ne y

yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
MODULE 4
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

Topic 1 – Testing internal yd ne y

gy S
controls o f Te c h n ol o

e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
In this Topic gy S
h n o lo y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
1. When U n and why do we need to test internal controls? e c
h t
r ig of T i ty
p y rs
Co How
2. do we identify which controls to test?Un i ve
i g h t
p
3. Designing audit procedures to testCointernal controls yr

4. Do we test every transaction or just some?

Understanding sampling
ne y
5. Executing tests of internal controls yd
o gy S
h n ol
6. Evaluating the evidence – so what? Te c
o f
e rs ity
7. What sort of controls do we expect to see? Univ
ht ig
o p yr
C
© Dr Amanda White - University of Technology Sydney
 y
Context lo gy S
yd ne

c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
1.1 When and why do we Cop

need to test internal controls gy S

yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 y
When do auditors test internal gy S
yd ne
o lo
controls?
ty o
f Tec h n
gy S
yd ne y

e rsi n ol o
• Only when
U n iv CR = low or medium Te c h
i g ht o f
y r rs ity
Cop
• Why don’t we test controls when CR = high? n i v e
t U
y r ig h
• Why test internal controls? Cop
• Testing the protective layer
• Efficiency / saving time ne y
yd
lo gy S
• Tests of controls are audit procedures which evaluate the n o
Te ch
operating effectiveness of controls in preventing, detectingyand
i t of
rs
correcting material misstatements (i.e. working) at theiveassertion
level. h t Un
p y r ig
Co
© Dr Amanda White - University of Technology Sydney
 y
At what pointloduring the audit do we gy S
yd ne
no
do this?ty of Te c h
gy S
yd n ey
e rsi n ol o
U n iv Te c h
ht
3p–yr4igmonths prior 1-2 monthsrafter ty o f
Reporting
EOFY s i
Co to the EOFY n
EOFY
U i ve date
i g h t
o p yr
C
• Preliminary planning • Obtain the Trial • Testing internal controls • Evaluate going
• Understanding the client Balance for the last 3 months of concern
• Gather any the year • Evaluate subsequent
• Understanding the
evidence that can • Gathering substantive events d n ey
transactions and business
only be collected evidence for the last 3 y y
Sthe
processes l o g
• Finalise audit
around the EOFY months of the year o
hnopinion
• Testing internal controls for
• Gathering evidence on of Te c
first 9 months of the year y • Sign the audit
• Gathering substantive rsit
balance sheet accounts
i ve opinion
evidence on transactions for tU n
r ig h
first 9 months of the year
o p y
C
© Dr Amanda White - University of Technology Sydney
 y
Remember we also want to know gy S
yd ne
o lo
when the
t y o controls
fTe c h n
are NOT operating
g y Syd n ey
e rsi n o lo
• WegcannotU n iv rely on the controls to protect the accounting Te ch
r i ht t y of
py – they do not help reduce the ROMM. ivers i
Codata n
t U
r ig h
• We will search for any other controlsCo–pycompensating
controls.
• If there is/are no compensating control/s, the auditor will
have to revise the CR assessment, change DR and adjust d n ey
g y Sy
the audit strategy n o lo
h c
o f Te
s it y
v e r
U ni
r i g ht
y
Cop
© Dr Amanda White - University of Technology Sydney
 ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
1.2 How do we identify which Cop

controls to test? gy S
yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
Identifyingecthe lo key controls gy S
hno d ne y
of T y
i t y o gy S
i ve r
s
h n ol
• A companyU n will have many controls in a business Te
process c
g h t i o f
p yr rs i ty
C o
• Match your controls to the assertions U n i ve
ig h t
o p yr
• Test one or two controls that best C
ensures data meets the
assertion in question
• It doesn’t matter whether it is an IT-based or manual ne y
yd
control – we evaluate and test both. o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
c h no lo gy S An example
ey
e dn
i ty of T o gy Sy
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
Cop 1.3 Designing audit
y r

yr i g h t Un i v e rs ity

procedures to test internal Cop

controls gy S
yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 y
What does anlo audit procedure need to gy S
yd ne
no
do? t y o fTe c h
g y Syd n ey
e rsi n ol o
v h
ht Uni o f Te c
• Gather
y r i g sufficient and appropriate evidence rs ity
Cop i v e
h t Un
yr i g
• Sufficient = Cop

• Appropriate =
ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
• Auditors must DESIGN their procedures Un i v
ig h t
p y r
Co
© Dr Amanda White - University of Technology Sydney
 ne y
yd
What if I asked gy S
h n olo you to draw a bird? y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
• Would U n
you feel confident in drawing a bird? Te c
gh t i o f
p yr e rs ity
C o i v
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
Instead – let’s gy S
h n olo try drawing a squiggle y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
U n Teinto a c
• Your
ig hsquiggle
t here • How can you turn o it
f
y r rs i ty
Cop bird? n i ve
h t U
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 y
The sample principle applies for gy S
yd ne
o lo
designing
ty o f Teaudit
c h n
procedures gy S
yd ne y

e rsi n o lo
• Amanda’s U n iv 4 rules for designing audit procedures Te ch
r i g ht t y of
py e rs i
C o
1. Use audit specific terminology when starting toUbuild n i v your
ig h t
procedure y r
Cop
2. Use client specific terminology
3. Be specific – instructions should be detailed enough for someone
else to follow ne y
yd
o gy S
4. Make sure your procedure is fit for purpose h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
Let’s try anechexample
o – sales process gy S
nol ne y
T yd
i t y of o gy S
i ve r
s
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 d n ey
Control Procedure togytest Sy operating Sampling
effectiveness h n o lo method y
Tec yd ne
yo f gy S
s i t ol o
U n i ve r Te c h n
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
Cop 1.4 Do we test every
y r

yr i g h t Un i v e rs ity

transaction or just some? Cop

Understanding sampling gy S
yd ne y
ol o
How many times does a control execute or run? c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 y
In the past – why haven’t tested every gy S
yd ne
o lo
time a control
t y o fTe c h n
runs g y Syd n ey
e rsi n o lo
• Expensive U n iv – manually collecting evidence and checking Te ch
r i g ht t y of
py i
rs human
Cowhether the control is operating correctly requires n i v e
effort t U
y r ig h
Cop
• Evaluated monitoring control reports
• Controls are often IT-based – once we can prove it works
at specific points in time over the year – we can assume it d n ey
g y Sy
worked over the entire year. n o lo
h c
o f Te
• With more modern data analytics tools - there is potentials it y
v e r
for more testing t U ni
h ig
o p yr
C
© Dr Amanda White - University of Technology Sydney
 ne y
yd
What doesecsampling
lo mean? gy S
hno d ne y
of T y
i t y o gy S
i ve r
s
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
But could things go wrong? gy S
h n o lo y
ec d ne
y o fT gy S
y
e rs it o lo
• Sampling n iv risk ch n
U Te
r i g ht t y of
•y “the risk that the auditor’s conclusion based on a sample rs i may be
Cop different from the conclusion if the entire population i v e
n were
t U
r ig h
subjected to the same audit procedure” ASA500.5(c)
y
Cop
• What does that mean?
• Conclusion that controls are working correctly, when they aren’t
effective ne y
yd
lo gy S
• Does this result in an overstatement or understatement of n o
Control Risk? Te ch
i t y of
v e rs
• Non-sampling risk Un i
ig h t
p y
• That the auditor makes an inappropriate judgementr
Co
© Dr Amanda White - University of Technology Sydney
 ne y
yd
How do weechrespond
o to sampling risk? gy S
nol ne y
T yd
i t y of o gy S
i ve r
s
h n ol
• WegneedU n to select a sample that is “representative” f Te c
h t i o
p yr rs i ty
C o
• How do we do that? U n i ve
ig h t
y r
• Statistical analysis of the population Cop
• Using technology tools to help us with sampling

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 n ey
Sampling
d
g y Sy
o
ch nol approaches ne y
Te yd
i ty of o gy S
i ve rs
h n ol
U n Te c
t
igh Statistical o f
y r Non-statistical rs i ty
Cop sampling n i ve
sampling
h t U
y r i g
Cop
Random
Haphazard
sampling

ne y
yd
o gy S
Interval
Block h n ol
sampling Te c
o f
e rs ity
i v
Monetary unit / ht Un
r i g
dollar value
Co py Judgemental
sampling
© Dr Amanda White - University of Technology Sydney
 ne y
yd
Steps for audit gy S
h n olo sampling y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
1. DesignU n the test Te c
gh t i o f
p yr e rs ity
C o i v
2. Identify the population you need to selectt Uyour
n sample
from y r ig h
Cop
3. Do you need to stratify?
4. Select the sample ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
Selecting the gy S
h n olopopulation y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
c
t Un
• It allghcomes
i
e
down to understanding the audit procedure.
of T
p yr rs i ty
C o
• What document do you start with? U n i ve
ig h t
o p yr
• This choice doesn’t limit what other Cevidence you gather

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
1.5 Executing tests of internal Cop

controls gy S
yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
The physical gy S
h n olhow
o to y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
• RememberU n you are looking for proof of the internal Te
control c
g h t i o f
p yr rs i ty
C o
U n i ve
ig h t
y r
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop
Make sure you attend the workshop
for the follow along exercise ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
1.6 Evaluating the evidence – Cop

so what? gy S
yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
What are we gy S
h n olooking
lo for? y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
• Searching
U n for deviations in internal controls Te c
gh t o f
p y ri rs ity
Co • AKA when a control does not work i v e
h t Un
yr i g
Cop
• How many control deviations are acceptable?
• Audit manager or supervisor will provide you with a tolerable
level or rate of deviations
ne y
yd
gy S
!"#$%& '( )%*+,-+'./
• Calculate the actual rate = ol o
0'-,1 2'.-&'1 ,2-+*+-+%/ -%/-%)
c h n
o f Te
• Investigate the cause of the deviations – why? rs ity
i v e
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
Are controls gy S
h n ooperating
lo effectively? y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 y
How often to ldo we need to test gy S
yd ne
oo
controls?
ty o
f Tec h n
gy S
yd ne y

e rsi n o lo
U n iv
• Theghstandards recommend at least every 3 financial Te ch
i t y of
py r i t
rs system
Coperiods (assuming nothing in the internal control n i v e
changes) t U
y r ig h
Cop
• So the reality is a bit different!

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
1.7 What sort of controls do Cop

you expect to see? gy S

yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 ne y
yd
Sales and cash receipts process gy S
h n o lo y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
• Who are
U n the customers? Te c
gh t i o f
p yr e rs ity
C o i v
• How are prices set? t Un
i g h
yr
• How are discounts organised? Cop

• How are sales on credit processed?

ne y
• How do they chase up late payments? yd
o gy S
h n ol
• How are payments received from customers? f Te c
ity o
• How is cash handled? i v e rs
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 y
Purchasing and accounts payable gy S
yd ne
o lo
processty of Tec h n
gy S
yd ne y

e rsi n o lo
• Multi-step U n iv process for purchasing items Te ch
r i g ht t y of
y rs i
Cop• Segregation of duties – request, approve, process, i v e
n receive items,
t U
receive invoice and process payment y r ig h
Cop
• 3 way match process for payments – purchase order,
receiving report, invoice
ne y
• How are payments processed? Who accesses the bank yd
lo gy S
account? h n o
Tec f
rs i ty o
U n i ve
g h t
y ri
Cop
© Dr Amanda White - University of Technology Sydney
 ne y
Try brain storming controls for any gy S
yd
o lo
account orof Tprocess
ec h n
in a typical companyy Sydney
rs i ty o lo g
• How U n
would payroll be i ve
processed at a large retail store?Tec h n
gh t i o f
p yr rs i ty
C o
• What should the process be for purchasingt Unewn property i ve
plant and equipment? y r ig h
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney