7581 Testing reconciliations

Sep-2022

OAG Guidance

Reconciliations are commonly used to compare and analyze differences in balances between a general ledger account and the related subsidiary ledger (control account reconciliations). Financial statement reconciliations typically include bank, accounts receivable, inventory, fixed asset, accounts payable and other types of account and activity reconciliations (e.g., inter-company account reconciliations). Many of these reconciliations are likely to be considered relevant reconciliations for our audits. For specific industries (e.g., financial services) many other types of account and activity reconciliations are likely to be relevant reconciliations and considered controls in the control activities component. See OAG Audit 5035.1 for further guidance on what controls are included in the control activities component.

To be effective, reconciliations need to be:

• Complete: reconciliations need to account for all differences between the general ledger and the subsidiary ledger as reconciling items. In contrast, roll forwards from the opening balance to the closing balance do not constitute reconciliations and may not identify material misstatements.
• Performed gross (i.e. showing all reconciling debits and credits rather than netting of items): netting of reconciling items eliminates the transparency of the reconciliation.

We understand and evaluate how the entity prepares the reconciliation, which reconciling items are investigated and sources of data utilized in the reconciliation, e.g., bank statements, ledgers. The reconciling items may indicate potential material misstatements due to error or fraud resulting from, among other things, cut‑off issues, special transactions or breakdowns in internal control.

OAG Guidance

Audit evidence over relevant reconciliations can be obtained either from a combination of tests of controls and tests of details (a dual-purpose test) or from tests of details alone. Testing reconciliations provides audit evidence over relevant assertions for an account including completeness, accuracy, existence / occurrence and cut‑off.

Regardless of the type of test performed, senior members of the engagement team consider the matters arising from tests of relevant reconciliations, including exceptions, in case of the potential for increased fraud risk or a control deficiency with wider audit implications.

The table below outlines key considerations for each type of testing.

OAG Guidance

Determining the population of reconciliations for controls testing

Determining the number of reconciliations for testing requires professional judgment to determine whether the reconciliations are sufficiently homogeneous to permit them to be treated as one population. Consider whether the controls testing population is an individual reconciliation for a particular account at a single location or all reconciliations for a particular account at multiple locations. Opportunities to expand the population of reconciliations for a particular account or process across multiple locations exist when there are a large number of locations. This may significantly reduce the number of reconciliations we test.

Understand and evaluate the supervisory review and monitoring of the reconciliation process and use professional judgment to determine whether the population of reconciliations is sufficiently homogeneous to permit it to be treated as one population. Document the rationale, including evidence of homogeneity of the processes and procedures. Factors to consider when determining the population include

• entity level controls, including the control environment;
• the uniformity of the entity’s policies and procedures;
• consistency and completeness of the reconciliation process (i.e., commonality of the process for a group of locations);
• determination of the specific control to test (i.e., the reconciliation process itself or the supervisory review and approval of the reconciliations or an entity-level control or monitoring control over the company’s reconciliation processes);
• number and competence of individuals preparing the reconciliations;
• monitoring by the internal audit function;
• training of personnel in the reconciliation process; and
• historical results and prior knowledge of the entity’s process.

Evidence of the homogeneity of the processes and procedures can come from

• our understanding and evaluation of controls (evidence of implementation) including the central monitoring processes undertaken by the client; or
• prior year experience in combination with current year evidence of continuing commonality of procedures based on our accept-reject testing.

Common processes and procedures may be applied in circumstances where numerous sub‑account reconciliations are prepared for a particular account (such as for multiple cash accounts). It would be unlikely for processes and procedures over reconciliations across differing accounts or across different territories to be sufficiently homogeneous to treat these reconciliations as a single population. Therefore, separate testing of individual populations by account or territory will be likely.

Example

There are multiple preparers and reviewers at the entity’s 90 locations for accounts receivable processing. Preparation of monthly reconciliations at each location, review, resolution of differences and reporting are in accordance with the entity’s standard account reconciliation policies and procedures. The entity has effective monitoring controls over the preparation of accounts receivable reconciliations and there has been no history of misstatements related to ineffective reconciliation controls. In these circumstances, we may determine that reconciliation processes for accounts receivable across all locations are homogeneous.

Further, of the total 90 locations, we test the accounts across the 50 locations that present a reasonable possibility of material misstatement. Treating the monthly accounts receivable reconciliations performed at those 50 locations as one population, we test 15 or 25 reconciliations across the population consisting of all 50 locations (the sample size for reperformance of a manual control that is performed at 50 locations for 12 months or 600 occurrences which would be treated as a multiple times per day control) rather than 100 reconciliations (2 at each of the 50 locations).

However, there may be other considerations for substantive testing. The same approach will apply if there is a single entity managing multi-entity financial statements, e.g., an investment management company with multiple funds.

Selecting reconciling items for testing

When reperforming the reconciliation, we test significant reconciling items (excluding those items that are immaterial in the aggregate). However, when using reperformance to test a reconciliation with a large number of reconciling items, we may use our judgment and follow the guidance below to select reconciling items for testing as long as we can demonstrate that the planned level of evidence is gained. We:

• Apply targeted testing to identify large or unusual reconciling items for testing. Test all individually significant (by size) or individually unusual (risk of material misstatement through error or fraud) items. Where there is heightened fraud risk, consider testing additional apparently normal items to incorporate unpredictability into our audit procedures.
• Decide if additional testing is necessary, considering the magnitude and types of the remaining reconciling items not subject to targeted testing and whether we have obtained sufficient evidence so that additional testing is unnecessary.

Ordinarily audit procedures for reconciling items include the comparison and agreement of balances with third-party evidence and/or supporting control accounts, sub‑ledgers and activity statements and tracing reconciling items to supporting documentation to confirm validity.

Evaluating exceptions

When, as a result of reconciliations testing, we identify control exceptions, consider those in accordance with guidance in OAG Audit 6057. Assess whether identified exceptions represent a deficiency (or significant deficiency) in the entity’s system of internal control. Evaluate whether identified exceptions affect our risk assessment and may require revisions in the level of risk associated with the related account or may indicate risks of fraud. See OAG Audit 5500 for specific guidance on fraud risk assessment and responses.