Tests Of Controls
Help Questions
CPA Auditing and Attestation (AUD) › Tests Of Controls
You are the auditor of a nonissuer in a financial statement audit and plan to rely on controls over the revenue process to reduce substantive testing. The entity uses pre-numbered shipping documents, and a supervisor is expected to review a daily sales register and match it to shipping documents before invoices are posted. Under these circumstances, which test would best determine the effectiveness of controls over the occurrence of recorded sales?
Perform a substantive analytical procedure comparing monthly revenue trends to prior periods and investigate significant variances.
Select a sample of recorded sales entries and vouch each to an approved shipping document that evidences shipment before invoicing.
Confirm a sample of year-end accounts receivable balances with customers to support existence of receivables.
Obtain management’s written representation that all recorded sales occurred and were authorized.
Explanation
This question tests the auditor's understanding of tests of controls over the occurrence assertion for revenue transactions, as outlined in AU-C 330. The key fact is that the entity has a control requiring supervisor review of daily sales registers matched to shipping documents before invoice posting, and the auditor wants to test whether this control effectively prevents fictitious sales. Vouching recorded sales entries to approved shipping documents (Choice B) directly tests whether the control ensures sales are supported by actual shipments, which addresses the occurrence assertion. Analytical procedures (Choice A) are substantive procedures, not tests of controls, and cannot evaluate whether specific control activities operated effectively. Management representations (Choice C) provide limited evidence about control effectiveness and cannot replace the auditor's testing. Confirming receivables (Choice D) tests existence of receivables, not the operating effectiveness of controls over sales occurrence. When testing controls over transaction occurrence, the auditor should select a sample of recorded transactions and examine evidence that the control activity was performed.
During a financial statement audit of a nonissuer, you identify that the same individual can set up new vendors in the master file and also process vendor payments, and management asserts that a monthly review of the vendor change report by the controller mitigates the risk. Under these circumstances, what is the auditor’s best approach to evaluate whether the mitigating control is operating effectively?
Assume the review control is effective because it is performed by the controller and therefore reduce substantive testing to a minimum.
Document the segregation of duties deficiency and issue an adverse opinion on internal control over financial reporting.
Test a sample of monthly vendor change reports for evidence of controller review and follow-up of unusual items, including investigation documentation.
Perform confirmations of year-end accounts payable only, because confirmations replace the need to test mitigating controls.
Explanation
This question addresses testing mitigating controls when segregation of duties deficiencies exist, as outlined in AU-C 265 and AU-C 330. The key fact is that one person can both set up vendors and process payments, creating fraud risk that management claims is mitigated by controller review of vendor changes. Testing monthly vendor change reports for evidence of controller review and investigation documentation (Choice A) evaluates whether the mitigating control operates effectively to detect unauthorized vendor additions. Assuming effectiveness based on position (Choice B) violates professional skepticism and testing requirements. Confirmations alone (Choice C) are substantive procedures that cannot evaluate control effectiveness and don't address the specific segregation risk. Issuing an adverse opinion (Choice D) is premature without first testing whether mitigating controls are effective, and applies only to integrated audits of issuers. When segregation of duties is lacking, the auditor must test whether compensating controls effectively mitigate the increased risk, requiring inspection of evidence that reviews occurred and exceptions were investigated.
In a financial statement audit of a nonissuer, you plan to rely on controls over the purchasing process. The control states that accounts payable will only record a vendor invoice when it is matched to an approved purchase order and receiving report (three-way match), and the accounts payable supervisor reviews an exception report of unmatched items weekly. What is the most appropriate procedure for evaluating the operating effectiveness of this control?
Recalculate the year-end accounts payable balance and compare it to the prior year to identify unusual fluctuations.
Wait until after the audit report date to test the control to ensure it operated throughout the entire period.
Inspect a sample of recorded vendor invoices for evidence of three-way match and supervisor review of exceptions, including dates and signatures.
Assess inherent risk as low because the entity has a formal purchasing policy and therefore reduce control testing.
Explanation
This question addresses testing the operating effectiveness of a three-way match control and supervisory review, as required by AU-C 330 for controls the auditor intends to rely upon. The control involves matching vendor invoices to purchase orders and receiving reports, with supervisor review of exceptions, requiring the auditor to inspect evidence that these activities occurred. Inspecting a sample of recorded invoices for evidence of the three-way match and dated supervisor signatures (Choice A) provides direct evidence that the control operated as designed throughout the period. Recalculating balances (Choice B) is a substantive procedure that cannot evaluate control effectiveness. Assessing inherent risk as low (Choice C) violates professional standards because inherent risk assessment is independent of controls, and control testing cannot be reduced based on policies alone. Testing controls after report date (Choice D) is inappropriate because controls must be tested during the period under audit. The auditor must obtain evidence through inspection, observation, inquiry, and reperformance that controls operated effectively throughout the period of intended reliance.
You are auditing an issuer and identified a segregation of duties control in the purchasing process: purchasing creates purchase orders, receiving confirms quantities received, and accounts payable records invoices; system roles are intended to prevent one user from performing incompatible duties. Which procedure is most appropriate to test the operating effectiveness of this segregation of duties control?
Test user access and role assignments by inspecting role matrices and selecting users to verify they do not have incompatible permissions, and corroborate through system logs where applicable
Inspect a sample of paid invoices and conclude segregation of duties is effective if invoices appear properly supported
Perform only a walkthrough of one purchase transaction because segregation of duties is assessed through design only
Rely on management's policy statement describing segregation of duties because system access is controlled by IT
Explanation
This question addresses testing segregation of duties via system roles in an issuer's audit, per PCAOB AS 2201. The control prevents incompatible permissions. Choice A is appropriate by inspecting matrices and logs, aligning with AS 2201. Choice B tests invoices substantively per AS 2301, while Choice C limits to walkthroughs, insufficient for effectiveness per AS 2110. Choice D relies on policy, not evidence per AS 2201. A decision rule is to verify roles against actual access logs. This framework confirms effective segregation for risk mitigation.
In a financial statement audit of a nonissuer, the entity has a control requiring two signatures on checks over $10,000, with the second signature provided by the CFO after reviewing supporting documentation. You plan to rely on this control to reduce substantive testing of disbursements. Which test would best determine the effectiveness of the CFO's review as part of the dual-signature control?
Confirm the cash balance with the bank and conclude the dual-signature control operated effectively if the confirmation agrees
Test only the design of the dual-signature policy because operating effectiveness is addressed through substantive procedures
Reconcile total disbursements per bank statement to the general ledger and treat the reconciliation as a test of the dual-signature control
Inspect a sample of canceled checks over $10,000 for two signatures and examine the related support to assess whether the CFO's review was meaningful
Explanation
This question evaluates testing review controls in disbursements for a nonissuer audit, per AU-C 330. The dual-signature policy includes CFO review of support for checks over $10,000. Choice A is correct by inspecting signatures and assessing review meaningfulness, aligning with AU-C 330. Choice B is a reconciliation test, not specific to the control per AU-C 330, while Choice C is confirmation, substantive per AU-C 505. Choice D limits to design, but operating effectiveness is required per AU-C 330. Auditors should evaluate the depth of reviews beyond signatures for effectiveness. A transferable framework is to test both execution and substance of approval controls.
You are auditing a nonissuer in a financial statement audit and plan to use a system-generated aged accounts receivable report for both tests of controls and substantive procedures. Management asserts that access to the accounts receivable aging report is restricted and that user access is reviewed quarterly by IT. Under these circumstances, which procedure is most appropriate for evaluating the effectiveness of the related IT general control over access?
Rely on the service organization’s Type 1 report to conclude that access controls operated effectively throughout the year.
Test access controls only by inquiry because inspection could compromise system security.
Perform positive confirmations of accounts receivable balances to validate the accuracy of the aged receivables report.
Inspect a sample of quarterly user access review documentation for evidence of review, timely removal of terminated users, and resolution of exceptions.
Explanation
This question addresses IT general controls over system access, which are critical when relying on system-generated reports for audit procedures per AU-C 315 and AU-C 330. The control involves quarterly user access reviews by IT, and the auditor needs evidence these reviews effectively maintain appropriate access restrictions. Inspecting quarterly review documentation for evidence of review, terminated user removal, and exception resolution (Choice A) directly tests whether the access control operated effectively throughout the period. Confirming receivables (Choice B) is a substantive procedure unrelated to IT access controls. Type 1 reports (Choice C) only describe controls at a point in time and provide no evidence of operating effectiveness throughout the period. Testing by inquiry only (Choice D) provides insufficient evidence for IT controls and the security concern is unfounded when properly coordinated. The auditor must inspect documentation showing that access reviews occurred, identified issues like terminated employees, and resulted in timely remediation to maintain system integrity.
You are auditing a nonissuer in a financial statement audit and plan to rely on management’s monitoring control over bank reconciliations. The control is that the accounting manager prepares monthly bank reconciliations and the controller reviews and approves them, investigating reconciling items over $5,000. Which procedure is most appropriate for testing the operating effectiveness of this monitoring control?
Send bank confirmations to all banks used by the client to obtain year-end balances and compare them to the general ledger.
Inspect a sample of monthly bank reconciliations for evidence of timely preparation and documented controller review, and reperform the follow-up on selected reconciling items over $5,000.
Test the control only at year-end because interim testing is not permitted for monitoring controls.
Inquire of the controller whether bank reconciliations are reviewed and conclude the control is effective if responses are consistent.
Explanation
This question tests understanding of monitoring controls over bank reconciliations, which are detective controls requiring evidence of both performance and review per AU-C 330. The control involves accounting manager preparation and controller review with investigation of items over $5,000, requiring the auditor to test both components. Inspecting reconciliations for timely preparation, documented review, and reperforming follow-up on large items (Choice A) provides evidence that the monitoring control operated effectively including the investigation component. Bank confirmations (Choice B) are substantive procedures that verify balances but cannot evaluate control effectiveness. Inquiry alone (Choice C) provides limited evidence and must be corroborated with inspection or reperformance for controls testing. Testing only at year-end (Choice D) is incorrect because monitoring controls can and should be tested throughout the period, with appropriate roll-forward procedures. The auditor must obtain evidence through inspection and reperformance that monitoring controls not only occurred but also identified and resolved exceptions appropriately.
In a financial statement audit of a nonissuer, you plan to rely on a control environment element: the audit committee’s oversight of financial reporting. Management states the audit committee meets quarterly and reviews significant accounting estimates and journal entries. Which factor most likely indicates a weakness in the control environment that could reduce the auditor’s ability to rely on controls?
The audit committee meets more frequently during the year of a significant acquisition to address new reporting risks.
The audit committee includes members with financial reporting expertise and documents meeting minutes with follow-up actions.
The audit committee reviews a summary of uncorrected misstatements and discusses qualitative factors with the auditor.
The audit committee’s meeting minutes are prepared, reviewed, and approved by the chief financial officer without audit committee review.
Explanation
This question addresses control environment assessment, specifically audit committee oversight as described in AU-C 315. The control environment sets the tone at the top and influences control consciousness throughout the organization, with audit committee oversight being a critical element. Having the CFO prepare, review, and approve audit committee minutes without committee review (Choice B) represents a significant weakness because it compromises the independence and effectiveness of audit committee oversight. Financial expertise and documented follow-up (Choice A) strengthen the control environment. Increased meeting frequency for acquisitions (Choice C) demonstrates responsive oversight. Reviewing uncorrected misstatements with qualitative discussions (Choice D) shows active engagement in financial reporting oversight. When the audit committee's independence is compromised by management controlling its documentation, the auditor cannot rely on this control environment element. The auditor should assess whether this weakness affects the ability to rely on other controls and may need to increase substantive procedures.
In a financial statement audit of a nonissuer, you identified a key control over completeness of sales: the billing supervisor reviews a daily unmatched shipping report (shipments not yet invoiced) and ensures invoices are generated or issues are resolved, documenting actions taken. Which procedure is most appropriate to test the operating effectiveness of this control?
Perform a cutoff test at year-end only because daily controls are not tested throughout the year
Inspect a sample of daily unmatched shipping reports for evidence of review and trace selected items to subsequent invoicing or documented resolution
Confirm accounts receivable balances and conclude sales completeness controls are effective if confirmations agree
Reperform the entire billing process for one day and treat that as sufficient evidence for the full year
Explanation
This question covers testing completeness controls in sales for a nonissuer audit, per AU-C 330. The daily review of unmatched shipments ensures invoicing. Choice A is appropriate by inspecting reports and tracing resolutions, aligning with AU-C 330. Choice B limits to year-end, ignoring period coverage per AU-C 330, while Choice C is substantive per AU-C 505. Choice D tests one day only, insufficient for the year. Auditors should sample across periods for ongoing controls. A decision rule is to trace exceptions to resolution for effectiveness.
You are auditing an issuer and plan to rely on a control over estimates: the controller reviews the allowance for credit losses calculation quarterly, comparing key assumptions to historical write-offs and current economic data, and documents conclusions. Which procedure is most appropriate to test the operating effectiveness of this review control?
Obtain an external credit report and treat it as evidence that management's review control is effective
Recalculate the allowance at year-end and, if your estimate is close to management's, conclude the review control operated effectively
Inspect a sample of quarterly reviews for evidence of the controller's documented evaluation of assumptions and follow-up on significant changes
Delay testing until after issuing the audit report because estimate reviews are tested at completion only
Explanation
This question addresses testing review controls over accounting estimates in an issuer's audit, per PCAOB AS 2201. The quarterly review of allowance assumptions is documented with conclusions. Choice A is appropriate by inspecting evaluations and follow-up, aligning with AS 2201. Choice B is substantive recalculation per AS 2501, while Choice C uses external evidence inappropriately. Choice D delays testing; controls must be tested during the audit per AS 2201. A framework is to assess the precision of assumption reviews against standards. This ensures estimates are reliable for financial reporting.