By MIA Professional Practices & Technical
In Part 1 of this article, we have briefly introduced and highlighted the importance of test of controls (TOC), the principles behind TOC as well as the type of TOC and the level of reliability of audit evidence obtained from each type of TOC.
For the second and last part of this article, more aspects of TOC will be further discussed which includes the timing, nature and extent of TOC and also considerations for smaller entities. The effectiveness of these procedures can help improve the overall efficiency of the audit fieldwork.
Timing of TOC
The auditor shall test controls for the particular time, or throughout the period, on which the auditor intends to rely. For instance, if the auditor is to rely on a control over a period, the tests of the entity’s monitoring of controls should cover the entire financial period in which the activities are carried out, instead of certain months of the financial period only.
Nature and Extent of TOC
Paragraph 10 of ISA 330 imposes requirements for the auditor when designing and performing TOC as follows:
- Auditor shall perform other audit procedures in combination with inquiry to obtain audit evidence about the operating effectiveness of the controls, including:
- Auditor shall determine whether the controls to be tested depend upon other controls (indirect controls) and, if so, whether it is necessary to obtain audit evidence supporting the effective operation of those indirect controls.
When more persuasive audit evidence is needed regarding the effectiveness of a control, it may be appropriate to increase the extent of testing of the control. In determining the extent of tests of controls to be performed, auditors should consider the following factors:
If the auditor plans to use audit evidence from a previous audit about the operating effectiveness of specific controls, the auditor shall establish the continuing relevance of that evidence by obtaining audit evidence about whether significant changes in those controls have occurred subsequent to the previous audit. The auditor is required to make inquiry in combination with observation or inspection, in confirming the auditor’s understanding of those specific controls, and:
- If there have been changes that affect the continuing relevance of the audit evidence from the previous audit, the auditor shall test the controls in the current audit.
- If there have not been such changes, the auditor shall test the controls at least once in every third audit and shall test some controls during each audit in the subsequent two audit periods.
Using Audit Evidence Obtained in Previous Audits
Paragraph 13 of the ISA 330 indicates that the auditor is allowed to use audit evidence obtained in previous audits, subject to the proofs established by the auditor on the continuing relevance of that evidence. The auditor shall consider the following:
Considerations Specific to Smaller Entities
There is always a need to consider the disparity of the structure and simplicity of internal controls in smaller entities.
In the case of very small entities, there may not be many control activities that could be identified by the auditor, or the extent to which their existence or operation have been documented by the entity may be limited. In such cases, Paragraph A18 in ISA 330 provides special considerations to those entities whereby it may be more efficient for the auditor to perform further audit procedures that are primarily substantive procedures. In rare cases for some very small entities, however, the absence of control activities or of other components of control may make it impossible to obtain sufficient appropriate audit evidence.
A TOC assesses the operating effectiveness of the audit client’s internal controls in preventing and detecting material misstatements. TOC also assists auditors to reconfirm whether their initial understanding obtained when assessing the control environment and internal controls is appropriate or otherwise. This would then enable auditors to determine the extent of their reliance on the internal control system during the audit fieldwork.
Therefore, it is expedient for auditors to consider whether greater efficiency could be achieved by placing more emphasis on TOC in order to reduce the extent of substantive audit procedures as seen in the flowchart below. By having resources deployed to performing procedures that are more tailored to the level of risk, both audit quality and efficiency could be better attained.