including where we plan to test individual controls at the Moderate level of assurance (see guidance on controls testing in OAG Audit 6053), will depend on the circumstances, in particular the nature of the risk. When controls are not expected to provide strong mitigation of the risk, plan substantive procedures so that sufficient evidence is obtained in aggregate in relation to all relevant assertions. For example, if controls testing does not address completeness, include sufficient substantive tests to respond to the risk related to this assertion. Determine if low substantive evidence will be enough and whether substantive analytics will provide sufficient evidence in these circumstances, and include tests of details in the plan if appropriate. Also, note the point above on responding to a significant risk.

No controls reliance: When no reliance on controls is expected, we will normally plan to obtain high assurance from substantive tests for significant risks and moderate assurance for elevated risks. When we plan for low level of substantive evidence in case of a normal risk, determine if this is appropriate in light of our understanding of the entity, materiality and characteristics of the balance under consideration. Remember that when our response to a significant risk consists solely of substantive procedures, they shall include tests of details as required by CAS 330.21.

OAG Guidance

For guidance and examples of situations where substantive procedures alone would not be appropriate refer to OAG Audit 5043.3.

We design our audit approach to such areas to include an appropriate combination of evidence from controls and substantive procedures and document the risks identified and related controls evaluated.

Related Guidance

See OAG Audit 5034 for guidance on understanding the entity’s information systems.