Basic/Overview
What component of the audit risk model does TOC determine?
AR = IR × CR × DR
TOCs directly affect the Control Risk (CR) component, which in turn influences the amount and nature of substantive procedures needed.
False!
They are done before the TOC.
This is the minimum number of samples required for a control that occurs monthly or quarterly.
2
The auditor examined payroll records to check whether each one had been approved by the HR manager.
Inspection
The auditor asked for the reviewed and signed inventory count sheet for a TOC.
Specific evidence gathered
inventory count sheets and signature records
What is the purpose of test of controls?
To evaluate whether a company’s internal controls are operating effectively to prevent, detect, or correct material misstatements in the financial statements.
Tracing a transaction to supporting documents during a walkthrough helps determine if a control has been implemented.
True!
Walkthroughs involve tracing and are used to verify the control is in place and functioning, not just designed.
For a daily control performed 365 times a year, how many samples should an auditor select to obtain reasonable assurance?
25 - 60
To test the reconciliation control, the auditor independently recalculated the bank reconciliation for February and compared the result to the client’s version.
Reperformance
To test the review of timesheets control, the auditor selected 5 review samples because the controller performs the check on a weekly basis.
Sample size and rationale
What happens if a TOC fails?
- Control Risk increases, so auditor cannot rely on the control.
- More substantive testing is required (larger sample, more detail).
- Audit approach may shift from combined to fully substantive.
- Control deficiency is evaluated and may need to be reported.
Tests of controls are only required when the auditor plans to rely on the controls to reduce substantive testing.
True!
TOCs are performed only if the auditor intends to rely on controls. Otherwise, a fully substantive approach is used.
How many samples does an auditor need to test if the control is fully automated and has been tested for change management?
1
The auditor selected 30 sales orders and followed them through to invoices and shipping documents to confirm matching quantities and dates.
Inspection, Reperformance
The auditor documented that "All sales over $100,000 must be approved by the regional manager. To test this control, we reviewed the samples and confirmed an approval signature was present in each case".
Evidence-gathering Techniques: Inspection
What do we have to do before a TOC?
1. Obtain an Understanding of the Control Environment
2. Perform a Walkthrough
The purpose of a TOC is to assess the risk of material misstatement at the financial statement level.
False!
It is to evaluate whether internal controls are operating effectively and auditor can rely on the controls.
If a control occurs on an ad hoc basis and doesn't fall into a defined frequency category, how should an auditor determine the sample size?
Using professional judgement
The auditor sat with a plant technician and watched them complete an emissions entry form using the standardized template during a live control execution.
Observation
The control tested is a bank reconciliation that is prepared monthly and independently reviewed by a supervisor. The auditor selected 2 reconciliations, traced reconciling items to supporting documents, and noted who signed off and when. The test supports the accuracy and completeness assertions.
This one includes all four: evidence gathering techniques, assertions are stated, sample size is given (monthly → 2), and the auditor’s procedures (inspection + tracing) are detailed.