6052 Nature of controls tests

Sep-2022

OAG Guidance

Testing Techniques

For general guidance (including definitions of the below techniques) on various types of audit procedures see OAG Audit 1052.

There are four main techniques relevant to testing controls, each providing a different level of evidence, as shown below.

Persuasiveness of the evidence is impacted by the type of procedure used to obtain the evidence. Sufficient appropriate audit evidence is to be obtained through a combination of procedures, such as inquiry, observation, examination/inspection and reperformance, with inquiry being the least persuasive, followed by observation, then examination/inspection and finally with reperformance being the most persuasive.

View actual size

Inquiry provides us with some relevant information, especially when we apply professional skepticism in the discussions. We get further support, by corroborating inquiry with others in the entity, or by examining reports, manuals, or other documents used in or generated by the performance of the control, or by reperforming the control. Note that inquiry alone will not provide sufficient evidence to support a conclusion about the effectiveness of a control. Accordingly, while inquiry can be useful, it is best used in combination with other control testing techniques.

Observation is an appropriate way to obtain evidence if there is no documentation of the operation of a control, like segregation of duties. Observation is also useful for physical controls, e.g., seeing that the warehouse door is locked, or that blank checks are safeguarded. Generally, evidence we obtain directly, such as through observation, provides more assurance than that obtained indirectly or by inference, such as through inquiry. We need to consider, however, that the control we observe might not be performed in the same manner when we are not present.

Inspection often is used to determine whether manual controls, like the follow‑up of exception reports, are being performed. Evidence could include written explanations, check marks, or other indications of follow‑up documented on the exception report itself. Inspect evidence of the performance of a control when it might reasonably be expected to exist. Absence of evidence may indicate that the control is not operating as prescribed and further procedures will be necessary to determine whether there is in fact an effective control.

Example We may test controls over cash receipts by observing the procedures for opening the mail and processing cash receipts. However, because observation is pertinent only at a point in time, we may combine this with detailed inquiry and inspection of documentation to gain further evidence about the operation of the controls over the period.

It is important to recognize that a signature on, for example, a voucher package to indicate that the signer approved it does not necessarily mean that the person carefully reviewed the package before signing. The package may have been signed based on only a cursory review (or without any review). As a result, the quality of the evidence regarding the effective operation of the control might not be sufficiently persuasive. If that is the case, reperforming the control (for example, checking prices, extensions, and additions) will likely be more appropriate. In addition, we might inquire of the person responsible for approving voucher packages what he or she looks for when approving packages and how many errors have been found within voucher packages. We also might inquire of supervisors whether they have any knowledge of errors that the person responsible for approving the voucher packages failed to detect.

Reperformance generally provides more persuasive evidence than the other techniques and is therefore used when a combination of inquiry, observation and inspection of evidence does not provide sufficient appropriate audit evidence that a control is operating effectively. However, if extensive reperformance is likely to be necessary, we reconsider whether it is efficient to perform tests of controls to restrict the scope of substantive testing. If we consider reperformance to be appropriate, remember that it is the performance of the control that we are assessing and not the existence or accuracy of specific transactions. If we are reperforming a control, our objective is to give all instances of a homogenous population of controls an equal chance of selection. Therefore we do not apply targeted testing when selecting instances for testing.

While reperformance provides the most persuasive evidence, we do not automatically default to reperformance testing for all controls. Rather, we vary or alter the nature of our testing (e.g., perform inquiry and observation or perform inquiry and examination/inspection). The nature of testing is evaluated in conjunction with the characteristics and risk associated with the control.

The following examples demonstrate the difference between inspection and reperformance:

• Depending on the test objectives when testing the managerial review of a bank reconciliation, we may inspect the evidence that the reconciliation has been prepared through inspecting that the reconciliation exists, scanning the reconciling items to be satisfied that they appear to have been appropriately addressed in the reconciliation process, and checking that it has been signed by both the preparer and reviewer. If additional evidence is required, for example the reconciliation appears to contain unusual items, consider the need to reperform the reconciliation to be sure that the control works appropriately. This would ordinarily include reperforming the steps the reviewer executed to review the reconciliation, such as comparing amounts on the reconciliation to supporting documentation and inspecting supporting evidence in relation to any unusual items and for other reconciling items, with appropriate follow‑up action taken for these items. If we conclude that the reconciliation was not properly prepared yet the reviewer had still signed the reconciliation to indicate completion of their review, we follow‑up why the reviewer was satisfied with the reconciliation and evaluate whether the review process is effective and therefore whether the reconciliation control is effective.

• When testing a warehouse manager review of daily inventory counts, we can decide to inspect the evidence that this review has been done by inspecting documentation prepared by, or reviewed by, the warehouse manager. However, we may decide to reperform his/her review, including reperforming inventory counts, following up differences and responses to differences between the counts and perpetual inventory records. The objective of this test would be to evaluate whether the review is effective by evaluating the effectiveness of the warehouse manager’s review.

• If we decide to inspect evidence to test approvals of new customer credit, we would inspect the application documentation for evidence of approval by an authorized approver. However, if we decide to reperform the control, we review supporting information, evaluate this against the client’s approval criteria and check that the approval is in line with the client’s policies. If we find new customer credit that has been approved contrary to the client’s policy we follow up to determine the underlying facts and circumstances so that we can evaluate whether the approval control is operating effectively.

For certain less complex, routine controls the inquiry and observation or examination / inspection procedures performed during our assessment of the design and implementation may be sufficient to test the operating effectiveness of that control.

We would consider scaling the audit for smaller organizations. When smaller organizations or business units do not have formal documentation policies for evidencing operation of its controls, consider if testing controls through inquiry combined with other procedures, such as observation of activities, inspection of less formal documentation, or reperformance of certain controls, provides sufficient evidence about whether the control is effective.

Further Engagement Considerations

Tests of controls provide one form of audit evidence that contributes to the overall sufficiency and appropriateness of audit evidence available to support our opinion. Less complex entities may not have formal, consistently documented evidence available to directly support the operating effectiveness of their controls, however, that does not preclude us from being able to rely on the effectiveness of those controls, provided we can corroborate the effective operation of the controls.

The nature and timing of our audit procedures may be affected by the fact that some of the accounting data and other information may be available only in electronic form or only at certain points or periods in time. Such information may not be retrievable after a specified period of time if files are changed and if backup files do not exist. An entity’s data retention policies may require us to request retention of some information for audit purposes or to perform audit procedures at a time when the information is available.

See OAG Audit 5031 for additional guidance on assessing the operating effectiveness of controls in less complex entities.

Related Guidance

See OAG Audit 7591 for further guidance on the use of CAATs.