A5. The nature of an audit procedure refers to its purpose (i.e., test of controls or substantive procedure) and its type (i.e., inspection, observation, inquiry, confirmation, recalculation, reperformance, or analytical procedure). The nature of the audit procedures is of most importance in responding to the assessed risks.
A6. Timing of an audit procedure refers to when it is performed, or the period or date to which the audit evidence applies.
A7. Extent of an audit procedure refers to the quantity to be performed, for example, a sample size or the number of observations of a control activity.
A8. Designing and performing further audit procedures whose nature, timing and extent are based on and are responsive to the assessed risks of material misstatement at the assertion level provides a clear linkage between the auditors’ further audit procedures and the risk assessment. Responding to the Assessed Risks at the Assertion Level (Ref: Para. 7(a))
A9. The auditor’s assessed risks may affect both the types of audit procedures to be performed and their combination. For example, when an assessed risk is high, the auditor may confirm the completeness of the terms of a contract with the counterparty, in addition to inspecting the document. Further, certain audit procedures may be more appropriate for some assertions than others. For 1 For example, as required by paragraph 18, irrespective of the approach selected, the auditor designs and performs substantive procedures for each significant class of transactions, account balance, and disclosure. example, in relation to revenue, tests of controls may be most responsive to the assessed risk of misstatement of the completeness assertion, whereas substantive procedures may be most responsive to the assessed risk of misstatement of the occurrence assertion.
A10. The reasons for the assessment given to a risk are relevant in determining the nature of audit procedures. For example, if an assessed risk is lower because of the particular characteristics of a class of transactions without consideration of the related controls, then the auditor may determine that substantive analytical procedures alone provide sufficient appropriate audit evidence. On the other hand, if the assessed risk is lower because of internal controls, and the auditor intends to base the substantive procedures on that low assessment, then the auditor performs tests of those controls, as required by paragraph 8(a). This may be the case, for example, for a class of transactions of reasonably uniform, non-complex characteristics that are routinely processed and controlled by the entity’s information system.
A11. The auditor may perform tests of controls or substantive procedures at an interim date or at the period end. The higher the risk of material misstatement, the more likely it is that the auditor may decide it is more effective to perform substantive procedures nearer to, or at, the period end rather than at an earlier date, or to perform audit procedures unannounced or at unpredictable times (for example, performing audit procedures at selected locations on an unannounced basis). This is particularly relevant when considering the response to the risks of fraud. For example, the auditor may conclude that, when the risks of intentional misstatement or manipulation have been identified, audit procedures to extend audit conclusions from interim date to the period end would not be effective.
A12. On the other hand, performing audit procedures before the period end may assist the auditor in identifying significant matters at an early stage of the audit, and consequently resolving them with the assistance of management or developing an effective audit approach to address such matters.
A13. In addition, certain audit procedures can be performed only at or after the period end, for example: Agreeing the financial statements to the accounting records; Examining adjustments made during the course of preparing the financial statements; and Procedures to respond to a risk that, at the period end, the entity may have entered into improper sales contracts, or transactions may not have been finalised.
A14. Further relevant factors that influence the auditor’s consideration of when to perform audit procedures include the following: The control environment. When relevant information is available (for example, electronic files may subsequently be overwritten, or procedures to be observed may occur only at certain times). The nature of the risk (for example, if there is a risk of inflated revenues to meet earnings expectations by subsequent creation of false sales agreements, the auditor may wish to examine contracts available on the date of the period end). The period or date to which the audit evidence relates.
A15. The extent of an audit procedure judged necessary is determined after considering the materiality, the assessed risk, and the degree of assurance the auditor plans to obtain. When a single purpose is met by a combination of procedures, the extent of each procedure is considered separately. In general, the extent of audit procedures increases as the risk of material misstatement increases. For example, in response to the assessed risk of material misstatement due to fraud, increasing sample sizes or performing substantive analytical procedures at a more detailed level may be appropriate. However, increasing the extent of an audit procedure is effective only if the audit procedure itself is relevant to the specific risk.
A16. The use of computer-assisted audit techniques (CAATs) may enable more extensive testing of electronic transactions and account files, which may be useful when the auditor decides to modify the extent of testing, for example, in responding to the risks of material misstatement due to fraud. Such techniques can be used to select sample transactions from key electronic files, to sort transactions with specific characteristics, or to test an entire population instead of a sample.
A17. In certain circumstances, the audit mandate and any other special auditing requirements may affect the auditor’s consideration of the nature, timing and extent of further audit procedures.
Considerations specific to smaller entities
A18. In the case of very small entities, there may not be many control activities that could be identified by the auditor, or the extent to which their existence or operation have been documented by the entity may be limited. In such cases, it may be more efficient for the auditor to perform further audit procedures that are primarily substantive procedures. In some rare cases, however, the absence of control activities or of other components of control may make it impossible to obtain sufficient appropriate audit evidence.
Higher Assessments of Risk (Ref: Para 7(b))
A19. When obtaining more persuasive audit evidence because of a higher assessment of risk, the auditor may increase the quantity of the evidence, or obtain evidence that is more relevant or reliable, e.g., by placing more emphasis on obtaining third party evidence or by obtaining corroborating evidence from a number of independent sources.
Designing and Performing Tests of Controls (Ref: Para. 8)
A20. Tests of controls are performed only on those controls that the auditor has determined are suitably designed to prevent, or detect and correct, a material misstatement in an assertion. If substantially different controls were used at different times during the period under audit, each is considered separately.
A21. Testing the operating effectiveness of controls is different from obtaining an understanding of and evaluating the design and implementation of controls. However, the same types of audit procedures are used. The auditor may, therefore, decide it is efficient to test the operating effectiveness of controls at the same time as evaluating their design and determining that they have been implemented.
A22. Further, although some risk assessment procedures may not have been specifically designed as tests of controls, they may nevertheless provide audit evidence about the operating effectiveness of the controls and, consequently, serve as tests of controls. For example, the auditor’s risk assessment procedures may have included: Inquiring about management’s use of budgets.
Observing management’s comparison of monthly budgeted and actual
expenses. Inspecting reports pertaining to the investigation of variances between budgeted and actual amounts. These audit procedures provide knowledge about the design of the entity’s budgeting policies and whether they have been implemented, but may also provide audit evidence about the effectiveness of the operation of budgeting policies in preventing or detecting material misstatements in the classification of expenses.
A23. In addition, the auditor may design a test of controls to be performed concurrently with a test of details on the same transaction. Although the purpose of a test of controls is different from the purpose of a test of details, both may be accomplished concurrently by performing a test of controls and a test of details on the same transaction, also known as a dual-purpose test. For example, the auditor may design, and evaluate the results of, a test to examine an invoice to determine whether it has been approved and to provide substantive audit evidence of a transaction. A dual-purpose test is designed and evaluated by considering each purpose of the test separately.
A24. In some cases, as discussed in SA 315, the auditor may find it impossible to design effective substantive procedures that by themselves provide sufficient appropriate audit evidence at the assertion level2. This may occur when an entity conducts its business using IT and no documentation of transactions is produced or maintained, other than through the IT system. In such cases, paragraph 8(b) requires the auditor to perform tests of relevant controls.
Audit Evidence and Intended Reliance (Ref: Para. 9)
A25. A higher level of assurance may be sought about the operating effectiveness of controls when the approach adopted consists primarily of tests of controls, in particular where it is not possible or practicable to obtain sufficient appropriate audit evidence only from substantive procedures.
Nature and Extent of Tests of Controls
Other audit procedures in combination with inquiry (Ref: Para. 10(a))
A26. Inquiry alone is not sufficient to test the operating effectiveness of controls. Accordingly, other audit procedures are performed in combination with inquiry. In this regard, inquiry combined with inspection or reperformance may provide more assurance than inquiry and observation, since an observation is pertinent only at the point in time at which it is made.
A27. The nature of the particular control influences the type of procedure required to obtain audit evidence about whether the control was operating effectively. For example, if operating effectiveness is evidenced by documentation, the auditor may decide to inspect it to obtain audit evidence about operating effectiveness. For other controls, however, documentation may not be available or relevant. For example, documentation of operation may not exist for some factors in the control environment, such as assignment of authority and responsibility, or for some types of control 2 SA 315, paragraph 30. activities, such as control activities performed by a computer. In such circumstances, audit evidence about operating effectiveness may be obtained through inquiry in combination with other audit procedures such as observation or the use of CAATs.
Extent of tests of controls
A28. When more persuasive audit evidence is needed regarding the effectiveness of a control, it may be appropriate to increase the extent of testing of the control. As well as the degree of reliance on controls, matters the auditor may consider in determining the extent of tests of controls include the following: The frequency of the performance of the control by the entity during the period. The length of time during the audit period that the auditor is relying on the operating effectiveness of the control. The expected rate of deviation from a control. The relevance and reliability of the audit evidence to be obtained regarding the operating effectiveness of the control at the assertion level. The extent to which audit evidence is obtained from tests of other controls related to the assertion. SA 530, “Audit Sampling” contains further guidance on the extent of testing.
A29. Because of the inherent consistency of IT processing, it may not be necessary to increase the extent of testing of an automated control. An automated control can be expected to function consistently unless the program (including the tables, files, or other permanent data used by the program) is changed. Once the auditor determines that an automated control is functioning as intended (which could be done at the time the control is initially implemented or at some other date), the auditor may consider performing tests to determine that the control continues to function effectively. Such tests might include determining that: Changes to the program are not made without being subject to the appropriate program change controls; The authorised version of the program is used for processing transactions; and Other relevant general controls are effective. Such tests also might include determining that changes to the programs have not been made, as may be the case when the entity uses packaged software applications without modifying or maintaining them. For example, the auditor may inspect the record of the administration of IT security to obtain audit evidence that unauthorised access has not occurred during the period.
Testing of indirect controls (Ref: Para. 10(b))
A30. In some circumstances, it may be necessary to obtain audit evidence supporting the effective operation of indirect controls. For example, when the auditor decides to test the effectiveness of a user review of exception reports detailing sales in excess of authorized credit limits, the user review and related follow up is the control that is directly of relevance to the auditor. Controls over the accuracy of the information in the reports (for example, the general IT- controls) are described as “indirect” controls.
A31. Because of the inherent consistency of IT processing, audit evidence about the implementation of an automated application control, when considered in combination with audit evidence about the operating effectiveness of the entity’s general controls (in particular, change controls), may also provide substantial audit evidence about its operating effectiveness.
Timing of Tests of Controls
Intended period of reliance (Ref: Para. 11)
A32. Audit evidence pertaining only to a point in time may be sufficient for the auditor’s purpose, for example, when testing controls over the entity’s physical inventory counting at the period end. If, on the other hand, the auditor intends to rely on a control over a period, tests that are capable of providing audit evidence that the control operated effectively at relevant times during that period are appropriate. Such tests may include tests of the entity’s monitoring of controls. Using audit evidence obtained during an interim period (Ref: Para. 12)
A33. Relevant factors in determining what additional audit evidence to obtain about controls that were operating during the period remaining after an interim period, include: The significance of the assessed risks of material misstatement at the assertion level. The specific controls that were tested during the interim period, and significant changes to them since they were tested, including changes in the information system, processes, and personnel. The degree to which audit evidence about the operating effectiveness of those controls was obtained. The length of the remaining period. The extent to which the auditor intends to reduce further substantive procedures based on the reliance of controls. The control environment.
A34. Additional audit evidence may be obtained, for example, by extending tests of controls over the remaining period or testing the entity’s monitoring of controls.
Using audit evidence obtained in previous audits (Ref: Para.13)
A35. In certain circumstances, audit evidence obtained from previous audits may provide audit evidence where the auditor performs audit procedures to establish its continuing relevance. For example, in performing a previous audit, the auditor may have determined that an automated control was functioning as intended. The auditor may obtain audit evidence to determine whether changes to the automated control have been made that affect its continued effective functioning through, for example, inquiries of management and the inspection of logs to indicate what controls have been changed. Consideration of audit evidence about these changes may support either increasing or decreasing the expected audit evidence to be obtained in the current period about the operating effectiveness of the controls.
Controls that have changed from previous audits (Ref: Para. 14(a))
A36. Changes may affect the relevance of the audit evidence obtained in previous audits such that there may no longer be a basis for continued reliance. For example, changes in a system that enable an entity to receive a new report from the system probably do not affect the relevance of audit evidence from a previous audit; however, a change that causes data to be accumulated or calculated differently does affect it. Controls that have not changed from previous audits (Ref: Para. 14(b))
A37. The auditor’s decision on whether to rely on audit evidence obtained in previous audits for controls that:
