Tests of controls

Accounting Ahead | Original study resource | accountingahead.com.au

Tests of controls

MODULE 3 | 3.2.1 | STUDENT COMPANION

A test of controls asks whether a control operated effectively throughout the period of reliance: how it

was applied, how consistently, and by whom or by what means. That goes beyond Module Two's check of

design and implementation. Enquiry must be combined with inspection, observation or reperformance.

Automated controls can be tested lightly when the general IT controls show the program didn't change.

Interim testing needs evidence for the rest of the period, evidence from earlier audits can be used only

within limits, and controls over significant risks are always tested in the current period. Every deviation

must be understood before deciding whether reliance still makes sense.

Design and implementation, or operating effectiveness?

Design and implementation (Module Two)

Design: could the control, as designed, stop a material

misstatement, or find and fix one?

Implementation: does it exist, and is the entity actually using

it?

Usually one walkthrough, at a point in time

Test of operating effectiveness

Did it operate effectively throughout the period the auditor

intends to rely on it?

How was it applied at different times during the period?

Was it applied consistently?

By whom, or by what means?

Only test well-designed controls

Testing a badly designed control only proves that a bad control was

followed

Deviation

A control that didn't operate as designed, whether or not a

misstatement actually resulted

Why test controls at all? Testing controls is a choice the auditor makes when relying on them will reduce the

substantive work, and a necessity when substantive procedures alone can't give enough evidence, as in highly

automated processes with no paper trail. A walkthrough shows that a control exists; it says nothing about the

other days of the year.

ADVANCED AUDIT AND ASSURANCE | M3 | 3.2.1 | STUDENT COMPANION

1

Accounting Ahead | Original study resource | accountingahead.com.au

Ways to test whether a control operated

Enquiry

Ask the people involved

how the control works

and what they do with

exceptions

e.g. asking the sales

manager how discount

approvals are handled

Never enough on its

own

Inspection

Examine evidence that

the control was

performed

e.g. a manager's

electronic approval on a

discount; a signed,

reviewed bank

reconciliation

Good, where the

control leaves a trail

Observation

Watch the control being

performed: useful when it

leaves no trail

e.g. seeing how duties

are actually split

between depot staff

Shows only what

happened while the

auditor watched

Reperformance

Carry out the control

again, independently

e.g. redoing a

reconciliation; following

up items on an

exception report

Strong evidence

Computer-assisted

techniques

Test the controls built

into software directly

e.g. test data and similar

techniques (next lesson)

Direct evidence about

the program

Strongest in practice: enquiry combined with inspection or reperformance

One perfect performance proves little. Watching a control performed well on one afternoon shows it worked

then, while someone was watching. For the rest of the year the auditor needs evidence that leaves a trail, or

repeated observations at different, unannounced times.

Automated, general IT and indirect controls

Automated controls. Voltana's system won't recognise revenue until a customer-signed installation

completion form has been submitted and matched to the contract. Software applies a rule the same way

every time, so a few well-chosen examples can test it, as long as the program wasn't changed without

authority during the period.

General IT controls come first. Change management and access controls are what let the auditor say that

a control tested once kept working all year. If they are weak, the automated control must be tested more

directly, or the auditor relies on substantive work instead.

Indirect controls. A manager's monthly review of a sales report is only as good as the report. The auditor

also tests the accuracy and completeness of the report the manager used.

Timing and evidence from earlier audits

Situation What the auditor needs

Controls tested at an interim date Evidence about any significant changes to those controls since the interim

date, then a decision on what more the remaining months need: for example,

extend the tests to that period, or test how the entity monitors its controls

A control tested in an earlier audit,

unchanged since

May rely on that evidence after confirming nothing has changed, but must

retest each such control at least once in every three audits, and test some

controls in every audit

A control that has changed since it

was last tested

Test it in the current audit

A control over a significant risk Always test it in the current period: earlier years' evidence can't be used

ADVANCED AUDIT AND ASSURANCE | M3 | 3.2.1 | STUDENT COMPANION

2

Accounting Ahead | Original study resource | accountingahead.com.au

Voltana's plan across the system change

Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun

Old system (July to January) New system (February to June)

The team's

plan

Substantive approach to revenue

No controls relied on, and the substantive work is designed on that

basis

Rely on the new system's controls

Completion-form rule, discount approvals, and the

general IT controls behind them

Not chosen:

rely all year

Test the old system's controls

Seven months of evidence

Test the new system's controls

Five months of evidence

Plus the

data

migration

New system live: February 2026

Revenue is a significant risk: any control relied on must be tested this year, not carried forward from earlier audits

A sensible trade-off. Relying on controls for the whole year would mean testing the old system for seven

months, the new one for five, and the migration between them, all in this year's audit because revenue is a

significant risk. The team relies only on the new system from February, and designs the July to January

substantive work on the basis that no controls were relied on for that part of the year.

When a test finds deviations

The team tests sixty discounts above 10% for evidence of a manager's electronic approval and finds two

approved only after the sale had been recorded. The auditor then:

makes specific enquiries to understand each deviation and its cause;

considers whether it was a one-off error or a sign of something more, such as deliberate override: two late

approvals by the same manager, both on large June sales, tell a different story from two random slips;

decides whether the tests still give an appropriate basis for reliance, whether more tests of controls are

needed, or whether the risk must be met with more substantive procedures instead.

ADVANCED AUDIT AND ASSURANCE | M3 | 3.2.1 | STUDENT COMPANION

3

Accounting Ahead | Original study resource | accountingahead.com.au

Practice questions

MODULE 3 | 3.2.1 | TRY THESE BEFORE THE WORKED ANSWERS

Question 1 - Design and implementation, or operating effectiveness?

Keelson Forwarding Pty Ltd (imagined) arranges sea and air freight and customs clearance for importers. Its

year ends on 30 June. Say whether each procedure tests design and implementation or operating effectiveness.

Procedure Design and implementation, or

operating effectiveness?

(a) Follow one shipment through the system, from booking to invoice, noting

each control along the way

(b) Inspect the finance manager's electronic approval, and its date, on 25 credit

notes above $2,000 chosen from across the year

(c) Ask the credit controller how she deals with customers who go over their

credit limit

(d) Read the delegation of authority policy for approving credit notes

(e) Redo the reconciliation of shipping lines' statements to the cost ledger for

three months spread across the year

(f) Watch, once, as two staff open the high-value cargo cage together, to see

that the procedure is in place

(g) For every change to the freight rate tables during the year, check the

change log for approval and testing

(h) For weekly exception reports chosen across the year, check that each item

was investigated and cleared

ADVANCED AUDIT AND ASSURANCE | M3 | 3.2.1 | STUDENT COMPANION

4

Accounting Ahead | Original study resource | accountingahead.com.au

Question 2 - Design a test of controls

For each of Keelson's controls, choose the best combination of procedures to test whether it operated effectively

throughout the year.

Control at Keelson Your test of controls (combination of procedures)

(1) The job system won't let an invoice be

raised until a proof of delivery has been

saved to the job

(2) Each month an accounts officer

reconciles every shipping line's statement to

the cost ledger; the finance manager reviews

and signs each reconciliation

(3) Two staff must be present whenever the

locked high-value cargo cage is opened

(4) Credit notes above $2,000 need the

finance manager's electronic approval before

they are issued

Question 3 - A payroll system changed mid-year

Until 31 December, Keelson ran payroll on an old in-house system. From 1 January it uses a payroll service

rented from a cloud provider; employee details, pay rates and leave balances were migrated in December.

Payroll is not a significant risk, and last year the team tested the old system's payroll controls and found them

effective. The team would like to rely on payroll controls this year. Plan the testing of controls.

ADVANCED AUDIT AND ASSURANCE | M3 | 3.2.1 | STUDENT COMPANION

5

Accounting Ahead | Original study resource | accountingahead.com.au

Worked answers

MODULE 3 | 3.2.1 | WORKED ANSWERS - ATTEMPT THE QUESTIONS FIRST

Question 1 - Keelson Forwarding

Tests Why

(a) Design and implementation A walkthrough of one transaction shows the controls exist and how they

work

(b) Operating effectiveness Evidence of approval across the year, including whether it came before

issue

(c) Design and implementation Enquiry helps understanding, but alone it can't show the control operated

(d) Design and implementation A policy shows what should happen, not what did

(e) Operating effectiveness Reperformance at different times during the year

(f) Design and implementation One observation shows the control is in place on that day only

(g) Operating effectiveness A general IT control tested for the whole period

(h) Operating effectiveness Follow-up of exceptions at different times during the year

Question 2 - Keelson's controls (suggested)

Control Test of controls

(1) Proof of delivery before

invoicing (automated)

Inspect the system setting and try the rule with one job that has a proof of delivery and

one that hasn't (in a test copy); test the general IT controls over changes and access,

so one test covers the year

(2) Monthly shipping line

reconciliations

Enquire; inspect a sample of months for preparation, sign-off and timely follow-up of

reconciling items; reperform one or two reconciliations in full

(3) Two staff at the cargo cage Enquire; observe on several unannounced visits; inspect any access log or camera

record of who entered

(4) Approval of credit notes

above $2,000

Inspect approvals for a sample chosen across the year, checking the approval came

before issue and was by the right person; or use data analytics to test every credit

note above $2,000 for an approval dated before issue

Question 3 - Keelson's payroll (sample answer)

Two systems, two sets of evidence. Reliance for the whole year needs evidence about the old system (July to

December), the new one (January to June) and the migration between them.

Old system. Payroll isn't a significant risk and the controls didn't change before the switch, so last year's evidence

may be used once enquiry plus observation or inspection confirms nothing changed, provided each control is

retested at least every third audit and some controls are tested this year.

Migration. Test the conversion controls: reconciliations of employee numbers, pay rates and leave balances

between the systems, reviewed and signed off. If they are weak, test the migrated data directly.

New system. No earlier evidence exists, so test in the current period: obtain the cloud provider's assurance report

on its controls over the period (check dates and exceptions), and test Keelson's own controls, such as approving

new employees and pay rate changes and reviewing each pay run.

The alternative: rely on the new system only and take a substantive approach for July to December, for example

an analytical procedure built from headcount and pay rates.

ADVANCED AUDIT AND ASSURANCE | M3 | 3.2.1 | WORKED ANSWERS

6