- In a financial statement audit of a nonissuer, you plan to rely on controls over the purchasing process. The control states that accounts payable will only record a vendor invoice when it is matched to an approved purchase order and receiving report (three-way match), and the accounts payable supervisor reviews an exception report of unmatched items weekly. What is the most appropriate procedure for evaluating the operating effectiveness of this control?
Answer: Inspect a sample of recorded vendor invoices for evidence of three-way match and supervisor review of exceptions, including dates and signatures.
This question addresses testing the operating effectiveness of a three-way match control and supervisory review, as required by AU-C 330 for controls the auditor intends to rely upon. The control involves matching vendor invoices to purchase orders and receiving reports, with supervisor review of exceptions, requiring the auditor to inspect evidence that these activities occurred. Inspecting a sample of recorded invoices for evidence of the three-way match and dated supervisor signatures (Choice A) provides direct evidence that the control operated as designed throughout the period. Recalculating balances (Choice B) is a substantive procedure that cannot evaluate control effectiveness. Assessing inherent risk as low (Choice C) violates professional standards because inherent risk assessment is independent of controls, and control testing cannot be reduced based on policies alone. Testing controls after report date (Choice D) is inappropriate because controls must be tested during the period under audit. The auditor must obtain evidence through inspection, observation, inquiry, and reperformance that controls operated effectively throughout the period of intended reliance.
- Based on the results of the test of controls described in the passage, what is the auditor's most appropriate conclusion?
Answer: The auditor cannot rely on the control because the sample results do not support the planned level of control risk.
The correct answer is C. The sample deviation rate is 4/60, which is approximately 6.7%. This rate exceeds the tolerable deviation rate of 5%. Therefore, the sample results indicate that the control is not operating effectively enough to support the auditor's planned level of control risk. The auditor cannot rely on the control. Choice A is incorrect because the deviation rate exceeds the tolerable rate. Choice B is the opposite of the correct action. Choice D is inappropriate; deviations must be investigated, not automatically excluded, to determine if they are truly anomalies.
- You are auditing a nonissuer in a financial statement audit and plan to use a system-generated aged accounts receivable report for both tests of controls and substantive procedures. Management asserts that access to the accounts receivable aging report is restricted and that user access is reviewed quarterly by IT. Under these circumstances, which procedure is most appropriate for evaluating the effectiveness of the related IT general control over access?
Answer: Inspect a sample of quarterly user access review documentation for evidence of review, timely removal of terminated users, and resolution of exceptions.
This question addresses IT general controls over system access, which are critical when relying on system-generated reports for audit procedures per AU-C 315 and AU-C 330. The control involves quarterly user access reviews by IT, and the auditor needs evidence these reviews effectively maintain appropriate access restrictions. Inspecting quarterly review documentation for evidence of review, terminated user removal, and exception resolution (Choice A) directly tests whether the access control operated effectively throughout the period. Confirming receivables (Choice B) is a substantive procedure unrelated to IT access controls. Type 1 reports (Choice C) only describe controls at a point in time and provide no evidence of operating effectiveness throughout the period. Testing by inquiry only (Choice D) provides insufficient evidence for IT controls and the security concern is unfounded when properly coordinated. The auditor must inspect documentation showing that access reviews occurred, identified issues like terminated employees, and resulted in timely remediation to maintain system integrity.
- You are the auditor of a nonissuer in a financial statement audit. The entity uses a three-way match control in the purchasing process: accounts payable (A/P) clerks may record vendor invoices only when the system shows an approved purchase order and receiving report match the invoice quantity and price; exceptions require supervisor approval. Because you plan to rely on this control to reduce substantive testing of purchases and A/P, what is the most appropriate procedure for evaluating the operating effectiveness of this control during the year?
Answer: Inspect a sample of recorded invoices for evidence in the system of a matched purchase order and receiving report, and reperform the match for the selected items
This question tests the auditor's procedures for evaluating the operating effectiveness of internal controls when relying on them to modify substantive testing in a financial statement audit of a nonissuer, as outlined in AU-C Section 330. The entity employs a three-way match control in its purchasing process, requiring matched purchase orders and receiving reports before recording invoices, with exceptions needing approval. Choice B is appropriate because it involves inspecting evidence of the control's operation and reperforming the match, providing direct evidence of effectiveness throughout the year. Choice A is incorrect as recalculating balances is a substantive test, not a test of control operation per AU-C 330, while Choice C relies on representations, which AU-C 580 states are not sufficient alone for control testing. Choice D is flawed because confirmations provide substantive evidence of balances, not control effectiveness, according to AU-C 505. Auditors should prioritize tests like inspection and reperformance to assess if controls operated as designed over the relevant period. A transferable framework is to match the test type to the control's nature, ensuring coverage of the full period of reliance to support reduced substantive procedures.
- You are auditing an issuer and plan to rely on a control over revenue recognition for contracts with variable consideration. The control requires a technical accounting memo prepared by accounting, reviewed and approved by the revenue recognition manager, and retained with the contract file before revenue is recorded. Which test would best determine the operating effectiveness of this control?
Answer: Select a sample of contracts with variable consideration and inspect the contract file for the memo and evidence of review/approval prior to revenue recognition
This question tests controls over revenue recognition with variable consideration in an issuer's audit, per PCAOB AS 2201. The control requires a reviewed memo before recording. Choice A aligns by inspecting memos and approvals, per AS 2201. Choice B is analytical, not control testing per AS 2305, while Choice C is substantive confirmation per AS 2310. Choice D is inquiry-only, insufficient per AS 2110. A framework is to verify documentation and timing of approvals. This ensures accurate revenue under ASC 606.
- In a financial statement audit of a nonissuer, you plan to rely on a control where the accounting supervisor reviews and approves all customer credit memos before they are processed, to address the risk of unauthorized sales returns and revenue reduction. Which procedure is most appropriate to test the effectiveness of this control?
Answer: Select a sample of credit memos and inspect for evidence of supervisor approval prior to processing, and evaluate whether supporting documentation was reviewed
This question evaluates approval controls over credit memos in a nonissuer audit, per AU-C 330. The supervisor reviews and approves to prevent unauthorized reductions. Choice A aligns by inspecting approvals and support, per AU-C 330. Choice B is confirmation, substantive per AU-C 505, while Choice C is analytical per AU-C 520. Choice D delays improperly; interim testing is allowed per AU-C 330. Auditors should assess approval timeliness and documentation. A transferable rule is to sample high-risk items for review depth.
- You are auditing an issuer and intend to rely on a control that restricts access to post entries to the general ledger to authorized accounting personnel. The entity uses a periodic user access review control where the controller reviews a system-generated list of users with general ledger posting rights and documents removals of inappropriate access. Which procedure is most appropriate to test operating effectiveness of the access review control?
Answer: Inspect a sample of access review instances for evidence of review, evaluate whether exceptions were identified, and verify timely removal of inappropriate access
This question tests IT general controls over access in an issuer's audit, per PCAOB AS 2201. The periodic user access review by the controller documents and removes inappropriate access. Choice A aligns by inspecting reviews, exceptions, and removals, per AS 2201's evidence requirements. Choice B is unauthorized testing, inappropriate per AS 2110, while Choice C is substantive per AS 2301. Choice D misapplies standards; issuers require inspection, not just inquiry, per AS 2201. A decision rule is to verify timely resolution of exceptions in access reviews. This framework confirms access controls prevent unauthorized entries.
- An auditor performs a procedure that involves vouching a sample of entries in the sales journal to shipping documents and customer orders to verify both the existence of the sale and the proper authorization of the transaction. This procedure is an example of a(n):
Answer: Dual-purpose test.
The correct answer is C. A dual-purpose test is an audit procedure that serves as both a test of controls and a substantive test of details for the same transaction. In this case, examining the customer order for authorization tests the control, while vouching the sale to the shipping document provides substantive evidence about the occurrence assertion.
- In an integrated audit of an issuer, tests of the operating effectiveness of controls should be designed to provide a level of assurance that is:
Answer: Sufficient to support the auditor's opinion on internal control over financial reporting.
The correct answer is B. In an integrated audit under PCAOB standards, the primary purpose of testing controls is to support the auditor's opinion on the effectiveness of internal control over financial reporting (ICFR). While these tests also inform the control risk assessment for the financial statement audit (A), the level of assurance must be high enough to support the separate opinion on ICFR. Assurance from tests of controls is different from substantive assurance (C). Testing is not limited to changed controls; controls must be tested each year to support the ICFR opinion (D).
- To test the operating effectiveness of controls over access to the company's accounting system, an auditor would most likely:
Answer: Attempt to log in using the credentials of a terminated employee.
The correct answer is C. Attempting to log in with credentials of a terminated employee directly tests the effectiveness of the control related to timely de-provisioning of access. This is a form of reperformance/inspection. A vulnerability scan (A) tests for system weaknesses but not specifically the access control for terminated employees. Inquiry (B) is not sufficient on its own. The disaster recovery plan (D) is related to business continuity, not routine access controls.
- When testing a client's automated controls within its IT system, an auditor would most likely focus testing on the client's:
Answer: IT general controls, particularly change management controls.
The correct answer is C. When relying on automated application controls, the auditor must also test the effectiveness of the related IT general controls (ITGCs). ITGCs, such as controls over program changes, access, and computer operations, provide the foundation for the reliable operation of automated controls. If change management controls are weak, an unauthorized and improper change could be made to the application, rendering the automated control ineffective. The other options are either less directly related (A, B) or not a test of controls at all (D).
- An auditor is testing the operating effectiveness of a client's control over the approval of credit memos. The control requires a credit manager's signature on all credit memos exceeding $1,000. Which of the following audit procedures provides the most persuasive evidence that this control is operating effectively?
Answer: Selecting a sample of recorded credit memos and examining them for the credit manager's signature.
The correct answer is D. Selecting a sample of issued credit memos and examining them for proper authorization (the manager's signature) directly tests whether the control was performed. This is a form of inspection. Choice A, inquiry, is not sufficient on its own. Choice B, observation, only provides evidence for the moment in time the auditor is observing. Choice C is a substantive test of details related to the occurrence of sales, not a test of the control over credit memo approval.
- You are the auditor of a nonissuer in a financial statement audit and intend to rely on controls over payroll. The entity's control requires that new hires and pay rate changes must be supported by an approved personnel action form, and payroll changes are entered by payroll staff. Under these circumstances, which test would best determine the effectiveness of controls over authorization of payroll changes?
Answer: Select a sample of pay rate changes recorded in the payroll register and inspect for an approved personnel action form dated prior to processing.
This question tests understanding of authorization controls over payroll changes, focusing on preventive controls that ensure only approved changes enter the payroll system per AU-C 330. The control requires approved personnel action forms for new hires and pay rate changes, necessitating the auditor to test whether this authorization occurred before processing. Selecting pay rate changes and inspecting for approved personnel action forms dated prior to processing (Choice B) directly tests whether the authorization control operated effectively. Recalculating gross-to-net pay (Choice A) tests accuracy, not authorization. Searching for duplicates (Choice C) is a fraud detection procedure but doesn't test the authorization control. Analytical procedures (Choice D) are substantive tests that cannot evaluate control effectiveness. When testing authorization controls, the auditor must trace from the transaction (pay rate change) back to the authorization document (personnel action form) and verify proper approval and timing. This provides evidence that only authorized changes were processed in the payroll system.
- During a financial statement audit of a nonissuer, you identify a segregation of duties issue in the cash receipts process: one employee opens mail, prepares the deposit, records receipts, and performs the bank reconciliation. Management added a compensating control where the finance director reviews the daily deposit slip to the cash receipts journal and investigates differences. Which test would best determine the effectiveness of the compensating review control?
Answer: Inspect a sample of days for evidence of the finance director's documented comparison and follow-up of differences
This question evaluates testing compensating controls for segregation of duties deficiencies in a nonissuer audit, as per AU-C 315. The compensating control is the finance director's daily review of deposit slips against the cash receipts journal. Choice A aligns with AU-C 330 by inspecting review evidence and follow-up, providing direct assessment of effectiveness. Choice B is incorrect as increasing confirmations is substantive per AU-C 505, not control testing, while Choice C uses analytical procedures, inappropriate for control evaluation under AU-C 520. Choice D delays testing improperly, contrary to AU-C 330's period-of-reliance requirement. Auditors should use a framework evaluating the precision of compensating reviews to mitigate identified risks. This ensures overall control effectiveness despite segregation issues, allowing reduced substantive procedures.
- You are auditing the financial statements of an issuer. Revenue is processed through an automated order-to-cash system in which credit limits are enforced by a system control that blocks shipment when a customer exceeds its limit; credit managers can override blocks using unique credentials. You intend to rely on the credit-limit control to address the risk of uncollectible receivables and improper revenue recognition. Which test would best determine the effectiveness of the override control over credit-limit blocks?
Answer: Inspect a sample of override transactions for evidence of credit manager approval and trace to user access logs showing the override was performed by an authorized user
This question examines tests of controls over automated systems and overrides in an issuer's audit, governed by PCAOB AS 2201, which requires evidence of effective operation when relying on controls. The key facts involve an automated credit-limit enforcement with manual overrides by credit managers using unique credentials to mitigate risks in receivables and revenue. Choice A aligns with AS 2201 by inspecting override evidence, approvals, and access logs to verify the control's effectiveness. Choice B is incorrect as analytical procedures are substantive, not tests of controls per AS 2305, while Choice C relies solely on inquiry, insufficient under AS 2110 for operating effectiveness. Choice D is wrong because IT controls must be tested during the audit period, not deferred, as per AS 2201. A professional judgment framework involves selecting samples from the population of overrides and corroborating with system evidence. Auditors should ensure tests address both automated and manual elements to confirm reliance for risk reduction.
- In a financial statement audit of a nonissuer, the entity has a control requiring two signatures on checks over $10,000, with the second signature provided by the CFO after reviewing supporting documentation. You plan to rely on this control to reduce substantive testing of disbursements. Which test would best determine the effectiveness of the CFO's review as part of the dual-signature control?
Answer: Inspect a sample of canceled checks over $10,000 for two signatures and examine the related support to assess whether the CFO's review was meaningful
This question evaluates testing review controls in disbursements for a nonissuer audit, per AU-C 330. The dual-signature policy includes CFO review of support for checks over $10,000. Choice A is correct by inspecting signatures and assessing review meaningfulness, aligning with AU-C 330. Choice B is a reconciliation test, not specific to the control per AU-C 330, while Choice C is confirmation, substantive per AU-C 505. Choice D limits to design, but operating effectiveness is required per AU-C 330. Auditors should evaluate the depth of reviews beyond signatures for effectiveness. A transferable framework is to test both execution and substance of approval controls.
- The primary purpose of performing tests of controls is to provide a reasonable basis for:
Answer: Reducing the assessed level of control risk.
The correct answer is A. Auditors perform tests of controls to evaluate their operating effectiveness. If the controls are found to be effective, the auditor can justify assessing control risk at a level below the maximum. This allows the auditor to reduce the nature, timing, and/or extent of substantive procedures. Quantifying misstatements (B) is the purpose of substantive testing. Going concern evaluation (C) and opinion modification (D) are conclusions drawn from the totality of audit evidence, not just tests of controls.
- You are the auditor of a nonissuer in a financial statement audit and plan to rely on controls over the revenue process to reduce substantive testing. The entity uses pre-numbered shipping documents, and a supervisor is expected to review a daily sales register and match it to shipping documents before invoices are posted. Under these circumstances, which test would best determine the effectiveness of controls over the occurrence of recorded sales?
Answer: Select a sample of recorded sales entries and vouch each to an approved shipping document that evidences shipment before invoicing.
This question tests the auditor's understanding of tests of controls over the occurrence assertion for revenue transactions, as outlined in AU-C 330. The key fact is that the entity has a control requiring supervisor review of daily sales registers matched to shipping documents before invoice posting, and the auditor wants to test whether this control effectively prevents fictitious sales. Vouching recorded sales entries to approved shipping documents (Choice B) directly tests whether the control ensures sales are supported by actual shipments, which addresses the occurrence assertion. Analytical procedures (Choice A) are substantive procedures, not tests of controls, and cannot evaluate whether specific control activities operated effectively. Management representations (Choice C) provide limited evidence about control effectiveness and cannot replace the auditor's testing. Confirming receivables (Choice D) tests existence of receivables, not the operating effectiveness of controls over sales occurrence. When testing controls over transaction occurrence, the auditor should select a sample of recorded transactions and examine evidence that the control activity was performed.
- An auditor is least likely to perform tests of controls when:
Answer: The auditor believes a purely substantive approach will be more efficient.
The correct answer is B. An auditor is not required to perform tests of controls if it is possible and more efficient to obtain sufficient appropriate audit evidence by performing only substantive procedures. This is often the case for smaller entities or for specific assertions where designing effective substantive tests is straightforward. A strong control environment (A), high transaction volume (C), or a significant risk mitigated by a control (D) are all situations that would encourage, not discourage, the testing of controls (assuming reliance is planned for D).
- An auditor tested a client's controls at an interim date and concluded that they were operating effectively. To support this conclusion for the entire audit period, the auditor should perform additional tests of controls for the remaining period. Which of the following factors would most likely lead the auditor to extend the testing of controls for the remaining period?
Answer: Significant changes were made to the control environment during the remaining period.
The correct answer is D. If significant changes occurred in the control environment, IT systems, or specific control procedures during the period after interim testing, the auditor cannot rely on the interim test results and must perform additional tests. Choice A would decrease the need for extensive roll-forward testing. Choice B, a management representation letter, does not provide evidence about control effectiveness. Choice C is a result of the overall audit process and does not directly inform the need to extend tests of controls.
