Audit Process: Building and Executing Test Plans

• Chapter 9, Part 1 focuses on Building and Executing the Test Plan
• Phase III of the Audit Process Model deals with testing and obtaining evidence.
• Auditors must evaluate the design of controls and whether these have been implemented.
• If the design of controls is considered adequate, the auditor needs to assess the operating effectiveness, or implementation, of relevant internal controls through tests.
• If the auditor assumes controls operate effectively, it results in low CR (Control Risk)
• Substantive procedures, on their own, may prove inadequate.

Tests of Control

• The greater reliance placed on a control's effectiveness necessitates more persuasive audit evidence.
• Reliance on controls over purchases, like authorization, custody, and recording, also requires substantive testing on purchases.
• When assessing operating effectiveness, misstatements found by substantive procedures suggest that controls are not working effectively.
• The absence of misstatements doesn't automatically imply the tested controls are effective.
• A material misstatement found by the auditor is a strong sign of a significant deficiency in internal control.
• Assessing the effectiveness of controls acknowledges that some deviations may occur due to personnel changes, seasonal shifts, or human error.
• Upon detecting deviations, auditors must assess the deficiency's severity and its impact on the control risk assessment.
• Auditors could revise CR (Control Risk) and adjust planned substantive procedures based on increased detection risk (DR).

Expected Rate of Deviation (ERD)

• Represents the rate of control failures the auditor anticipates based on experience, client knowledge, or risk assessment.
• It is determined before testing to aid in planning the sample size for control testing.
• A higher expected deviation rate necessitates testing more samples for a reliable conclusion.

Detected Rate of Deviation (DRD)

• Represents the actual rate of control failures discovered during audit testing
• It is calculated following control tests on a sample of transactions.
• If the detected rate exceeds the tolerable rate, auditors might need to increase substantive procedures, instead of relying on controls.

Tolerable Deviation Rate (TDR)

• The maximum control failure rate acceptable before concluding the control is ineffective.
• Set before testing based on the importance of the control.
• If the detected deviation rate exceeds this, the auditor can't rely on the control and must perform more substantive procedures.

Techniques to Assess if controls are Operating Effectively

• Inquiry: Asking management/staff about control procedures.
• Observation: Watching a control process in action, like inventory counts.
• Inspection: Reviewing documents related to controls, for example, authorization of transactions.
• Reperformance: Independently executing a control to assess its effectiveness.