CHAPTER 11AUDIT PROCEDURES IN RESPONSE TO ASSESSED RISKS: TEST OF CONTROLSI Putu Wibaksha Aditya P.125020307121027Putri Ayu Dwi Lestari125020307121011

Assessing control risk is the process of evaluating the effectiveness of an entitys internal control in preventing or detecting material misstatement in the financial statements.

The design of internal controlThe operation of internal controls

5 Steps In Assessing Control Risk :Consider the knowledge acquired from procedures to obtain the understanding of internal controlsIdentify potential misstatement that could occur in an assertionIdentify necessary controls that would likely prevent or detect and correct misstatementsPerform tests of controls to determine the effectiveness of design and operationEvaluate the evidence and assess control risk

Assessing Control Risk in an Information Technology Environment

There are strategies for performing tests of controls:Assessing control risk based on user controlsPlanning for a low control risk assessment based on application controlsPlanning for a high control risk assessment based on general controls and manual followup

Computer-assisted audit techniques (CAATs) is using computer directly to test application controls and also known as auditing through the computer.

When developing an audit strategy for testing computer controls, Auditor should choose CAATs to test the operation of specific programmed application controls:Parallel simulationTest dataIntegrated test facilityContinuous monitoring of online real time systems

Designing Tests of Controls

Tests of controls are designed to evaluate the operating effectiveness of a control.

How the control was appliedThe consistency with which it was applied during the periodBy whom it was applied.

Nature of Tests of ControlsInquiries of appropriate entity personnelInspection of documents, reports, or electronic files, indicating performance of the controlObservation of the application of the controlReperformance of the application of the control by the auditor, including the use of computer assisted audit techniques (CAATs)

Timing of Tests of ControlsDetermines the period of reliance on tests of controls.Auditor tests controls only at a particular point in timeAuditor obtain evidence that control operated effectively at that point in timeAuditor obtains evidence about operating effectiveness during the period of timeAuditor tests controls throughout the period

Extent of Tests of ControlsAuditor should consider the following factors:

The nature of controlFrequency of operationImportance of control

Staffing Tests of ControlsA final audit decision involves staffing of tests of controls or who should perform tests of cotrols.

Audit Programs for Tests of ControlsThe program lists the procedures to be used in performing the tests pertaining to the indicated assertions and provides columns to indicate:

Cross-references to the working papers where the results of the tests are documentedWho performed the testsThe date the tests were completed

Dual Purpose TestsSome firms use dual-purpose testing because it may be more cost efficient to perform the tests simultaneously rather than separately.

Additional Consideration

Assessing Control Risk For Account Balance Assertions Affected By A Single Transaction ClassThe process of assessing control risk is straight forward for accounts that are affected by a single transaction class.

Assessing Control Risk For Account Balance Assertions Affected By Multiple Transaction ClassMany balance sheet accounts are significantly affected by more than one transaction class.

The existence and occurance of accounts receivable is affected by three transactions:Existence and occurance of salesCompleteness of cash receiptsCompleteness of sales returns and allowances

Completeness of accounts receivable is also affected by three transactions:Completeness of salesExistence and occurence of cash receiptsExistence and occurence of sales returns and allowances

Documenting The Assessed Level of Control RiskThe test of control must be documented.

Open book page 498

Communicating Internal Control MattersThe auditor is required to identify and report to the audit committee, or other entity personnel with equivalent authority and responsibility, certain conditions that relate to an entitys internal control observed during an audit of the financial statements.

*