Tests of Controls: Designing Effective Control Tests for the CPA Exam

When and Why Auditors Test Controls

Tests of controls are audit procedures designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level. Under AU-C Section 330, the auditor performs tests of controls in two situations: when the auditor's risk assessment includes an expectation that controls are operating effectively (i.e., the auditor intends to rely on controls), or when substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level.

The second situation arises when an entity's transactions are initiated, authorized, recorded, processed, and reported electronically with little or no manual intervention. In highly automated environments, much of the audit evidence exists only in electronic form, making it impractical to obtain sufficient evidence through substantive procedures alone.

Designing Tests of Controls

Types of Procedures

Tests of controls typically involve one or more of the following procedures: inquiry of appropriate personnel, observation of the application of specific controls, inspection of documents and reports indicating the performance of controls, and reperformance of the application of controls by the auditor. Inquiry alone is not sufficient to test the operating effectiveness of controls. The auditor must combine inquiry with other procedures to obtain sufficient evidence.

For example, if the control being tested is management's review and approval of journal entries, the auditor might inquire about the review process, inspect journal entries for evidence of the reviewer's approval (such as initials or electronic signatures), and reperform the review on a sample of entries to determine whether the reviewer would have detected errors.

Nature of Controls and Appropriate Tests

The nature of the control influences the type of test procedure selected. Manual controls, such as physical inventory counts or manual three-way matching, require testing across multiple periods or time points because their effectiveness depends on the consistency of human performance. Automated controls, such as system-enforced edit checks or automated calculations, generally need to be tested only once if the auditor determines that the relevant IT general controls are operating effectively, because automated controls perform consistently once properly programmed.

Timing of Tests of Controls

The auditor may test controls at an interim date, but must then obtain evidence about significant changes in controls after the interim period and determine what additional evidence is needed for the remaining period. If the auditor plans to rely on controls tested in a prior audit, the auditor must test those controls at least once every third audit. Controls over significant risks must be tested in the current period.

Evaluating the Results

Deviations from Expected Controls

When the auditor identifies deviations from expected control performance, the auditor must evaluate whether the deviations indicate that the control is not operating effectively. The auditor considers the nature and cause of the deviation, whether it is an isolated occurrence or representative of a pattern, and whether it could result in a material misstatement. If the deviation rate exceeds the tolerable deviation rate, the auditor concludes that the control is not operating effectively and must revise the risk assessment and modify the nature, timing, or extent of substantive procedures accordingly.

Documentation Requirements

The auditor must document the controls tested, the procedures performed, the results of the tests, and the conclusions reached about operating effectiveness. For controls that operate on a repetitive basis, the auditor documents the sample size, the method of selection, and any deviations identified.

CPA Exam Tips for Tests of Controls

• Know that inquiry alone is never sufficient to test the operating effectiveness of a control. Expect questions that present inquiry as the only procedure and ask whether it is adequate.
• Understand the difference between testing the design of a control (does the control address the risk?) and testing the operating effectiveness of a control (was the control applied consistently over the period?).
• Automated controls that are functioning properly need to be tested only once per audit when IT general controls are effective. Manual controls require testing across the period.
• Controls over significant risks must be tested in the current audit period and cannot rely on evidence from a prior period.
• Deviations in tests of controls do not automatically mean a control deficiency exists, but they require the auditor to reassess control risk and potentially expand substantive testing.