lOMoARcPSD|8624398 Ch08 sm moroney 3e - Answer for Chapter 8 of Auditing: A practical approach Auditing (Victoria University) StuDocu is not sponsored or endorsed by any college or university Downloaded by Parteek Singh (Parteek.singh30@gmail.com) lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach rd 3 edition by Moroney, Campbell and Hamilton Prepared by Jane Hamilton © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e Chapter 8: Execution of the audit – testing of controls Review questions 8.11 What is the difference between entity-level controls and transaction-level controls? Entity level controls are the collection of the internal control components of control environment, entity’s risk assessment process, the information system, control activities, and control monitoring (ASA 315/ISA315). The entity level controls exist at an organisational or entity level rather than at a more detailed transaction level. Transaction level controls operate at the transaction level. For example, there are controls; such as the authorisation required for sales above a certain amount, and reconciling and accounting for every cheque issued through a bank reconciliation statement. Transaction level controls operate at a much lower level than entity controls and have the best chance of preventing things going wrong with transactions, or detecting when they have gone wrong. 8.12 Explain the purpose of (a) prevent controls and (b) detect controls. Why would it be important for an entity to have both types of controls? Controls have two main objectives: to prevent or detect misstatements in the financial report, or to support the automated parts of the business in the functioning of the controls in place. The prevent controls are designed to stop fraud or errors from occurring. The prevent controls are applied to each transaction with the objective that all transactions that are entered into the client’s accounting system do not contain any errors. The detect controls are designed to detect fraud or errors that have occurred. As such, they are applied after transactions have been processed with the objective that any transactions that were entered into the client’s accounting system with error are detected so that they can be rectified. Ideally, the prevent controls would stop all fraud and error, so that detect controls are not necessary. However, because prevent controls do not work at 100% effectiveness, the detect controls are necessary. Prevent controls are normally expected to be less than 100% effective because of factors such as: Management override of the controls. Failure to apply the prevent controls due to staff tiredness, busyness, or malfunctioning hardware or software. Also, the prevent controls may not leave an auditable trail when they are applied. This means that it is not always easy to verify if the prevent control has worked. For example, there may be a signature of the person authorising the transaction, but it is not clear if the transaction was carefully checked before it was authorised. Also, the prevent control may not leave any evidence if the transaction is not processed © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.2 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls (because it was not correct). An effective detect control will provide additional assurance that the transaction was checked because it shows the errors detected. The system should not rely solely on detect controls. Prevent controls are necessary to support the detect controls because the detect controls are unlikely to be sensitive enough to detect all errors after they enter the records. 8.13 The form completed by casual employees to claim overtime requires a signature from the supervisor before payroll will process the claim. Is this a prevent or detect control? Explain. In this case, requiring a signature on a form means that the form must be authorised by that person before it can be processed. The absence of a signature is supposed to prevent an incorrect, or unauthorised, form being processed. This means that it is a prevent control. 8.14 A junior employee must prepare a bank reconciliation and submit it to the manager. Is this a prevent or detect control? Explain. Bank reconciliations are classified as detect controls because their purpose is to detect errors that have been made. They operate after the transactions have been created and processed, so cannot be classified as ‘prevent controls’. A bank reconciliation will detect delays in depositing receipts, incorrect recording of the amount of a cheque etc., and by detecting the error, allowing it to be corrected. 8.15 What does “ITGC” stand for? Explain their purpose. ITGC means Information Technology General Controls. The three types of ITGCs are: 1. program change controls – only appropriately authorised, tested and approved changes are made to applications, interfaces, databases and operating systems. 2. logical access controls – only authorised personnel have access to data and applications and can perform only authorised tasks and functions. 3. other ITGCs, including regular and timely back-ups of data, following up and resolving program faults and errors in a timely manner, following up any deviations from scheduled processing on a timely basis, and planning upgrades to programs and applications on a timely basis. These controls are ‘general’ because they do not relate to a specific program, or type of transaction process. They apply generally to the IT system. The purpose of these controls is to support the functioning of the IT system. They are prevent and detect controls, and provide evidence supporting the auditor’s reliance on the electronic audit evidence. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.3 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e 8.16 What is the difference between observation and inspection of physical evidence? Observation means the auditor observes the control being performed. Inspection of physical evidence means that the auditor inspects the documents for evidence that the control was performed. Inspection of physical evidence is normally more reliable than observations because the auditor gathers evidence about the performance of the controls in detail. However, the evidence is not complete because, for example, finding a signature on a document does not prove that the person signing read and understood the contents of the document. Observation is less reliable than inspection of physical evidence because the people performing the control may be on their ‘best behaviour’ when they are observed. The auditor does not know if they always perform the control well. The auditor could gather more evidence from the documents on multiple dates. 8.17 Does an auditor have to test every control? Explain. An auditor does not have to test every control because some controls are redundant or control errors that are not likely to result in material misstatements of the financial report. The auditor would select the controls that will provide the most efficient and effective audit evidence (that the controls are working). The auditor selects the controls that they believe are critical to their opinion. Factors affecting the auditor’s decision about which controls to test include: type of control frequency of the controls level of assurance that the auditor wants to gain. Generally, the auditor tests controls that address the WCGWs the most effectively with the least amount of testing. If one control addresses multiple WCGWs, then it would be most likely to be selected for testing. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.4 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls 8.18 What factors do auditors consider when deciding how much control testing to do? The factors affecting the auditor’s decision about how much control testing to do include: the frequency of the control’s operation the level of assurance required (i.e. how much the auditor will rely on the control to reduce substantive testing) the persuasiveness of the evidence gained from testing the control the need to be sure that the control operated throughout the period the existence of a combination of controls address the WCGW the relative importance of the WCGW being addressed the likelihood that the control operated as intended (i.e. how competent are the staff, the quality of the control environment, changes in the accounting system, unexplained changes in related account balances, the auditor’s prior period experience with the client). 8.19 What is the premise underlying the use of benchmarking? Why is it helpful to the auditor? Benchmarking is the audit testing strategy that allows the auditor to carry forward the benefit of certain application controls testing into future periods, such as from an interim date to the rest of the year, or to future years. The premise underlying the use of benchmarking is the idea that a computer will continue to perform any given procedure in exactly the same way until such time as the program (or application) is changed. This means that if the auditor can show that there has been no change in the program or the application, the auditor can continue to rely on the results of testing the program or application in previous periods. The auditor is likely to be more successful in showing the absence of change if the overall control environment is strong, the length of time between the original test and the audit test period is shorter, and the specific program or application is more defined and likely to be stable. In addition, the decision to use benchmarking is more likely if the results of other tests are consistent and the consequences of failing to detect changes because of the reliance on benchmarking are less severe. Benchmarking is helpful to the auditor because the auditor’s testing is reduced. Instead of re-testing the program or application, the auditor needs to test only the lack of changes to the program or application. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.5 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e 8.20 Discuss the concepts of nature, timing and extent as they relate to controls testing. Nature refers to the type of test (enquiry, observation, inspection of physical evidence, re-performance). As discussed in review question 8.16, the types of tests vary in the reliability of the evidence produced. Timing refers to the date of testing (i.e. interim vs. year-end). Interim testing is common for controls testing because it provides evidence about control risk which influences the nature, timing and extent of substantive testing to be conducted at or near year-end. Further control testing is conducted during the remainder of the year to provide evidence that the controls continue to operate effectively throughout the financial period. Extent refers to the number of items tested (i.e. size of the sample). A larger sample provides more reliable evidence about the strength of controls, and would be used if the auditor wishes to gain a higher level of assurance from the controls testing. 8.21 What is the relationship between the results of tests of controls and substantive testing? If an auditor assesses control risk as being less than high, the auditor must gather evidence from controls testing to support their assessment. If the evidence shows that control risk is less than high, the auditor can tolerate a higher level of detection risk. Higher detection risk means that the auditor can adjust the nature, timing, and extent of substantive testing such that less evidence is required from these tests. Therefore, the evidence gathered from tests of controls can provide a reasonable level of assurance that there are no material misstatements in the financial report. In this case, the auditor will perform only limited substantive testing (perhaps relying on analytical review). If the auditor is able to obtain only limited assurance from tests of controls, the auditor will need to perform more substantive testing. If the auditor is unable to gain any assurance from controls testing, the auditor will perform considerable substantive testing. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.6 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls 8.22 Explain the process of documenting the auditor’s conclusions. What must be documented? The auditor would document the results of the control testing, including the purpose of the tests and the deviations found. The auditor must document the action taken, if any, to resolve the exceptions or issues that arose during the controls testing. For example, there could be a compensating control which was working effectively, so that the auditor did not need to do further testing. Alternatively, the auditor would document the additional work done to resolve the issue, or the adjustment to substantive tests to take into account the higher than expected control risk. The tests are documented in detail: the actual control being tested the purpose of the test the work performed (e.g. the items selected for testing) the results of testing each item whether the test results supported overall purpose of the test details on audit personnel performing the test, date of the tests. The documents should allow another auditor to review the working paper, re-perform the steps and reach the same conclusion as the original auditor. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.7 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e Professional application questions 8.23 Performance indicators The audit assistant has been assigned to review performance indicators in the procurement department of Kentucky Kapers, a manufacturing audit client. The assistant reports to you that he has obtained a copy of reports used by the supervisor in the procurement department to assess the performance of the purchasing team. The reports include details of orders processed per day, backlog of orders and time taken to clear the backlog (on a weekly basis), and overtime requests by staff in the department. The assistant also reports that his discussions with the supervisor reveal that the performance indicators are used to manage the department, but are not used for follow-up on unexpected results in the financial reporting system. Required Are the performance indicators in the report useful as audit evidence for the financial report audit? Explain. The performance indicators appear to be useful to the client. That is, the supervisor of the procurement department uses the performance indicators in the reports to assess the performance of the purchasing team. This means that the client has faith in the quality of the data. As such, the auditor has more confidence in the data. However, the supervisor also reveals that the performance indicators are not used for follow-up on unexpected results in the financial reporting system. The performance indicators are based on non-financial data. Although the non-financial data are relevant to financial data (e.g. overtime requests would be related to payroll expense classified as overtime payments), the client does not appear to relate the performance indicators to the financial reporting system. This means that the relevance of the indicators to the topic of the financial report audit is lower. The auditor could conduct tests of the non-financial data to gain additional assurance about their reliability, including their relation to the financial data, before using them in the audit. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.8 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls 8.24 Controls testing results Washington Cleaning has more than 50 employees and has several contracts to clean offices in the central business district. In order to keep disruption to a minimum, the teams of cleaners do not commence work until after 6 pm each night. In the working papers documenting the control testing results the senior auditor notices that there was one instance of a part-time staff member for Washington Cleaning being paid an incorrect hourly rate. Required Explain why the result shows a control exception (deviation). The audit evidence is that there is one instance of a part-time staff member being paid an incorrect hourly rate. The fact that the payment was incorrect is evidence that the procedures for calculating and checking the payments have failed in some way. The client’s controls for preventing the error should have stopped the incorrect payment being made. An example of such a control would be a step in the system that would not have allowed the payroll clerk to select the incorrect rate when calculating the payment. The detecting controls have also failed. For example, it could be the payroll manager’s job to review and approve the payments for the month. The incorrect pay is evidence of a control exception or deviation because if the controls had been designed and executed correctly the incorrect pay would not have occurred, or would have been detected and corrected before the auditor found it. 8.25 IT controls – password The client company assigns each new employee a user profile and password for the computer system. The first time the new employee logs onto a company desktop computer, they are automatically forced to change their password. Passwords must be changed every 30 days. Required Explain what type of control the above information describes. Discuss its strengths and weaknesses. The control described is an IT general control. The login and password system is a logical access control preventing unauthorized personnel from having access to the computer system. The login details would normally be linked to a level of access, for example a senior manager would have greater access than a junior staff member. The login details would also be linked to specific functions within the computer system. For example, a staff member in sales would not have access to personnel records even if the person was a senior member of the sales team. Login and password controls prevent staff from accessing certain areas and introducing errors, so is a prevent control. It is a strong system to force the staff member to change the password on the first login because this reduces the risk that others can know the password and use it, © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.9 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e because the staff member chooses their own password. Changing the password every 30 days is also an advantage because it reduces the risk that others will get to know the password and be able to use it because they would have to know the new password. There is no information about whether the staff member can reuse old passwords, or whether the password must satisfy certain criteria (such as using a mix of numbers or letters) to make it a stronger password. A weakness with passwords is that some staff do not keep them secret (for example, they might share the password with others, leave it on display, use obvious passwords such as the name of their favourite sport team, use the same password for different applications, etc.). 8.26 IT controls - suppliers Within the client’s IT system, supplier information is contained in a supplier master file (SMF). Each supplier has a unique supplier code. If the purchasing clerk attempts to place an order from a supplier not in the SMF, the order cannot be processed. To avoid delays in processing orders, the purchasing clerk has access to the supervisor’s password, which allows the clerk to allocate a supplier code to new suppliers. Required Explain what type of control the above information describes. Discuss its strengths and weaknesses. The control is a transaction control. Specifically it is an IT application control. The purpose of the control is to prevent errors because the order cannot enter the system if the correct supplier code is not used. This prevents a clerk from either making an error with the code itself (such as recording 865 as 8655) or using a supplier that has not been authorised for use. It is not clear whether the supplier code is linked to the items being purchased. For example, if the clerk uses an incorrect but valid supplier code, will the system accept the purchase order? If item ABC is only to be ordered from supplier 865, and not from supplier 864, will the order be accepted if the item ABC is being ordered from supplier 864 (which is a valid supplier code)? If the suppliers are not linked to the items that may be ordered from them, there is the potential for some incorrect orders to be accepted into the system. Another potential weakness of the system is that there might be a delay between identifying a suitable supplier and getting the supplier approved and an approved supplier number issued and accepted into the system. It is probably for this reason that the clerk has obtained the password that allows the clerk to allocate a code to a new supplier. It is a control failure to allow passwords to be shared in this way. It means that the system will show that the new code was properly authorised, but it has not been because the supervisor has not necessarily seen the information and made a decision about using that supplier. A stronger control would require additional © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.10 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls evidence that the supervisor has agreed to add the new supplier (such as a document trail with signatures or additional authorisations). 8.27 Internal controls from prior year. The junior auditor on the engagement has suggested that, since there were no exceptions detected in previous years, no work on internal controls is required because last year’s evidence will be sufficient. The senior auditor accepts the suggestion because it is a good example of benchmarking. Required Explain why the junior auditor’s suggestion is not appropriate and outline what work is required. There are several reasons why using the work done in previous years would not be appropriate. The most likely are that conditions at the client have changed. For example, if the client has grown significantly from previous years the controls may no longer be suitable for the larger organisation. Other changes to the management or systems at the client could render the control system less effective than in previous years. Several controls could work together to create an effective control system, but one or more of the individual controls could have changed, creating a different level of overall control over the transactions. The auditor might have taken a substantive approach to the audit last year, and not placed much reliance on the control system. If the auditor wanted to adopt the lower assessed level of control strategy this year, there would be more testing of controls required than done in previous years. If the auditor wanted to adopt a mainly substantive approach this year, the auditor must still gain an understanding of the current system of controls. In all cases, the auditor must consider what work is to be done on the controls this year, regardless of the level of work done in previous years. The suggestion is not a good example of benchmarking because there is no assurance that the application has not been changed or modified since the last test of the application control. The auditor would need to gather evidence to support any carry forward of reliance on the control. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.11 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e 8.28 Prevent controls Nebraska Industries manufactures and wholesales small tools. It sells the tools to a large group of regular customers and makes most sales by telephone to this group. Additionally, it receives orders online by its sales team who sign up new customers within the sales area. In the past, Nebraska Industries has had trouble with customers who do not pay their accounts on time. Despite instructing the sales team not to make sales to customers before their creditworthiness has been assessed, sales are still being made to new customers before their limits have been set and to existing customers beyond their credit limit. Also, the economic recession has started to affect its customers, and Nebraska’s management is concerned about the possibility of increasing bad debts. Required (a) What sort of prevent control could be used to deal with the problems faced by Nebraska Industries? Explain how the control would work. (b) Assume the prevent control is implemented, and during this year there have been no sales to customers that have taken any customer beyond its credit limit. What are two possible explanations for this that the auditor must consider? (c) If an auditor finds two sales transactions during the year that are in excess of a customer’s credit limit at the time of the sale, what conclusion would the auditor draw from this evidence? What other evidence could the auditor consider before concluding that the prevent control has failed. (a) Prevent controls would be designed to stop sales being made to non-creditworthy customers. For example, the software would not allow a sale to be made until the credit manager has approved the sale on credit, or the software could require a credit check authorisation number to be included in the sale transaction. The system could require all new customers to be approved before a debtor account can be opened, and the account has to be open before a sale can be processed to that customer. The system would prevent a sale being made if the sale took the account balance beyond the approved credit limit, unless authorised by the credit manager. (b) The auditor observes that no credit sale has been processed which takes a customer over its credit limit. The two possible explanations are: (1) the prevent control is working effectively, (2) no customer has tried to purchase items which take it over its credit limit. In the second case, there is no evidence that the prevent control is working or not working, because it was not triggered. (c) The transaction could have been authorised by the credit manager (or other senior manager). The authorisation could be because the client has security for the debt. However, the authorisation could be inappropriate and be a case of management override of the control. That is, the manager has overridden the prevent control to make a sale for reasons such as receiving a kick-back from the customer, disregard for company policy against such sales, an effort to reach sales targets in the department etc. The auditor would consider whether there was evidence of higher level authorisation of the transactions, such as reading board minutes, reading correspondence or memos between the managers, reading the customer file for © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.12 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls evidence of security for the debt, making enquiries of the relevant sales managers. The auditor would also consider if other similar transactions (same sales manager, same client, same product etc.) are being processed correctly, or if there is evidence of other sales in excess of credit limits being prevented. 8.29 Testing bank reconciliation controls You are testing the controls over bank accounts for your audit client, Orleans Ltd. You note that the responsibility for bank reconciliations has changed due to a corporate reorganisation halfway through the current financial year. Both the staff member performing the bank reconciliations and the supervisor have changed. You are able to talk to only the current staff member and supervisor because the other staff took voluntary redundancies and left the client’s employment six months ago. Required (a) What techniques are available to you to gather evidence about the bank reconciliations? Explain how you would use each technique and comment on the quality of the evidence obtained from each. (b) When you ask the employees responsible for bank reconciliations about how they perform the reconciliations there is a possibility that they will not tell the whole truth about their performance of the reconciliations. Given this, will you bother to ask them? Explain. (c) Explain the impact of the staff changes on your controls testing program. (a) The most reliable evidence would be gathered by re-performance of a sample of bank reconciliations. The auditor could judge if all items were dealt with appropriately. In addition, completed bank reconciliations can be inspected for evidence of identification of errors and follow-up. The least reliable evidence would be obtained from observing client staff complete a bank reconciliation or by making enquiries of the client staff (because these procedures would not provide reliable evidence about the bank reconciliation performance at earlier periods when different staff were involved). (b) The auditor would approach discussions with client staff with professional scepticism. This means that the auditor does not assume the client’s staff are lying, but the auditor has a questioning mind, being alert to conditions which may indicate possible errors or fraud. The auditor makes a critical assessment of any statements by the staff. For example, do the statements make sense given what the auditor knows about the client and in the context of other evidence gathered? What other evidence could be obtained to support the statements? How much would the auditor expect the staff to know about bank reconciliations performed by other staff at other periods? The auditor cannot assume that staff would lie and not ask them about the audit, but the auditor cannot rely on staff statements alone. (c) The staff changes impact on the controls testing program because the auditor would require evidence that the performance of bank reconciliations was similar in different periods. The auditor would be careful to obtain evidence about the © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.13 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e performance of the controls from each period. If there was any evidence that performance was poor during any sub-period, the auditor would seek to obtain additional evidence about control performance, or increase the substantive testing. In this case there is six month period since the staff left, during this period many changes could have occurred. 8.30 Inventory program controls Denver Drapers supplies custom-fitted curtains and blinds to retail customers. It has recently expanded to offer a wide variety of home decorating products through its six stores across the state. After some initial problems with stock control it installed a new automated inventory system in April this year. The system replaced another automated system that had been modified so often over the years that the auditor had advised Denver’s management that they did not regard it as reliable. That is, the auditor was unable to rely on the old system sufficiently to assess control risk for inventory as anything less than high. Required (a) Explain the normal process an auditor would expect to find in the client’s systems governing changes to computer programs. Why is an auditor concerned about program changes? (b) Denver Drapers’ financial year-end is 31 December. Does the auditor need to obtain evidence about the performance of the inventory control system from every month in the year or from a sample of months? Explain. (c) If the auditor conducts tests of the inventory controls at an interim date, is it appropriate to conclude that the controls also relate to the end of period date? Why? (a) The auditor would expect to find client documentation about the changes to computer programs. If the client made major changes to the computer programs (e.g. install a new system), the matter could be discussed at the board level. Other changes would be authorised by senior management, as appropriate. In all cases, there would be some level of authorisation of the changes, including complete documentation of the changes and their effects on the client’s reporting and operations. In addition to documenting the changes to the programs, the auditor would expect to find a log of the changes (including the staff involved, the changes, test data, copies of programs etc.). The auditor would expect to find some type of segregation of duties. For example, those making the computer changes would not also be those staff involved in maintaining accounting records. Auditors are concerned about program changes because they potentially introduce errors to programs. In addition, the changes could mean that the auditor is unable to rely on the results of any previous testing by the auditor of the computer system in the audit. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.14 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls (b) The financial reports for the year include the effects of sales and purchase transactions from the entire year. If the computer program is changed at any point during the year, the auditor must consider whether controls should be tested separately for the periods before and after the change. Evidence is not necessarily required from every month of the year, but there should be evidence from before and after the new system was installed in April. Inventory balances as at 31 December can be tested through the end of year stock-take procedures. (c) The results of the interim testing to the end of year inventory balance is appropriate if the testing was performed during the period after the installation of the new stock control system. However, as noted above, the total purchase and sales transactions also include pre-April transactions which were processed through the old system. The testing of these accounts should include evidence from pre-April dates. Questions 8.31 and 8.32 are based on the following case. MaxSecurity Limited (MaxSecurity) has been an audit client of Smith & Associates (S&A) for the past 15 years. MaxSecurity is based in Wollongong, where it manufactures high-tech armour-plated personnel carriers. MaxSecurity often has to go through a competitive market tender process to win large government contracts. Its main product, the small but powerful Terrain Master, is highly specialised and MaxSecurity only does business with nations that have a recognised, democratically elected government. MaxSecurity maintains a highly secure environment, given the sensitive and confidential nature of its vehicle designs and its clients. In September 2016, MaxSecurity installed an off-the-shelf costing system to support the highly sophisticated and cost-sensitive nature of its product designs. The new system replaced a system that had been developed in-house as the old system could no longer keep up with the complex and detailed manufacturing costing process that provides tender costings. The old system also had difficulty with the company’s broader reporting requirements. MaxSecurity’s IT department, together with the consultants from the software company, implemented the new manufacturing costing system. There were no customised modifications. Key operational staff and the internal audit team from MaxSecurity were significantly engaged in the selection, testing, training and implementation stages. The manufacturing costing system uses all of the manufacturing unit inputs to calculate and produce a database of all product costs and recommended sales prices. It also integrates with the general ledger each time there are product inventory movements such as purchases, sales, wastage and damaged stock losses. MaxSecurity’s end of financial year is 30 June. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.15 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e 8.31 Understanding types of controls In relation to the new manufacturing costing system, describe two automated application controls that MaxSecurity could be using. Automated application controls apply to the processing of individual transactions. These controls include edit checks, validations, calculations, interfaces and authorisations. For example: only authorised personnel would have access to the costing system – this would be controlled through log-on and password procedures. All transactions would have an appropriate level of authorisation, through input of an authorisation code by a senior manager (once transaction request is input, the manager’s computer would alert the manager to the transaction and request approval, then the transaction would be released for processing). Inventory movement transactions entered into the system would require input of an inventory part number which is checked against a master file before the transaction is allowed to proceed. 8.32 Assessing control testing results Discuss the implications of finding evidence that the controls identified in question 8.31 are (a) effective, (b) not effective. Evidence that the controls are effective increases the auditor’s confidence in the controls and justifies the lower assessed level of control risk approach. Evidence that the controls are not effective means that the auditor needs to identify and successfully test alternative controls which prevent or detect the WCGWs, or increase the reliance on substantive testing. Specifically, in respect of suggested controls in 8.31: Non-authorised personnel access – a failure of this control would suggest that nonauthorised personnel are able to process transactions. This creates doubt about the validity of all transactions and would be a major control failure. Authorisation – transactions not authorised before entry, creating the possibility that unauthorised transactions have been processed. This is also a major control failure. Inventory part numbers checked against master file – failure of this control means that part numbers could be incorrect. Inventory movement transactions processed with incorrect part numbers could lead to incorrect stock balances in the accounting records. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.16 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls 8.33 Control testing results and documentation Amy Adams, the audit senior, is reviewing the working papers written by the audit assistant on the audit of Virginia Creepers, a garden nursery and retailer of garden accessories. Amy reads the following description of the results of testing of inventory controls written by the audit assistant: Stock controller advises that no changes have been made to the inventory programs during the current financial year. There are no documents on file authorising program changes so I conclude the stock controller’s statement is true. Stock controller also advises that management did not attempt to override any controls relating to inventory. There are no memoranda or emails from management on file instructing the stock controller to go against procedures, so I conclude the stock controller’s statement is true. The audit assistant concludes that the inventory controls have not been changed or overridden during the financial year, so the results of the interim testing of controls can be relied upon. Required (a) Examine the statements by the audit assistant. What deficiencies in the testing can you identify? (b) If the results of testing one control show that the control is not effective, does the auditor have to increase substantive testing? What other options are available to the auditor? (c) Explain why it is important for the working papers to be completed with sufficient detail for another auditor to understand what has been done. Make a list of the parties who might review the documents. (a) The audit assistant is incorrectly interpreting an absence of evidence of an event as evidence of the absence of the event. There is no evidence of any program changes or overrides, but only limited testing has been done. The auditors need to gather direct evidence that there were no changes or overrides. The auditors will need to conduct further tests to verify the statements. (b) Other options available to the auditor include testing other controls that could perform the same function, that is, what other controls exist to prevent or detect the WCGW? Further, would failure of the control being tested necessarily lead to a potential material misstatement in the financial report? For example, is the control aimed at behaviour which does not impact on the financial reports (e.g. making sure that inventory is sorted correctly by colour on the shelves if not relevant to the financial report)? If the auditor concludes that the only controls relevant to preventing or detecting an error that is likely to result in a material misstatement in the financial report, the auditor would increase substantive testing. (c) Working papers (whether electronic or paper based) are used to provide instructions to audit staff and to record results of testing. As the working papers are completed, more senior staff review the results of the tests in order to assess the adequacy of the evidence. The audit opinion must be based on sufficient, appropriate © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.17 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e evidence. Ultimately, the audit partner must sign off on an audit report using the results recorded in the working papers as justification. Within the audit firm, other partners are often used to review the decisions reached to ensure quality standards are maintained. These other partners are not involved in the audit and must rely on the documentation to understand the nature, timing and extent of all testing, and the results obtained. The papers must be completed with sufficient detail to allow the review partners to reach a decision. Audit partners from other firms could also review the working papers to provide more independent testing of the audit quality as part of peer review programs within the auditing profession. Regulators, such as ASIC, will also review some audit working papers to monitor audit quality and write reports on the overall level of audit quality in the economy. Finally, the working papers could be used as evidence in legal disputes between auditors and their clients or other interested parties. 8.34 Technique for testing computerised controls The sales transactions at Colorado Park, a new audit client, are handled by a software application that is not supported by very detailed documentation. The audit partner requests the team to re-perform some controls to ensure that the software application controls are working as described by Colorado Park’s management. The audit software used by the audit team can access the data on the client’s files, allowing the use of standard audit procedures. Required (a) Give examples of controls over sales transactions that should be part of the software application. (b) How could the audit team test the controls in the client’s sales software application? (a) Sales transaction control examples: Rejection of transactions above a specific limit (to prevent incorrect data for sales amount). Inclusion of inventory item ID in sales transaction so that sales are automatically priced. Include customer number in sales transaction so that sales to customers who have exceeded their credit limit are rejected. (b) Possible tests include: Test data – the auditor prepares some data to process through the client’s computer system. The data would have valid and invalid types of transactions. The auditor would try to prepare enough invalid transactions to mimic all types of errors (e.g. if the client does not sell items with values greater than $1000, the auditor could prepare a transaction with $1,000,000 as the value to test if the client’s system will reject the transaction). Process the client’s actual transactions through another software package controlled by the auditor. The auditor would test if the output from the client’s software is the same as the output from the auditor’s software. This would © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.18 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls 8.35 require the auditor to have software that would be similar enough to the client’s systems. Interrogation software – the auditor would have special software to interrogate the client’s systems to request reports of transactions with certain parameters. The audit software could also search for evidence of changes, which could be unauthorised, made to the client’s software. The audit software could also search for certain likely problems with client software. Payroll controls The audit senior on the audit of Frankel Factors is preparing the audit plan for the year ended 30 June 2017. The following notes relate to the payroll application system that went live on 1 January 2017. 1. The new payroll application is more complex than the old system, but its reporting function provides more detail. For example, the new application calculates leave, superannuation, payroll tax and work cover expenses, as well as the corresponding accruals. 2. Due to the brief time available to implement the new system, the previous application ceased operation on 31 December 2016 and the new application went live on 1 January 2017 without running parallel with the previous application. Staff training and testing of the new application was limited. 3. Access to the master files is restricted to the payroll supervisor and her deputy. Access to transaction files is restricted to payroll staff who are responsible for the processing of fortnightly and monthly pay. Prior to the introduction of the new payroll application system, the payroll master and transaction files were kept in a separate database from the general ledger application. At the end of each month, the IT staff imported transaction data from the database into the general ledger. Management decided to upgrade the existing accounting system due to the frequent problems encountered by IT staff when importing data into the general ledger. Required (a) Based on the information above, explain two relevant concerns you may have about the payroll application’s integration with the general ledger application. (b) Describe one IT application control that would ensure the accuracy of the salaries and wages expenses transaction. (c) Describe one IT application control that would ensure the occurrence of the salaries and wages expenses transaction. (d) Design and describe in detail appropriate tests of control that you would use to satisfy yourself about the effectiveness of these internal controls. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.19 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e (a) The new system provides expenses and accruals for the accounting system, and thus any errors in its calculations can have a direct effect on the accounts. No testing prior to the new system going ‘live’. The auditor cannot review evidence of the system’s ability to operate in the same way as the old system (i.e. would the same data be generated under both systems). Limited staff training increases the risk that there will be errors in either the system and its financial data or the way it is interpreted and used by the client’s staff. (b) Accuracy is affected by the raw data and the calculations. Controls could be over the entry of data (e.g. hours worked, approved pay rates linked to the position classification, limits on total amounts calculated to prevent 10 hours being entered as 100 hours because the total would be over the approved limit), and over the calculations (e.g. reasonableness tests such as overall limits on total payments). (c) Occurrence relates to whether the payment is for hours actually worked, there would need to be a control that did not allow payment to be made until a supervisor had authorised the hours worked; controls to prevent duplicate payments (i.e. same worker paid twice for hours worked). There should be a reconciliation between payments made and recorded in the general ledger with records of hours worked via the payroll report. (d) Tests of controls could include use of dummy data (feed in new data to determine if the controls prevented the payment if it was not authorised, feed in deliberately incorrect data, such as duplicate payments); gathering documentary evidence of approvals of hours worked; reconciling hours worked for a pay period with total payments made that period; seeking documentary evidence for supervisor reviews of salary payments etc. An example of a control test: Client name: xxxxx Year end: 31 December 2013. Working paper: Payroll control testing Purpose of test: The purpose of this test is to verify that the payroll reconciliation control for hours worked with overall payments is adequately designed and implemented for the 12 months ending 31 December 2013. Work to be performed: Select two payroll reconciliations from different months, tie the total payments as per the general ledger to the payroll report, and the payments on the payroll report with the approved hours worked, tie the payments listed on the payroll report to the bank statement, and vouch all differences between the payroll report and the approved hours worked, and payroll report with general ledger and bank statement greater than 10% to supporting documentation to ensure valid reconciling items and that the reconciliation has been performed correctly. Ensure the reconciliation has been prepared and reviewed on a timely basis. Findings/results of testing: Conclusion: Prepared by: P1.1 Reviewed by: © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) Index: 8.20 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls Questions 8.36 and 8.37 are based on the following case. Chan & Partners Chartered Accountants is a successful mid-tier accounting firm with a large range of clients across Australia. During the 2017 year, Chan and Partners gained a new client, Medical Services Holdings Group (MSHG), which owns 100 per cent of the following entities: Shady Oaks Hospital, a private hospital group Gardens Nursing Home Pty Ltd, a private nursing home Total Cancer Specialists Limited (TCSL), a private oncology clinic that specialises in the treatment of cancer. Year-end for all MSHG entities is 30 June. You are an audit senior on the Shady Oaks Hospital engagement. Your initial review of the business has highlighted the following significant risks. 1. Payroll expense. Shady Oaks employs, in addition to its full-time staff, a significant number of casual nursing, cleaning and administrative staff. Overtime is often worked on weekends and night shifts due to a shortage of staff. Payment at overtime rates for standard weekend and night shifts has been a common occurrence. 2. Accounts payable. Shady Oaks also has a large number of suppliers for various medical supplies and drugs. Paying the supplier twice for the same purchase has been a continuing problem. 8.36 Prevent and detect controls For each of the accounts for Shady Oaks (1 and 2 above) identified to be a significant risk: (a) determine the key assertion at risk (b) describe a practical prevent internal control that would directly address the risk (c) describe a practical detect internal control that Shady Oaks could implement in relation to the risk. You may wish to present your answer in the form of a table as follows. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.21 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e In addition your business risk assessment procedures indicate there is a risk that payments to suppliers are made prior to goods being received. As part of your evaluation of the potential mitigating internal controls you note that accounting staff perform the following procedures. 1. A pre-numbered cheque requisition is prepared for all payments. 2. The details on the supplier’s invoice are matched to the appropriate receiving report. 3. The details on the supplier’s invoice and receiving report are matched to an authorised purchase order. 4. The cheque requisition is stapled to the authorised purchase order, receiving report and supplier’s invoice and forwarded to the appropriate senior staff member for review and authorisation. 5. The authorised cheque requisition, together with the supporting documents, is passed to accounts payable for payment. Account at risk a. Assertion at risk A. Payroll expense: overpayment of overtime Occurrence, accuracy B. Accounts payable: payments made twice to the same supplier occurrence b. Preventative internal control Use different codes for standard shifts and overtime hours; require special authorisation of overtime payments Require supplier and invoice code to be input at time of processing payment – system to reject duplicates; Cancel documents used to support payment to prevent reuse © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) c. Detective internal control Review of overtime payment reports Reconciliation of supplier accounts each month, detect debit balances or accounts with more payments than invoices 8.22 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls 8.37 Prevent controls (a) Identify the key assertion at risk for payables in relation to payments made prior to receipt of goods. (b) For the control procedures (1) to (5) above for payables: (i) Identify the key preventative internal control that directly addresses the risk of payments being made by Shady Oaks to its suppliers before the goods are received. (ii) Outline how your choice of the internal control in (i) will prevent payment to suppliers prior to receipt of goods. (iii) Design and describe in detail an appropriate test of control that you would use to satisfy yourself about the effectiveness of this internal control. (a) Payment to suppliers before goods are received creates the risk that the payment is for goods that may never be received, or not received in the relevant period at the price quoted. The assertions at risk are the occurrence of the payment of payables. The cheque has been drawn against the bank account, but the payment is not for a liability owing for goods purchased. (b) Requiring a receiving report before payment (with appropriately verified details of date, amount, unit price, total price and supplier) mitigates the risk of payment before receipt of goods. The receiving department will not prepare the receiving report until the goods are received. The senior staff member will review the package of documents for evidence of receipt, thus ensuring that the receiving report is included, and it matches the other documents. (c) I would review authorised packages of documents for evidence of the existence of the receiving report and verify that the details on the receiving report match the other documents (i.e. the number of goods received is the same as the number of goods on the supplier’s invoice and purchase order). © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.23 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e Case study – Cloud 9 Answer the following questions based on the information presented for Cloud 9 in the appendix to this text and the current and earlier chapters. You should also consider your answers to the case study questions in earlier chapters. Effective internal controls at the transaction level are designed to prevent or detect material misstatements that could occur within the flow of transactions. In the case study assignment in chapter 6, you were required to identify potential misstatements and affected financial report assertions within the wholesales sales to cash receipts process. Required (a) Use your worksheet from the case study assignment in chapter 6 to complete this part of the assignment. In column four, include the transaction-level internal controls Cloud 9 has implemented to prevent and/or detect potential errors. (b) In designing the audit strategy, auditors should consider the effectiveness of the client’s internal control structure, thereby determining the control risk. An auditor should perform a preliminary assessment of control risk to give confidence to take a controls-based approach to the audit strategy. A controlsbased strategy is one in which the internal controls of a significant process are tested and proven to be effective and, therefore, can be relied upon to reduce the level of substantive testing needed. If internal controls are tested and proven to be operating effectively, the auditor can reduce the control risk of the related financial report assertion. This method of testing and proving controls can reduce the substantive procedures to be performed or allow substantive testing to be performed prior to year-end. When designing control tests, consider whether there will be sufficient evidence that the control: operated how it was understood to operate was applied throughout the period of intended reliance was applied on a timely basis encompassed all applicable transactions was based on reliable information resulted in timely correction of any errors that were identified. Based on the preliminary assessment of Cloud 9’s control environment obtained in earlier procedures, the audit team has decided to test controls over the sales to cash receipts process. It is expected that there will be no deficiencies in the transaction-level internal controls. Josh has partially completed the testing for selected controls over the sales/receivables and cash receipts processes. He has asked you to complete the testing for him. All information has been provided by the client (refer to the appendix to this text). Document your findings on the workpapers Josh has started (see tables 8.4 and 8.5 below) and then conclude with your assessment on the overall effectiveness of the controls tested. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.24 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls Aim: To test selected controls over the sales and receivables process. Sample: We haphazardly selected 25 sales invoices from the entire year. Complete the following audit procedures: Match the quantities and products ordered on the invoices to the dispatch notes. If they match, mark all matching lines on both documents with the letter ‘A’. Check the dispatch notes for a signature by the customer. If a signature is present, mark the signature with a ‘B’. Check the invoice contains a passcode entered by the supervisor. If a passcode is present, mark the code with a ‘C’. Aim: To test selected controls over the cash receipts process. Sample: We haphazardly selected 25 working days from the entire year in order to test the reconciliation of daily bank receipts to trade receivables. Match the total amount of the bank receipts to the accounts receivable postings. If the amounts match, mark with a ‘D’ on both documents. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.25 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e (a) Controls: The first two columns below are taken from the solution to the Cloud 9 Assignment in chapter 6. The last column ‘Control’ is the solution to this exercise. Significant Process Sales/Accounts Receivable Process Potential Misstatements Control Credit memos are not issued or Credit memos > $10,000 are approved by recorded for returns on a timely receiving manager and finance director. All basis or at all. others are approved by receiving manager. Bar code scanners used to automatically record sales and returns. Duplicate/false sales transactions are recorded. Sales order automatically matched to dispatch note in Swift prior to shipment. Shipping supervisor enters passcode in Swift authorising each shipment. System generates draft invoice when dispatch note authorised by shipping supervisor. System automatically posts invoice to sales and AR sub-ledgers. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.26 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls Significant Process Potential Misstatements Control Sales/Accounts Receivable Process Invoice misstates the quantity of goods shipped or incorrect pricing. Draft sales invoices are agreed to dispatch notes signed by customers. Sale price taken from master price file. Sales order automatically matched to dispatch note in Swift prior to shipment. System generates draft invoice when dispatch note authorised by shipping supervisor. System automatically posts invoice to sales and AR sub-ledgers. Proper credit authorisation is not obtained for wholesaler transactions Credit limit check is automatically performed by system against customer master file Sales journal/sub-ledger is incorrectly posted or does not reconcile. System automatically posts invoice to sales and AR sub-ledgers. Unapplied cash receipts are reviewed weekly via the dummy account. Daily review of the unfilled sales order report. Sales transaction is not recorded upon shipment of goods. Draft sales invoices are agreed to dispatch notes signed by customers. Review of exception report listing shipments not yet billed. Sales order automatically matched to dispatch note in Swift prior to shipment. Signed dispatch note file checked regularly System generates draft invoice when dispatch note authorised by shipping supervisor. System automatically posts invoice to sales and AR sub-ledgers. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.27 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e Significant Process Potential Misstatements Control Sales/Accounts Receivable Process Sales transaction is recorded when Draft sales invoices are agreed to dispatch goods not shipped. notes signed by customers. Sales order automatically matched to dispatch note in Swift prior to shipment. System generates draft invoice when dispatch note authorised by shipping supervisor. System automatically posts invoice to sales and AR sub-ledgers. Cash Receipts Cash receipts are not recorded when received. Bank reconciliations are prepared and are reviewed timely. Direct banking receipts are reconciled to Accounts Receivable and reviewed/approved. Unapplied cash receipts are reviewed weekly via the dummy account. Cash receipts in foreign currencies incorrectly valued. Bank reconciliations are prepared and are reviewed timely. Cash receipts recorded differ from amounts deposited. Bank reconciliations are prepared and are reviewed timely. Direct banking receipts are reconciled to Accounts Receivable and reviewed/approved. Unapplied cash receipts are reviewed weekly via the dummy account. Cash receipts/transfers are recorded in wrong period. Bank reconciliations are prepared and are reviewed timely. Direct banking receipts are reconciled to Accounts Receivable and reviewed/approved. Unapplied cash receipts are reviewed weekly via the dummy account. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.28 lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls Significant Process Potential Misstatements Control Cash Receipts Duplicate postings of cash receipts are made to G/L Bank reconciliations are prepared and are reviewed timely. Unapplied cash receipts are reviewed weekly via the dummy account. Totals in cash receipts journal are incorrectly posted. Bank reconciliations are prepared and are reviewed timely. Direct banking receipts are reconciled to Accounts Receivable and reviewed/approved. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.29 lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e (b) Complete testing Cloud 9 Pty Limited Sales process – testing internal controls 31 December 2016 RESULTS Sales Invoice # 324874 1 2 325048 325324 3 325542 4 5 325987 326067 6 326845 7 327111 8 Date Customer Name 14/01/2016 David Jones – Bondi Junction 23/01/2016 Rin Tin Limited 7/02/2016 Rebel Sport – World Square 16/02/2016 Rebel Sport – Sunshine Coast 2/03/2016 Myer – Adelaide 10/03/2016 Dick’s Sports – Coffs Harbour 8/04/2016 Peacock Prospecting Limited 27/04/2016 Running Shop – Manly © John Wiley & Sons Australia, Ltd 2017 Sale Amount (exc GST) 645.87 Invoice Customer matches signature Dispatch present Note (B) (A) Dispatch Note # ✔ D00324874 Shipping Supervisor authorisation (C) ✔ D00325048 D00325324 ✔ ✔ D00325542 ✔ 675.28 367.96 ✔ D00325987 D00326067 ✔ 10,220.00 ✔ D00326845 ✔ 457.24 ✔ D00327111 ✔ 17,750.00 905.46 ✔ 517.32 ✔ ✔ 8.30 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) ✔ ✔ lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls For purposes of this case study, sample tests 9-19 have been removed. There were no exceptions noted in the results ✔ 20 332811 21 333410 22 334063 23 334104 24 25 13/10/2016 David Jones - Perth Rebel Sport - World 27/10/2016 Square ✔ D00332811 ✔ ✔ 723.72 ✔ D00333410 ✔ 4/11/2016 Myer – Brisbane ✔ 917.92 ✔ 752.20 ✔ D00334063 ✔ 229.48 335215 6/11/2016 Cross Country Sports Peacock Prospecting 12/12/2016 Limited, Geralton 336947 20/12/2016 Foot Locker - Pitt St 1,021.60 ✔ × ✔ D00334104 ✔ 1,192.14 ✔ D00335215 ✔ ✔ ✔ D00335947 A To complete this test, we agreed the sales invoice to the dispatch note, ensuring it was signed by the customer (B). C To complete this test, we reviewed the dispatch note noting the encrypted passcode symbol. As passcodes are not printed, our IT specialists will perform control testing around passcode entry and the generation of the dispatch note once entered. x It was noted on the dispatch note that a customer signature was not obtained. Upon discussion with the billing team, it was determined that the customer was called to verify receipt of the goods. This should have been noted on the dispatch note to prove that the goods were received and the control was performed properly. CONCLUSION With the exception noted in the testing above, we cannot conclude at this time that the control around matching the sales invoice to the dispatch note is working effectively. To be able to rely on this control, we would need to increase our sample size by another 15 (assuming no exceptions found). © John Wiley & Sons Australia, Ltd 2017 8.31 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e The control for the shipping supervisor's authorisation does appear to be working effectively. Cloud 9 Pty Limited Controls Testing - Cash Receipts Process 31 December 2016 RESULTS 1 2 3 4 5 6 7 8 Date 8/01/2016 18/01/2016 15/02/2016 27/02/2016 11/03/2016 19/03/2016 4/04/2016 22/04/2016 Total Posted to AR 12 548.45 299 587.37 17 486.82 27 456.24 15 836.08 8 012.74 48 753.91 89 687.45 Total Bank Deposit 12 548.45 299 587.37 17 486.82 27 456.24 15 836.08 8 012.74 48 753.91 89 687.45 © John Wiley & Sons Australia, Ltd 2017 Evidence of Review ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ 8.32 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) lOMoARcPSD|8624398 Chapter 8: Execution of the audit – testing of controls For purposes of this case study, sample tests 9-19 have been removed. There were no exceptions noted in the results 20 21 22 23 24 25 19/09/2016 8/10/2016 23/10/2016 12/11/2016 3/12/2016 19/12/2016 12,577.23 18,765.49 5,490.61 9,302.20 12,567.33 13,874.85 12,577.23 18,765.49 5,490.61 9,302.20 12,567.33 13,874.85 ✔ ✔ ✔ ✔ ✔ ✔ CONCLUSION Based on the results above, the control appears to be operating effectively throughout the entire period. © John Wiley & Sons Australia, Ltd 2017 8.33 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) lOMoARcPSD|8624398 Solutions manual to accompany Auditing: a practical approach 3e Research question Explain the differences between an audit of internal controls as required by section 404 of the US Sarbanes–Oxley Act 2002 and the testing of internal controls for the purposes of expressing an opinion on the financial report as mandated by ASA 315 (ISA 315). Refer to the standard and legislation in your answer. © John Wiley & Sons Australia, Ltd 2017 Downloaded by Parteek Singh (Parteek.singh30@gmail.com) 8.34