SECTION 400:
Testing Phase:
Figure 400.1: Methodology Overview
Planning Phase:
* Understand the entity's operations: Section 220:
* Perform preliminary analytical procedures: Section 225:
* Determine planning, design, and test materiality: Section 230:
* Identify significant line items, accounts, assertions, and RSSI:
Section 235:
* Identify significant cycles, accounting applications, and financial
management systems: Section 240:
* Identify significant provisions of laws and regulations: Section 245:
* Identify relevant budget restrictions: Section 250:
* Assess risk factors: Section 260:
* Determine likelihood of effective information system controls:
Section 270:
* Identify relevant operations controls to evaluate and test: Section
275:
* Plan other audit procedures: Section 280:
* Plan locations to visit: Section 285:
Internal Control Phase:
* Understand information systems: Section 320:
* Identify control objectives: Section 330:
* Identify and understand relevant control activities: Section 340:
* Determine the nature, timing, and extent of control tests and of
tests for systems compliance with FFMIA requirements: Section 350:
* Perform nonsampling control tests and tests for systems compliance
with FFMIA requirements: Section 360:
* Assess controls on a preliminary basis: Section 370:
Testing Phase:
* Consider the nature, timing, and extent of tests: Section 420:
* Design efficient tests: Section 430:
* Perform tests and evaluate results: Section 440:
** Sampling control tests: Section 450:
** Compliance tests: Section 460:
** Substantive tests: Section 470:
*** Substantive analytical procedures: Section 475:
*** Substantive detail tests: Section 480:
Reporting Phase:
* Perform overall analytical procedures: Section 520:
* Determine adequacy of audit procedures and audit scope: Section 530:
* Evaluate misstatements: Section 540:
* Conclude other audit procedures: Section 550:
** Inquire of attorneys:
** Consider subsequent events:
** Obtain management representations:
** Consider related party transactions:
* Determine conformity with generally accepted accounting principles:
560:
* Determine compliance with GAO/PCIE Financial Audit Manual: Section
570:
* Draft reports: Section 580:
[End of figure]
410 - OVERVIEW:
.01:
During the testing phase, the auditor gathers evidence to report on the
financial statements, internal control, whether the entity's systems
are in substantial compliance with the three requirements of FFMIA, and
the entity's compliance with significant provisions of laws and
regulations. (See figure 400.1.) The following types of tests are
performed in the testing phase:
* Sampling control tests may be performed to obtain evidence about the
achievement of specific control objectives. If the auditor obtains
sufficient evidence regarding control objectives through the use of
nonsampling control tests (such as observation, inquiry, and
walkthroughs including inspection of documents), sampling control tests
are not necessary, as discussed in section 350. Further guidance on
sampling control tests begins in section 450.
* Compliance tests are performed to obtain evidence about compliance
with significant provisions of laws and regulations. Further guidance
on compliance tests is in section 460.
* Substantive tests are performed to obtain evidence that provides
reasonable assurance about whether the financial statements and related
assertions are free of material misstatement. Further guidance on
substantive tests is in section 470.
.02:
Sampling is often used in these tests. Sampling requires the exercise
of professional judgment as well as knowledge of statistical sampling
methods. The following sections provide a framework for applying
sampling to financial audit situations, but are not meant to be a
comprehensive discussion. Additional background and guidance on
sampling is provided in the Audit Guide Audit Sampling (2001
issue),[Footnote 1] published in 1999 by the American Institute of
Certified Public Accountants and in Using Statistical Sampling
published by GAO (accession number 129810). The auditor should consider
whether he or she needs to consult with the Statistician for assistance
in designing and evaluating samples. The auditor should consider the
costs and benefits in determining which type of sampling to use.
.03:
During this phase, the auditor performs the following activities for
each type of test:
* Consider the nature, timing, and extent of tests:
* Design efficient tests:
* Perform tests:
* Evaluate results:
Each of these processes is discussed below.
[End of section]
420 - CONSIDER THE NATURE, TIMING, AND EXTENT OF TESTS:
CONSIDER THE NATURE OF TESTS:
.01:
The auditor determines the testing methods that will best achieve the
audit objectives for sampling control tests, compliance tests, and
substantive tests. Testing methods generally can be classified as
either analytical procedures or detail tests. Analytical procedures
involve the comparison of the recorded test amount with the auditor's
expectation of the recorded amount and the investigation of any
significant differences between these amounts. Detail tests can be
classified in two general categories: sampling and nonsampling.
Sampling methods involve the selection of individual items from a
population with the objective of reaching a conclusion on all the items
in the population (including those not selected for testing).
Nonsampling methods involve selections to reach a conclusion only on
the items tested. Nonsampling requires the auditor to assess the risk
of misstatement in the items not tested.
.02:
The testing method selected by the auditor is a matter of the auditor's
judgment, considering the objectives of the test, the nature of the
population, the results of procedures performed during the planning and
internal control phases (including combined risk assessment and test
materiality), and possible efficiencies. For tests that involve
sampling, efficiencies can be achieved by using a common sample for
each test. These potential efficiencies are discussed further in
section 430.
CONSIDER THE TIMING OF TESTS:
.03:
As discussed in section 295 D, the auditor may choose to conduct tests
before or after the balance sheet date (interim testing) or to conduct
all tests as of the balance sheet date. Section 495 C provides guidance
on interim testing, tests of the period between the interim date and
the balance sheet date (the rollforward period), and related
documentation.
CONSIDER THE EXTENT OF TESTS:
.04:
For each type of test, the auditor determines, based on judgment, the
extent of tests to be performed. Generally, the extent of sampling
control tests is a function of the auditor's preliminary assessment of
the effectiveness of controls and the number of control deviations
expected. The extent of compliance tests is a function of the
effectiveness of compliance controls. The extent of substantive tests
is a function of combined risk and test materiality.
[End of section]
430 - DESIGN EFFICIENT TESTS:
.01:
After considering the general nature, timing, and extent of the tests
to be performed, the auditor should design specific tests. The auditor
should coordinate similar tests to maximize efficiency. For tests that
involve sampling, efficiencies can be realized by performing numerous
tests on a common sample (multipurpose testing).[Footnote 2] The
auditor generally should minimize the number of separate sampling
applications performed on the same population by attempting to
effectively achieve as many objectives as possible using the items
selected for testing.
.02:
As discussed in section 480, there are several methods of selecting
items for testing. When determining the selection method to use during
a multipurpose test, the auditor generally should use the method
considered most appropriate for substantive detail tests in the
particular situation. Use of this selection method is usually the most
efficient because sampling control and compliance tests generally can
be based on any type of sample.
.03:
For example, the auditor might use a sample of property additions to
(1) substantively test the amount of additions and (2) test financial
reporting controls over property acquisition. If a substantive test
would require 135 sample items and if the test of financial reporting
controls would require 45 sample items, the auditor should select 135
items in the sample but test controls relating only to 45. The 45 items
for control testing should be selected randomly or systematically (with
a random start) from the 135 sample items. For example, beginning from
a random start, every third item selected for substantive testing
should be tested for controls. If appropriate, the auditor may test
controls relating to all sample items to provide additional assurance
concerning controls.
[End of section]
440 - PERFORM TESTS AND EVALUATE RESULTS:
.01:
The auditor should perform the planned tests and should evaluate the
results of each type of test separately, without respect to whether the
items were chosen as part of a multipurpose test. Guidance on
performing and evaluating the results is presented for each type of
test in the following sections:
* Section 450 - Sampling control tests,
* Section 460 - Compliance tests, and
* Section 470 - Substantive tests.
.02:
Sometimes, tests performed with the expectation of obtaining certain
results give other results. When this happens, the auditor may wish to
expand a sample to test additional items. Unless planned for in
advance, this generally cannot be done simply, as discussed in
paragraphs 450.17, 460.02, and 480.28; the auditor should consult with
the Statistician in such cases.
.03:
The auditor should keep in mind that the consideration of the risk of
material misstatement due to fraud (discussed in section 260 for
planning) is a cumulative process that should be ongoing throughout the
audit. During testing, the auditor may become aware of additional fraud
risk factors or other conditions that may affect the auditor's
consideration of fraud risk factors identified during planning, such as
discrepancies in the accounting records, conflicting or missing
evidential matter, or problematic or unusual relationships between the
auditor and the entity being audited. The auditor should consider
whether fraud risk factors or other conditions identified require
additional or different audit procedures. (See section 540.):
.04:
For CFO Act agencies and components listed in OMB audit guidance the
auditor is required to report on the substantial compliance of their
financial management systems with the requirements of FFMIA. The
auditor should conclude on substantial compliance at the completion of
the audit work based on work done in the internal control and testing
phases, as discussed in section 540.
[End of section]
450 - SAMPLING CONTROL TESTS:
.01:
Controls that leave documentary evidence of their existence and
application may be tested by inspecting this evidence. If sufficient
evidence cannot be obtained through walkthroughs in combination with
other observation and inquiry tests, the auditor generally should
obtain more evidence by inspecting individual items selected using
sampling procedures. The auditor may use multipurpose testing to use
the same sample to test controls and/or compliance and/or balances
(substantive test). This is usually more efficient. Alternatively, the
auditor may design a sample to test controls alone. In this case, the
auditor generally should use random attribute sampling (described
beginning in paragraph 450.05) to select items for sampling control
tests.
.02:
When planning sampling control tests, the auditor should determine (1)
the objectives of the test (including what constitutes a deviation),
(2) the population (including sampling unit and frame), (3) the method
of selecting the sample, and (4) the sample design and resulting sample
size. The auditor should document the sampling plan in the workpapers.
See section 495 E for example workpapers for documenting samples.
OBJECTIVES OF THE TEST:
.03:
The auditor should clearly indicate the objectives of the specific
control test. In designing samples for control tests, the auditor
ordinarily should plan to evaluate operating effectiveness in terms of
the rate of deviations in units or dollars from prescribed controls.
This involves defining (1) the specific control to be tested and (2)
the deviation conditions. The auditor should define control deviations
in terms of control activities not followed. For example, the auditor
might define a deviation in cash disbursements as "invoice not approved
and initialed by authorized individual.":
POPULATION:
.04:
In defining the population, the auditor should identify the whole set
of items on which the auditor needs to reach a conclusion and from
which the sample should be drawn. This includes (1) describing the
population, (2) determining the source document or the transaction
documents to be tested, and (3) defining the period covered by the
test. When multiple locations are involved, the auditor may consider
all or several locations as one population for sampling if the controls
at each location are components of one overall control system. Before
combining locations into one population, the auditor should consider
such factors as (1) the extent of uniformity of the controls and their
applications at each location, (2) whether significant changes can be
made to the controls or their application at the local level, (3) the
amount and nature of centralized oversight or control over local
operations, and (4) whether there could be a need for separate
conclusions for each location. If the auditor concludes that the
locations should be separate populations, he or she should select
separate samples at each location; he or she should evaluate the
results of each sample separately.
METHOD OF SELECTION:
.05:
The auditor should select a sample that he or she expects to be
representative of the population. For tests of controls, attribute
sampling achieves this objective. Attribute sampling requires random
selection of sample items without considering the transactions' dollar
amount or other special characteristics. IDEA or other software may be
used to make random selections.
SAMPLE SIZE:
.06:
In designing attribute samples for which inspection is the principal
source of evidence of control effectiveness, the auditor should
determine the objectives of the sample. For financial reporting control
tests, the objective is to support the preliminary assessment of
control risk as either moderate or low. For compliance and operations
control tests, the objective is to support the preliminary assessment
of the control as effective. In addition, for financial reporting and
compliance control tests, there is an objective of obtaining evidence
to support the auditor's report on internal control.
.07:
To determine the sample size, the auditor uses judgment to determine
three factors: the confidence level, the tolerable rate (maximum rate
of deviations from the prescribed control that the auditor is willing
to accept without altering the preliminary assessment of control
effectiveness), and the expected population deviation rate (expected
error rate). Once the auditor determines these factors, he or she may
use software (such as IDEA) or tables to determine sample size and to
determine how many deviations the auditor may find without having to
change the control risk assessment. GAO uses Tables I and II. Table I
on the following page may be used to determine the sample sizes
necessary to support these preliminary assessments of controls and to
conclude on the effectiveness of the controls. Tables I and II are used
to evaluate the test results. The AICPA has other examples in its
guidance, and the GAO factors are within the range of the AICPA
examples. If an auditor chooses to use factors other than Tables I and
II, he or she should consult with the Statistician.
.08:
Tables I and II are based on a 90 percent confidence level. (This
confidence level used at GAO is generally appropriate because the
auditor obtains additional satisfaction regarding controls through
other tests such as substantive tests, inquiry, observation, and
walkthroughs.):
.09:
Tables I and II are each based on different tolerable rates. Table I is
based on a tolerable rate of 5 percent, and Table II is based on a
tolerable rate of 10 percent. Each table shows various sample sizes and
the maximum number of deviations that may be detected in each sample to
rely on the controls at the determined control risk level. (See
paragraphs 450.13-.15 for a discussion of the evaluation of test
results.)[Footnote 3]
Figure 450.1: Sample Sizes and Acceptable Numbers of Deviations; (90%
Confidence Level).
TABLE I: (Tolerable rate of 5%):
(Use for determining sample sizes in all cases):
Sample size: 45; Acceptable Number of Deviations: 0.
Sample size: 78; Acceptable Number of Deviations: 1
Sample size: 105; Acceptable Number of Deviations: 2.
Sample size: 132; Acceptable Number of Deviations: 3.
Sample size: 158; Acceptable Number of Deviations: 4.
Sample size: 209; Acceptable Number of Deviations: 6
[End of table]
TABLE II: (Tolerable rate of 10%)
(Use for evaluating sample results only if preliminary assessment of
financial reporting control risk is low and deviations exceed Table I):
Sample size: 45; Acceptable Number of Deviations: 1.
Sample size: 78; Acceptable Number of Deviations: 4.
Sample size: 105; Acceptable Number of Deviations: 6.
Sample size: 132; Acceptable Number of Deviations: 8.
Sample size: 158; Acceptable Number of Deviations: 10.
Sample size: 209; Acceptable Number of Deviations: 14.
[End of table]
[End of table]
.10:
For financial reporting controls, if the preliminary assessment of
control risk is low or moderate, Table I may be used to determine
sample size. OMB audit guidance requires the auditor to perform
sufficient control tests to justify a low assessed level of control
risk, if controls have been properly designed and placed in operation.
.11:
For compliance and operations controls, sample sizes may also be
determined using Table I.
.12:
The auditor may use the sample size indicated for 0 acceptable
deviations (45 items). If no deviations are expected, the sample size
will be the most efficient for assessing control effectiveness; if no
deviations are found, the sample will be sufficient to support the
assessment of control risk. However, the auditor may use a larger
sample size if control deviations are expected to occur but not exceed
the acceptable number of deviations for the table.
EVALUATING TEST RESULTS:
Financial Reporting Controls:
.13:
To evaluate sample results, the auditor needs the sample size, the
number of deviations, and the confidence level. The auditor may use
software (such as IDEA) or tables to evaluate results.[Footnote 4] If
the auditor used Table I to determine sample size, and deviations are
noted that exceed the acceptable number for the sample size, the
auditor should follow the guidance below in deciding how to revise the
preliminary assessment of control risk:
* Low control risk: If the preliminary assessment of control risk is
low and if deviations are noted that exceed the acceptable number for
Table I, but not Table II, control risk may be assessed as moderate.
For example, if the original sample was 45 items, the auditor may
reduce the assessment of control risk to a moderate level if there is
not more than 1 deviation. If the auditor finds more than 1 deviation
with a sample size of 45 items, the auditor concludes that the
controls being tested are not operating effectively and should
reassess control risk as high.
* Moderate control risk: If the preliminary assessment of control risk
is moderate and if control deviations exceed the acceptable number for
Table I, the auditor should conclude that control risk is high. The
preliminary assessment of control risk is based on the assumption that
the controls operate as designed. If the preliminary assessment of
control risk is moderate and if control tests indicate that the control
is not operating as designed (deviations exceed the acceptable number
in Table I), the auditor should conclude that the control is
ineffective and revise the control risk assessment to high.
Compliance Controls:
.14:
If Table I is used to determine sample size and deviations are noted
that exceed the acceptable number for the sample sizes shown in Table
I, the auditor should conclude that the compliance control is not
effective. The auditor also should determine whether any deviations
noted ultimately resulted in noncompliance with a budget-related or
other law or regulation.
Operations Controls:
.15:
If Table I is used to determine sample size and deviations are noted
that exceed the acceptable number for the sample sizes shown in Table
I, the auditor should conclude that the operations control is not
effective. The auditor should not place reliance on ineffective
operations controls when performing other auditing procedures.
OTHER CONSIDERATIONS:
.16:
If, during the testing of sample items, the number of deviations
exceeds the acceptable number of deviations in Table I or II (as
applicable), the auditor concludes that the controls are not operating
as designed. However, the auditor should consider whether there are
other reasons for continuing to test the remaining sample items. For
example, audit team management should determine whether additional
information (such as an estimate of the population rate of occurrence)
is needed to report control weaknesses as described in paragraphs
580.31-.57. The significance of the weakness will determine how the
auditor reports the finding and, therefore, which elements of the
finding (condition, cause, criteria, possible effect, and
recommendation or suggestion) need to be developed. Or, the auditor may
want to include an interval estimate in the report. The auditor should
consult with audit team management and the Statistician in deciding
whether to complete the testing of the sample.
.17:
If an unacceptable number of deviations is noted in the original sample
and the auditor believes the use of a larger sample size might result
in an acceptable number of deviations, the auditor should consult with
the Statistician before selecting additional sample items. The
selection and evaluation of additional sample items cannot be based on
Tables I or II or on the formulas used by IDEA.
.18:
The auditor should consult with the Statistician when projecting the
rate of sample control deviations to a population for disclosure in a
report. While typically stated as a percentage of transactions, the
deviation rate is expressed as a percentage of dollars in the
population if sampling control tests are performed on a sample selected
using DUS (see paragraphs 480.14-.23).
[End of section]
460 - COMPLIANCE TESTS:
.01:
The type of provision of a law or regulation and the assessment of the
effectiveness of compliance controls affect the nature and extent of
compliance testing. Based on the type of provision (as discussed in
paragraph 245.01) the compliance tests discussed below should be
performed.
TRANSACTION-BASED PROVISIONS:
.02:
To test transaction-based provisions, the auditor should use sampling
to select specific transactions for testing compliance. The selection
of transactions to test may be combined with tests of financial
reporting, compliance, or operations controls and/or with substantive
tests, as appropriate. If the selection is solely for compliance
testing, the auditor generally should use a random attribute sample
(see paragraph 450.05). To determine sample size, the auditor needs to
make judgments as to confidence level, tolerable rate, and expected
population deviation rate. Confidence level should be related to
compliance control risk. For example, if the auditor determines
compliance controls are effective, he or she may use an 80 percent
confidence level; if ineffective, a 95 percent confidence level.
Tolerable rate is the rate of transactions not in compliance that could
exist in the population without causing the auditor to believe the
noncompliance rate is too high. GAO auditors should use 5 percent for
this. Since the auditor will assess the impact of all identified
noncompliance, many auditors use zero as the expected population
deviation rate. Using the above factors yields the following sample
sizes:
[See PDF for image]
[End of figure]
Since the auditor usually reports compliance on an entitywide basis,
the auditor may use these sample sizes on an entitywide basis.
Evaluation of test results is discussed in paragraph 460.07. The
auditor should test the entire sample, even if instances of
noncompliance are detected. If compliance controls were assessed on a
preliminary basis as effective and the results of testing indicated
that this assessment is not appropriate, in the above example, the
auditor should consult with the Statistician to determine the
appropriate sample size and selection procedures. The auditor cannot
merely choose the other sample size, but may, for example, increase the
sample size from 32 to 65 by using sequential sampling and randomly
selecting 33 additional items. The Statistician should also evaluate
the results when a test is expanded.
QUANTITATIVE-BASED PROVISIONS:
.03:
Generally, effective compliance controls should provide reasonable
assurance that the accumulation/summarization of information is
accurate and complete. If the compliance controls do not provide such
reasonable assurance, the auditor should test the accumulation of
information directly for existence, completeness, and summarization.
Such tests may be either samples or nonsampling selections and
generally should be designed to detect misstatements that exceed an
auditor-determined percentage of the total amount of the summarized
information or the amount of the restriction stated in the provision,
if any (GAO generally uses 5 percent for this test materiality). (The
amount of the restriction is described in paragraph 245.01.) Such tests
may be discontinued if significant misstatements are noted that would
preclude compliance. The test for compliance is the comparison of the
accumulated/summarized information with any restrictions on the amounts
stated in the identified provision.
.04:
For example, if provisions of budget-related laws and regulations are
considered significant and if related budget and consequently
compliance controls are ineffective, the auditor should test the
summarized information directly for the following potential
misstatements in budget execution information:
* Validity: Recorded amounts are not valid. (See section 395 F for
validity criteria for obligations, expended authority, and outlays.):
* Completeness: Not all amounts are recorded.
* Cutoff: Obligations, expended authority, and outlays are not recorded
in the proper period.
* Recording: Obligations, expended authority, and outlays are not
recorded at the proper amount.
* Classification: Obligations, expended authority, and outlays are not
recorded in the proper account by program and by object, if applicable,
including the proper appropriation year if the account has multiple
years. (Examples of program and object classifications are provided in
section 395 F.):
* Summarization: Transactions are not properly summarized to the
respective account totals.
.05:
An example of audit procedures to test for these misstatements is
included in section 495 B.
PROCEDURAL-BASED PROVISIONS:
.06:
In testing compliance controls relating to a procedural-based
provision, the auditor generally would obtain sufficient evidence to
conclude whether the entity performed the procedure and therefore
complied with the provision. For example, the auditor's tests of
compliance controls concerning receipt of information from grantees
generally would provide evidence of whether such information was
received and therefore whether the entity complied. If compliance
control tests do not provide sufficient evidence to determine
compliance, the auditor should perform additional procedures, as
considered necessary, to obtain such evidence.
EVALUATING TEST RESULTS:
.07:
For any possible instances of noncompliance noted in connection with
the procedures described above or other audit procedures, the auditor
should:
* discuss such possible instances with OGC and, when appropriate, the
Special Investigator Unit and conclude whether noncompliance has
occurred and the implications of any noncompliance;
* identify the weakness in compliance controls that allowed the
noncompliance to occur, if not previously identified during compliance
control testing;
* report the nature of any weakness in compliance controls and consider
modification of the report on internal control as appropriate (see
paragraphs 580.31-.55);
* consider the implications of any instances of noncompliance on the
financial statements; and:
* report instances of noncompliance, as appropriate. (See paragraphs
580.67-.75.):
[End of section]
470 - SUBSTANTIVE TESTS - OVERVIEW:
.01:
In the internal control phase, the auditor preliminarily assesses the
level of combined (inherent and control) risk for each significant
assertion within each significant line item or account (see section
370). Substantive audit procedures should be applied to all significant
assertions in significant financial statement line items and accounts.
The auditor's objective during substantive tests is to determine
whether the assertions are materially misstated and to form an opinion
about whether the financial statements are presented fairly in
accordance with GAAP. To determine if significant assertions are
misstated, the auditor should consider designing substantive tests to
detect each of the potential misstatements in assertions that were
developed in the internal control phase (see section 330). In addition,
the auditor should consider whether efficiencies can be achieved by
using the concepts of directional testing, as discussed in paragraphs
470.14-.16.
.02:
Based on the level of expected overall audit assurance determined in
the planning phase of the audit (see paragraph 260.04), the auditor
should establish the minimum levels of substantive assurance for each
level of combined risk. For example, based on the audit risk model in
AU 350 and a desired overall audit assurance of 95 percent, GAO
considers the following minimum levels of substantive assurance for
each level of combined risk to be appropriate:
Low combined risk: 63%:
Moderate combined risk: 86%:
High combined risk: 95%:
Substantive assurance is the auditor's judgment that all of the
auditor's substantive tests will detect misstatements that in total
exceed materiality. Substantive assurance, which relates to the entire
audit and correlates directly with the level of combined risk, is not
the same as confidence level, which is for a specific sample. The
higher the risk, the more substantive assurance required.
TYPES OF SUBSTANTIVE TESTS:
.03:
There are two general types of substantive tests: (1) substantive
analytical procedures and (2) tests of details. To achieve the required
substantive assurance (discussed above) the auditor may use either of
these tests or a combination of the two. The type of test to use and
the amount of reliance to place on each type of procedure, within the
framework of the audit matrix (discussed in paragraph 470.10), is a
matter of the auditor's judgment and should be based on effectiveness
and efficiency considerations.
Substantive analytical procedures:
.04:
Substantive analytical procedures involve the comparison of a recorded
amount with the auditor's expectation of that amount and investigation
of any significant differences to reach a conclusion on the recorded
amount. Analytical procedures involve a study of plausible
relationships among both financial and nonfinancial data. A basic
premise is that plausible relationships among data may reasonably exist
and continue in the absence of errors, fraud, or changes in
circumstances. (See AU 329.):
.05:
Substantive analytical procedures may be performed at one of three
levels for an assertion, as follows:
* Complete: The auditor relies solely on analytical procedures for all
of the assurance required from substantive procedures. The procedure
is so persuasive that the auditor believes that it will detect any
aggregate misstatements that exceed test materiality.
* Partial: The auditor relies on a combination of analytical procedures
and tests of details to obtain an appropriate level of substantive
assurance. For partial assurance, the auditor believes that the
analytical procedures should detect any aggregate misstatements that
exceed test materiality.
* None: The auditor does not rely on analytical procedures for
substantive assurance. All substantive assurance will be obtained from
tests of details. In this situation, supplemental analytical
procedures may be performed to increase the auditor's understanding of
account balances and transactions, but not to provide any additional
substantive assurance. These procedures are similar in scope to those
performed on an overall basis at the financial statement level (see
section 520).
.06:
To determine whether to perform complete or partial substantive
analytical procedures, the auditor should consider the effectiveness or
persuasiveness and efficiency of such procedures. In so doing, the
auditor should consider the factors discussed in detail in section 495
A.
Detail tests:
.07:
Detail tests are test procedures that are applied to individual items
selected for testing and include:
* Confirming a balance or transaction or the related terms, such as
accounts receivable or accounts payable, by obtaining and evaluating
direct communication from a third party.
* Physically observing, inspecting, or counting tangible assets, such
as inventory or property, plant, and equipment, and applying related
procedures.
* Examining supporting documents to determine whether a balance is
properly stated. For example, the auditor might examine invoices for
property and equipment purchases.
* Recalculating, or checking mathematical accuracy of entity records by
footing or crossfooting or by recomputing amounts and tracing journal
postings, subsidiary ledger balances, and other details to
corresponding general ledger accounts. For example, the auditor might
recalculate unit cost extensions in an inventory list, foot the list
(whether prepared manually or by computer), and trace the total to the
general ledger amount.
.08:
Detail tests are generally used in combination to provide sufficient
substantive assurance about an assertion. For example, to test the
valuation of accounts receivable, the auditor might confirm balances,
recalculate the aging schedule, examine documents supporting the aging
and specific delinquent accounts, and discuss collectibility with
management. On the other hand, a single detail test procedure might
provide substantive assurance about more than one of the five financial
statement assertions. For example, a physical observation of inventory
might provide evidence about existence, valuation, and presentation and
disclosure.
.09:
The minimum extent of detail testing to be performed is based on the
combined risk assessment and the amount of assurance obtained from
substantive analytical procedures, as illustrated in the Audit Matrix
(figure 470.1).
DETERMINING MIX OF SUBSTANTIVE TESTS:
.10:
In determining an appropriate mix of analytical procedures and detail
tests, the auditor should consider the following matrix (figure 470.1)
which illustrates the integration of such tests for each level of
combined risk, when the auditor is using a desired overall audit
assurance of 95 percent. GAO auditors should use this audit matrix.
Figure 470.1: Audit Matrix:
Assessed combined risk level: Low; Substantive assurance: 63%;
Substantive assurance from analytical procedures[A]: Complete; Minimum
substantive assurance from detail tests: 0%; Substantive assurance
from analytical procedures[A]: Partial; Minimum substantive assurance
from detail tests: 50%; Substantive assurance from analytical
procedures[A]: None; Minimum substantive assurance from detail tests:
86%.
Assessed combined risk level: Moderate; Substantive assurance: 86%;
Substantive assurance from analytical procedures[A]: Complete; Minimum
substantive assurance from detail tests: 0%; Substantive assurance
from analytical procedures[A]: Partial; Minimum substantive assurance
from detail tests: 77%; Substantive assurance from analytical
procedures[A]: None; Minimum substantive assurance from detail tests:
86%.
Assessed combined risk level: High; Substantive assurance: 95%;
Substantive assurance from analytical procedures[A]: Complete; Minimum
substantive assurance from detail tests: 0%; Substantive assurance
from analytical procedures[A]: Partial; Minimum substantive assurance
from detail tests: 92%; Substantive assurance from analytical
procedures[A]: None; Minimum substantive assurance from detail tests:
95%.
[A] Complete assurance from analytical procedures requires procedures
that are extremely effective and persuasive to serve as the sole source
of audit evidence for achieving the audit objective. This level of
effectiveness or persuasiveness is very difficult to achieve when
combined risk is assessed as high. Therefore, complete reliance on
analytical procedures for substantive assurance in these situations is
rare, particularly for balance sheet accounts.
[End of table]
.11:
Additional factors to consider in determining an appropriate mix of
analytical procedures and detail tests include the following:
* The nature and significance of the assertion being tested: Analytical
procedures are generally more likely to be effective for assertions
related to net cost statement accounts than for those related to
balance sheet accounts. Significant assertions generally require more
or higher quality audit evidence that may not be available from
analytical procedures.
* The nature of the combined risk: Substantive tests should be designed
to address the specific type and level of combined risk for each
assertion. For example, for certain loss claim liabilities, detail
tests might be used to search subsequent claim payments for potential
liabilities in testing the completeness assertion, while analytical
procedures might be applied to test the related valuation assertion by
evaluating the amounts per claim.
* The availability of different types of evidence: Using evidence that
can be readily obtained may be more efficient. For example, in federal
government audits, the availability of budgets and other information
may assist in performing analytical procedures.
* The quality of the respective types of evidence available: The higher
the quality of a type of evidence, the greater the level of assurance
the auditor may derive from that type (see paragraph 470.13).
* The anticipated effectiveness of analytical procedures: Detail tests
should be used if analytical procedures are not expected to be
effective.
.12:
When determining the types of substantive tests to use, the auditor's
goal should be to choose the mix of effective procedures that are
considered to be the most efficient in combination with sampling
control tests and compliance tests. The auditor should exercise
judgment when assessing the effectiveness or persuasiveness of all
audit procedures, particularly analytical procedures.
.13:
When considering a procedure's relative effectiveness, the auditor is
concerned about the expected quality of the evidence. The quality of
evidence obtained in a substantive test depends highly on the
circumstances under which it is obtained and should be evaluated with
professional skepticism. The following are generalizations about
evidence:
* Evidence obtained from independent third parties provides a higher
level of assurance than that obtained from sources in the entity.
* Evidence obtained directly by the auditor through confirmation,
physical examination, vouching, or recalculation provides a higher
level of assurance than that obtained indirectly, such as through
inquiry.
* Documentary evidence provides a higher level of assurance than oral
representations.
* Evidence obtained at or near the balance sheet date concerning an asset
or liability balance provides a higher level of assurance than that
obtained before or after the balance sheet date, because the audit risk
generally increases with the length of the intervening period.
* The lower the control risk associated with an entity's internal
control, the higher the assurance concerning the information subject to
that internal control.
OTHER EFFICIENCIES:
.14: In planning tests, the auditor should consider the relationships
between recorded amounts to help in achieving efficiencies. For
example, in double-entry accounting, a misstatement in one account
affects at least one other (related) account. This relationship gives
rise to the opportunity for testing more than one account with a single
test. Similarly, the relationship between budgetary and
proprietary[Footnote 6] accounts may provide the opportunity for
efficiencies in testing.
.15:
In double-entry accounting, a misstatement in one account affects at
least one other (related) account. For example, a misstatement of
accrued payroll typically results in a misstatement of payroll expense.
In this example, a substantive test of accrued payroll should detect
misstatements in both accrued payroll and payroll expense. In designing
substantive tests, after considering combined risk and developing an
understanding of each related account, the auditor should consider the
effect of such tests on related accounts. For example, a test of
revenue for completeness may provide substantive evidence about the
completeness of accounts receivable. In many instances where double-
entry accounting is used, it may be efficient to (1) design an overall
strategy that tests certain accounts substantively for either existence
or completeness (the two assertions most affected by testing related
accounts) and (2) rely on such tests to detect misstatements in the
related accounts. For example, the auditor might test (1) assets and
expenses directly for existence and (2) liabilities, equity, and
revenue for completeness, thereby indirectly testing the related
accounts for existence or completeness, as applicable. This logic is
called a directional testing approach.
.16:
In some instances, the auditor may need to supplement a directional
testing approach to address specific combined risks. For example, if
inherent and control risk factors warrant, the auditor might test both
existence and completeness in a test of cutoff as of the balance sheet
date. During initial financial statement audits, the auditor generally
should test both existence and completeness directly, when those
assertions are significant, because the cumulative knowledge about the
interaction of accounts may be limited.
.17:
The audit assurance that can be obtained from directional testing is
diminished in balance-sheet-only audits if related accounts are not
also tested and in audits of entities having single-entry accounting
systems (since double-entry account interrelationships do not exist).
In these instances, the auditor should test both existence and
completeness directly when those assertions are significant.
.18:
To maximize efficiency, the auditor should combine the testing of
budgetary and proprietary accounts where the combination is
appropriate. For example, the auditor may combine tests of outlays (on
the statement of budgetary resources) with tests of cash disbursements
(used to test net costs).
.19:
If an entity has budget accounting records but does not maintain
separate proprietary accounting records, or the proprietary records are
incomplete, the auditor should directly test expended authority
produced by the budget system and the items necessary to reconcile the
budget to the proprietary accounts.
.20:
Also, if (1) relevant budget restrictions relate to significant
quantitative-based provisions of laws and regulations and (2) budget
controls are not effective, the auditor should test the accumulation of
budget amounts (see paragraphs 460.03-.05).
[End of section]
475 - SUBSTANTIVE ANALYTICAL PROCEDURES:
.01:
This section provides guidance on the application of substantive
analytical procedures. Analytical procedures are sometimes referred to
as fluctuation analysis, flux analysis, predictive tests, or analytical
review. These procedures consist of comparing recorded account balances
with the auditor's expectations. The auditor develops an expectation or
estimate of what the recorded amount should be based on an analysis and
understanding of relationships between the recorded amounts and other
data. This estimate is then used to form a conclusion on the recorded
amount. A basic premise underlying analytical procedures is that
plausible relationships among data may reasonably be expected to
continue unless conditions are known that would change the
relationship. (For further information, refer to AU 329 or the Audit
Guide Analytical Procedures.):
.02:
Scanning account detail and recomputation are two other audit
procedures related to analytical procedures. Scanning consists of
searching for unusual items in the detail of account balances. Scanning
is an appropriate tool to investigate the cause of a significant
fluctuation, but it is not considered a substantive analytical
procedure on its own. Unusual items identified through scanning should
be investigated to obtain substantive assurance about the unusual
items. The auditor may independently compute an estimate of an account
balance, which is sometimes referred to as recomputation or an overall
test of reasonableness. These recomputations are considered substantive
analytical procedures. When making recomputations, the auditor should
assess the reliability of the data used and should follow the steps
used for performing substantive analytical procedures.
.03:
The risk of forming the incorrect conclusion on the account balance
tested may be higher for substantive analytical procedures than for
detail tests because of the procedures' extensive use of the auditor's
judgment. Accordingly, quality control is of critical importance. To
help maintain a high level of quality in these procedures, the
assessment of the amount of reliance to place on the procedures, the
design of the procedures, and the formulation of conclusions on the
results of these procedures should be performed or closely supervised
and reviewed by experienced audit team personnel.
PERFORMING SUBSTANTIVE ANALYTICAL PROCEDURES:
.04:
If substantive analytical procedures are used, the auditor should
perform steps a. through l. below:
a. Determine the amount of the limit. The limit is the amount of
difference between the auditor's expectation and the recorded amount
that the auditor will accept without investigation. The determination
of the limit is a matter of the auditor's judgment; some guidelines are
provided in paragraph 475.05. The guidelines consider the amount of
substantive assurance desired from analytical procedures.
b. Identify a plausible, predictable relationship and develop a model
to calculate an expectation of the recorded amount. Consider the type
of misstatements that could occur and how those misstatements would be
detected by the model.
c. Gather data for developing the expectation, and perform appropriate
procedures to establish the reliability of the data. The reliability of
these base data is subject to the auditor's judgment. The reliability
of data is discussed further in section 495 A.
d. Develop the expectation of the recorded amount using the information
obtained during the previous steps. The preciseness of the expectation
is subject to the auditor's judgment and is discussed further in
section 495 A.
e. Compare the expectation with the recorded amount, and note the
difference.
f. Obtain explanations for differences that exceed the limit, since such
differences are considered significant.
g. Corroborate explanations for significant differences.
h. Determine whether the explanations and corroborating evidence
provide sufficient evidence for the desired level of substantive
assurance. If unable to obtain a sufficient level of substantive
assurance from analytical procedures, perform additional procedures as
discussed in paragraphs 475.12-.17 and consider whether the difference
represents a misstatement.
i. Consider whether the assessment of combined risk remains appropriate,
particularly in light of any misstatements identified. Revise the
assessment of combined risk, if necessary, and consider the effects on
the extent of detail tests.
j. Document (on the Summary of Possible Adjustments as discussed in
540.04) the amount of any misstatements detected by substantive
analytical procedures and their estimated effects. The limit (the
amount of the difference between the recorded amount and the
expectation that does not require explanation) is not considered a
known or likely misstatement and is not posted to the Summary of
Possible Adjustments.
k. Conclude on the fair presentation of the recorded amount.
l. Include documentation of work performed, results, and conclusions in
the workpapers. Required documentation is discussed in section 490.
GUIDELINES FOR ESTABLISHING THE LIMIT:
.05:
As discussed above, the limit is the amount of the difference between
the expected and recorded amounts that can be accepted without further
investigation. GAO uses the following guidelines in establishing the
limit for each level of reliance on analytical procedures for
substantive assurance:
* Complete reliance: The limit is 20 percent or less of test
materiality.
* Partial reliance: The limit is 30 percent or less of test materiality.
* No reliance: Substantive analytical procedures are not needed.
Auditors using different limits should document the basis for the limit
used.
INVESTIGATING SIGNIFICANT DIFFERENCES:
Causes of significant differences:
.06:
Differences between the expectation and the recorded amount typically
relate to either factors not included in the model (such as specific
unusual transactions or changes in accounting policies), a lack of
preciseness of the model, or misstatements (either errors or fraud).
Amount of Difference to Be Explained:
.07:
When obtaining explanations, it is usually helpful to review with
entity personnel the model and assumptions used to develop the
expectation. Entity personnel will then be in a better position to
provide the auditor with a relevant explanation. If the amount of the
difference exceeds the limit, the auditor generally should try to
obtain an explanation for the entire difference between the recorded
amount and the expectation. The portion of the difference that exceeds
the limit must be explained (see figure 475.1). If the difference does
not exceed the limit, an explanation is not required. The auditor
should identify and corroborate all significant factors that may cause
the expectation to differ from the actual amount, regardless of whether
the factors increase or decrease the difference.
Figure 475.1: Amount of Difference Explained When:
Recorded Amount Exceeds Limit:
[See PDF for image]
[End of figure]
Corroboration of explanations:
.08:
The relevance and reliability of corroborating evidence may vary
significantly; therefore, the extent of corroboration of explanations
is left to the auditor's judgment. Corroboration may consist of
examining supporting documentation or corroborating explanations
received from accounting department personnel with personnel from the
appropriate operating department, who should be knowledgeable about the
entity's operations. The explanations for the fluctuations should be
quantified and should address the direction and magnitude of the event
causing the fluctuation. The auditor should corroborate all
explanations received. In determining whether sufficient corroborating
evidence has been obtained, the auditor should consider the guidelines
for complete and partial assurance discussed in paragraph 470.05. In
evaluating explanations the auditor should consider whether the
difference could be caused by error or fraud.
Example of an adequate explanation for a significant fluctuation:
.09:
Assume that the auditor determined test materiality to be $25 million.
Additionally, assume that the auditor has determined, after considering
any inherent and control risks, that a substantive analytical procedure
should be performed with a limit of $5 million. The auditor estimated
interest expense at $80 million by multiplying the average loan balance
of $1 billion by the average interest rate of 8 percent. Both of these
averages were computed through a simple average of beginning-of-year
and end-of-year amounts. The recorded amount of interest expense, $94.5
million, is higher than the estimated amount by $14.5 million and
exceeds the limit by $9.5 million.
.10:
An explanation from entity personnel that "we borrowed more money this
year and interest rates are higher than last year" would not be
adequate. This explanation needs to be quantified and corroborated.
.11:
An example of an adequate explanation follows:
Based on a review of correspondence from lenders, interest rates
increased during the year and then fell and were computed to average 9
percent based on a monthly average. Additionally, loan statements from
lenders indicate that $100 million was borrowed and repaid during the
year, and the additional borrowings were outstanding for 6 months.
Therefore, the average loan balance was actually $50 million higher and
the average interest rate was 1 percent higher than the figures used in
the auditor's original estimate.
Therefore, the interest expense in excess of the expectation can be
explained as follows (in thousands):
$1,000,000 X 1% = $10,000 + 50,000 X 9% = 4,500:
Total difference explained: $14,500:
Course of action in the event of inadequate explanations or
corroborating evidence:
.12:
If an explanation and/or corroborating evidence does not adequately
explain the fluctuation sufficient to provide either complete or
partial assurance, the auditor must perform additional substantive
procedures. These procedures may consist of:
* increasing the effectiveness of the substantive analytical procedures
by making the expectation more precise in order to obtain the amount of
desired assurance,
* performing tests of details and placing no reliance on the
substantive analytical procedures that were ineffective, or:
* treating the difference as a misstatement.
.13:
The auditor should consider the relative efficiency of each of these
options. Deciding whether to perform additional substantive procedures
is a matter of the auditor's judgment. The additional procedures must
provide the auditor with adequate assurance that aggregate
misstatements that exceed test materiality have been identified.
.14:
To increase the persuasiveness or effectiveness of an analytical
procedure, the auditor generally needs to make the expectation more
precise. The auditor can do so by:
* building a more sophisticated model by identifying more key factors
and relationships,
* disaggregating the data (such as using monthly instead of annual
data[Footnote 7]), or
* using more reliable data or obtaining greater confidence in the
data's reliability by corroborating the data to a greater extent.
Measuring the precision of the expectation and the impact of changing
each of these factors on the procedure's effectiveness is difficult and
is left to the auditor's judgment.
.15:
If detail tests are used to test the account balance because adequate
explanations cannot be obtained or corroborated, the auditor still must
obtain an overall understanding of the current-year financial
statements when applying the required overall analytical procedures at
the financial statement level. As discussed in section 520,
significantly less work is needed to obtain this overall understanding
of the financial statements than when using analytical procedures as a
substantive test.
.16:
Additionally, if analytical procedures originally performed as a
substantive test do not provide the required assurance, the auditor may
be able to use those procedures to supplement an understanding of the
account balances or transactions after obtaining substantive assurance
through detail tests.
.17:
When the auditor places no reliance on substantive analytical
procedures, all substantive assurance is provided by detail tests. In
this situation, less rigorous, supplemental analytical procedures may
be used to increase the auditor's understanding of the account balances
and transactions after performing the detail tests. When using
supplemental analytical procedures, the auditor uses judgment to
determine which fluctuations require explanations.
[End of section]
480 - SUBSTANTIVE DETAIL TESTS:
POPULATION TO BE TESTED:
.01:
In designing detail tests, the assertion tested affects the choice of
the population (an account balance or a portion of an account balance)
from which items are selected. For example, the existence assertion
deals with whether recorded assets or liabilities exist as of a given
date and whether recorded transactions have occurred during a given
period. To detail test the existence assertion, the auditor should test
the recorded account balance by (1) selecting items from those that
compose the account balance and (2) then testing those items to
evaluate whether such inclusion in the account balance is proper. For
example, to test an expense account for existence, the auditor might
select individual expense amounts included in the balance from a detail
general ledger and then examine invoices that support the expense
amount. It would be inappropriate to select invoices directly and then
trace invoice amounts to inclusion in the general ledger balance.
.02:
For the existence assertion, the test population should agree with or
be reconciled to the recorded amount of the account balance being
tested. The auditor should test reconciling items, if any, in an
appropriate manner. If this is not done, the conclusion applies only to
the test population (the available items), not the recorded population.
.03:
Conversely, the completeness assertion deals with whether all
transactions and accounts that should be presented in the financial
statements are so included. To detail test the completeness assertion,
the auditor should select from an independent population of items that
should be recorded in the account. The auditor should (1) select items
that should be recorded from a source that is likely to contain all the
items that should be recorded and (2) determine whether they are
included in the recorded balance. For example, to test completeness of
recorded revenue, the auditor might select shipments from a shipping
log (which is believed to be reasonably complete), trace them to
recorded revenue amounts, and then test the summarization of those
amounts to inclusion in the general ledger revenue balance. To test
completeness of recorded accounts payable, the auditor might select
from payments made subsequent to year-end plus invoices on hand but not
yet paid and trace those in which the receipt of goods or services
occurred before year-end to inclusion in year-end accounts payable
(those where the receipt occurred after year-end should be tested for
exclusion from accounts payable).
SELECTION METHODS FOR DETAIL TESTS:
.04:
Detail tests may be applied to any of the following:
* all items composing the population;
* a nonrepresentative selection (nonsampling selection) of items; and:
* a representative selection (sample) of items composing the population.
Flowchart 1 (section 495 E) illustrates the process of deciding the
selection method.
.05:
Detail testing of all items composing the population is generally most
appropriate for populations consisting of a small number of large
items. For example, several large accounts receivable or investments
might compose an entire balance.
.06:
Detail testing of a nonrepresentative selection (nonsampling selection)
is appropriate where the auditor knows enough about the population to
identify a relatively small number of items of interest, usually
because they are likely to be misstated or otherwise have a high risk.
(Nonrepresentative selections may also be used to test controls by
using inquiry, observation, and walkthrough procedures and to obtain
planning information, for example, by performing a walkthrough to
understand the items in the population.) While the dollar amount is
frequently the characteristic that indicates that an item is of
interest, other relevant characteristics might include an unusual
nature (such as an item identified on an exception report), an
association with certain entities (such as balances due from high-risk
financially troubled entities), or a relationship to a particular
period or event (such as transactions immediately before and after the
year-end date). The effects of any misstatements found should be
evaluated; however, unlike sampling, the results of procedures applied
to items selected under this method apply only to the selected items
and must not be projected to the portion of the population that was not
tested. Accordingly, the auditor must apply appropriate analytical and/
or other substantive procedures to the remaining items, unless those
items are immaterial in total or the auditor has already obtained
enough assurance that there is a low risk of material misstatement in
the population.
.07:
Detail testing of a representative selection (sample) of items
composing the population is necessary where the auditor cannot
efficiently obtain sufficient assurance (based on the assessed combined
risk and other substantive procedures including analytical procedures)
about the population from nonrepresentative selections. The auditor
selects sample items in such a way that the sample and its results are
expected to be representative of the population. Each item in the
population must have an opportunity to be selected, and the results of
the procedures performed are projected to the entire population. (In
random selection, each item has an equal chance of selection (see
glossary for further discussion of definition); in dollar-unit sampling
(DUS), each dollar has an equal chance of selection; in classical
variables estimation sampling, each item in a stratum has an equal
chance of selection.):
.08:
The auditor may use a nonrepresentative selection for part of the
population and a sample for the remainder of the population. For
example, the auditor might select all inventory items with a book
amount greater than $10,000,000, all items that have not had any
activity in the previous 6 months, and a statistical sample of the
balance of the population. The auditor would project the misstatements
in the statistical sample to the population of items less than
$10,000,000 with activity in the last 6 months. The auditor would also
compute a combined evaluation for the three selections by adding the
results of the 100 percent selections to the conclusion for the
statistical selections.
.09:
The auditor should document in the workpapers (usually in the audit
program) whether a selection is intended to be a representative
selection (a sample projectable to the population) or a
nonrepresentative selection (not projectable to the population); if it
is a nonrepresentative selection, the auditor also should document the
basis for concluding that enough work has been done to obtain
sufficient assurance that the items not tested are free from aggregate
material misstatement.
REPRESENTATIVE SELECTIONS (SAMPLING):
.10:
The following paragraphs provide an overview of sampling, primarily
with respect to the existence and valuation assertions. Similar
concepts and methods apply to the completeness assertion, except that
the population for selection differs. (See paragraphs 480.01-.03.):
.11:
AU 350.45 indicates that samples may be either statistical or
nonstatistical. In statistical sampling, the auditor uses probability
theory to determine sample size, select the sample, and evaluate the
results for the purpose of reaching a conclusion about the population.
Statistical sampling permits the auditor to objectively determine
sample size (based on subjective decisions about risk and materiality),
objectively select the sample items, and objectively evaluate the
results; thus, the auditor using statistical sampling determines
objectively whether enough work has been performed. Because of these
advantages, when a sample is necessary, the auditor should use
statistical sampling. Software such as Interactive Data Extraction and
Analysis (IDEA)[Footnote 8] allows the auditor to quickly perform the
calculations necessary for statistical sampling.
.12:
In nonstatistical sampling, the auditor considers statistical concepts,
but does not explicitly use them to determine sample size, select the
sample,[Footnote 9] or evaluate the results. Because the auditor using
statistical sampling objectively considers the same factors that the
auditor using nonstatistical sampling should subjectively consider, the
size of a nonstatistical sample should not be less than the size of a
properly calculated statistical sample.
.13:
The auditor who uses nonstatistical sampling generally should first
calculate a statistical sample size (generally using dollar-unit
sampling), then add at least 25 percent. The 25 percent is protection
because the nonstatistical sample is not as objective as the
statistical sample. The auditor who wishes to use nonstatistical
sampling for a particular test should obtain the approval of the
Reviewer, in consultation with the Statistician, before performing the
test. Approval is not needed to use nonrepresentative selections
(nonsampling) since they do not involve projections.
.14:
In sampling, the sample must be selected from all the items that
compose the population so that each item has an opportunity for
selection (in statistical sampling, the auditor can determine the
probability of selection). For example, the auditor might select sample
items from a list of all accounts receivable balances that is
reconciled to the related account balance. Selecting sample items from
file drawers is not a valid selection method for any type of sampling
unless the auditor has determined that all items composing the
population are included in the drawers.
.15:
For statistical samples, sample items should be selected using random
or dollar-unit selection methods. Computer software may be used. Manual
selection should be based on random number tables, a computer-based
random number generator, or through use of systematic selection (every
nth item with a random start between 1 and n). For example, the auditor
might begin with a random start and then choose every nth item, where n
is the sampling interval. The sampling interval would be determined by
dividing the number of items in the population by the desired number of
selections.
.16:
The sample size is a function of the size of the population, the
desired confidence level (based on the amount of substantive assurance
the auditor requires from detail tests, as shown on the audit matrix in
section 495 D), test materiality (based on design materiality, expected
misstatements, and other factors discussed in paragraph 230.13), and
the sample selection method.
.17:
Once the auditor decides that a sample is necessary, the choice of the
sample selection method to be used is a matter of the auditor's
judgment concerning the most efficient method to achieve the audit
objectives. The following methods of sample selection are available for
substantive testing:
* dollar-unit sampling (DUS)--see paragraph 480.21,
* classical variables estimation sampling--see paragraph 480.32, and:
* classical probability proportional to size (PPS) sampling (evaluating a
PPS sample using a classical variables sampling approach)--see
paragraph 480.34.
Attributes sampling may be used for tests of controls and for tests of
compliance with laws and regulations. To use any sampling method for
substantive testing that is not listed in this paragraph, the auditor
should consult with the Statistician. (Stratification and/or use of
ratio estimates and regression estimates often lead to smaller sample
sizes. Multistage samples may reduce time and travel costs.):
.18:
Each of these methods yields a valid projected (likely) misstatement,
and a valid upper limit at the desired confidence level. In addition,
classical PPS and classical variables sampling yield a valid two-sided
confidence interval (DUS yields a valid upper limit). The auditor
chooses the method based on the test objectives and efficiency.
.19:
When deciding the sampling method, the auditor should consider whether
the dollar amounts of the individual items composing the population are
available (such as on a detail listing or a computer file), the
expected amount of misstatements, and the relative cost and efficiency
of each appropriate sampling method. Flowchart 2 (section 495 E)
summarizes the process of choosing the sampling method once the auditor
has decided a sample is necessary. The subsequent pages of the
flowchart indicate the steps that the auditor generally should perform
for each sampling method. Example workpapers to document attribute,
dollar-unit, and classical variables sampling are in section 495 E.
.20:
If the dollar amounts of the individual items composing the population
are known, the auditor should use DUS, classical PPS, or classical
variables estimation sampling. If dollar amounts of these individual
items are not known, see paragraph 480.36.
SAMPLE SELECTION:
Dollar-unit sampling (DUS):
.21:
Dollar-unit sampling (DUS)[Footnote 10] is a type of statistical
sampling that the auditor generally should use when:
a. the dollar amounts of individual items in the population are known,
b. the primary objective is to test the overstatement of the population
(see below for testing a population related to the line item),
c. the auditor expects that the total dollar amount of misstatement in
the population is not large,[Footnote 11] and:
d. the amount of misstatement in an individual item cannot exceed the
selected amount.[Footnote 12]
DUS is also known as probability proportional to size (PPS) and
monetary unit sampling (MUS). DUS works best in populations where the
total misstatement is not large and where the objective is to test for
overstatement of a population. When the objective is understatement of
a line item, the auditor often is able to define a related population
to test for overstatement. For example, to test for understatement of
accounts payable, the auditor would select a DUS of subsequent
disbursements. See also paragraph 480.36.
.22:
In a manually applied DUS, a sampling interval (n) is used to select
every nth dollar from the dollars in the individual items that compose
the population. These items might be recorded amounts for individual
receivable balances, inventory items, invoices, or payroll expenses.
The item that contains the nth dollar is selected for testing. DUS is
representative of all dollars in the population; however, larger items
have a higher probability of selection (for example, a $2,000 item has
an approximately twenty times greater probability of selection than a
$100 item).
.23:
When the total misstatement in the population is not large, DUS will
yield the smallest sample size for a given population, test
materiality, and desired confidence level when all statistical sampling
methods are considered. When the auditor expects that the population
contains a large amount of misstatement, he or she should use classical
variables sampling (see footnote 3 and paragraph 480.33).
.24:
In DUS, the auditor may compute the sample size manually (paragraphs
480.24-.26) or by using computer software (paragraph 480.27). To
calculate a dollar-unit sample size manually, the auditor uses the
dollar amount of the population, test materiality (see section 230),
and required confidence level. The auditor calculating sample size
manually may use the statistical risk factor from figure 480.1 to
determine sample sizes for the appropriate confidence level, as
discussed below.
Figure 480.1: Statistical Risk Factors:
Confidence Level: 50%; Statistical; Risk Factor[A]: 0.7.
Confidence Level: 63%; Statistical; Risk Factor[A]: 1.0.
Confidence Level: 77%; Statistical; Risk Factor[A]: 1.5.
Confidence Level: 86%; Statistical; Risk Factor[A]: 2.0.
Confidence Level: 92%; Statistical; Risk Factor[A]: 2.5.
Confidence Level: 95%; Statistical; Risk Factor[A]: 3.0.
[A] These are based on the Poisson distribution, which approximates the
binomial distribution. Therefore, the sample size computed using this
table may differ slightly from the sample size computed using IDEA.
[End of table]
Section 495 D contains the audit matrix with the appropriate risk
factor for each level of combined risk and reliance on substantive
analytical procedures. See paragraph 480.27 for guidance on using IDEA
to compute sample size.
.25:
The statistical risk factors are used in the following formulas to
determine the sampling interval and sample size for DUS:
1. sampling interval = test materiality  statistical risk factor:
2. sample size = recorded amount  sampling interval:
Sample sizes should be stated in whole numbers. Uneven amounts should
be rounded up to the next whole number. For example, a sample size of
40.2 items should be rounded up to 41 items.
.26:
For example, to test a recorded amount of $30 million with a test
materiality of $900,000 and a 95 percent confidence level, the
statistical risk factor would be 3.0. The sampling interval would be
$300,000 (test materiality of $900,000 divided by the statistical risk
factor of 3.0). Essentially, from a random start, every 300,000th
dollar is selected. Therefore, the preliminary estimate of sample size
of 100 items is calculated by dividing the recorded amount of $30
million by the sampling interval of $300,000. Because the amount of
certain items might equal or exceed the sampling interval, a selection
might include more than 1 sample item (for example, a $600,000
selection would include 2 of the 100 estimated sample items: $600,000/
$300,000 = 2), thereby making the actual number of items tested fewer
than 100.
.27:
When the auditor uses the IDEA software to calculate sample size, the
inputs are materiality, expected total dollar amount of misstatements
in the population, confidence level, and the dollar amount of the
population. Whether the auditor should input design materiality or test
materiality depends on why the auditor reduced design materiality to
get test materiality (see paragraph 230.13). If the auditor reduced
design materiality to test materiality because not all entity locations
are being tested or because the area is sensitive to financial
statement users, the auditor should input test materiality. If the
auditor reduced design materiality to test materiality solely because
misstatements were expected, the auditor should input design
materiality rather than test materiality. The reason for this is that
the auditor inputs the expected dollar amount of misstatements in the
population, and the software considers it in adjusting materiality (if
the auditor inputs test materiality, the adjustment will have been made
twice).
.28:
It is difficult to select additional items for a dollar-unit sample
after the original sample is selected. If the auditor believes that
extension of the sample might be necessary, the auditor generally
should plan for that possibility and consult with the Statistician. For
example, the auditor might use a 95 percent confidence level
(statistical risk factor of 3.0) to select the sample but test only the
number of items necessary to achieve the planned confidence level. The
items tested should be spread evenly throughout all of the items
selected. For example, in a manual selection, if a statistical risk
factor of 1.5 is appropriate based on the planned confidence level, the
auditor would make selections using a statistical risk factor of 3.0
(twice as many selections as the factor of 1.5) and initially test
every other selection (beginning with a random start).
.29:
If the preliminary assessment of combined risk or reliance on
substantive analytical procedures is not supported by the results of
testing, the substantive assurance needed from detail tests increases,
and the auditor would then test the additional items selected in the
initial sample.
.30:
If additional sample items are not selected during the initial sample
and it is necessary to select additional items, the auditor should
consult with the Statistician to determine how to select the additional
sample items. Selection of these additional items may be more complex
and less efficient than if they were chosen during the initial sample.
.31:
Section 495 F describes how to manually select items using DUS.
Computer software, such as IDEA, generally should be used to select a
dollar-unit sample.[Footnote 13] The choice of selection method used
should be based on efficiency considerations.
Classical variables estimation sampling:
.32:
Classical variables estimation sampling is a type of statistical
sampling that the auditor should consider when the auditor expects that
one or more of the following exist in the population: the dollar amount
of misstatement in the population is large (see footnote 3); individual
misstatements may exceed the selected amount of sampling units;
significant understatements cannot be identified using other tests;
there are no book amounts for each sampling unit; or the auditor cannot
add the dollar amounts in the population (see flowchart 2 in section
495 E).
.33:
Classical variables estimation sampling is useful because it frequently
results in smaller sample sizes in higher misstatement situations than
those that would be obtained using DUS. Because applying this method is
somewhat complex, the auditor should consult with the Statistician
before using it. Classical variables sampling and classical PPS require
knowledge of the population to determine sample size. In many audits,
the auditor learns about the population over several audits and
improves the plan each time.
Classical PPS Sampling:
.34:
Classical PPS Sampling is a type of statistical sampling that the
auditor should use when he or she is testing for overstatement of the
defined population and finds a large misstatement rate. The sample is
selected the same way as a dollar-unit sample (proportional to size).
Since there is no exact way to determine sample size, the auditor uses
DUS to calculate sample size. However, since classical PPS sampling is
used when there are large misstatement rates, the auditor uses a
conservative (high) estimate of the expected misstatement to avoid
needing subsequently to expand the sample size to obtain a sufficient
sample size.
.35:
Since classical PPS yields a valid measure of likely misstatement and
precision, it may be used whenever the only reason for using classical
variables sampling otherwise is the expected large misstatement rate.
Sampling when dollar amounts are not known:
.36:
DUS cannot be used if the dollar amounts of individual items in the
population are not known. Classical variables estimation sampling might
be used, but this has some difficulties: there is no way to accurately
calculate the sample size without the individual dollar amounts, and
the method is inefficient unless the auditor finds a large misstatement
rate. Lack of individual dollar amounts usually occurs when testing the
completeness assertion where the selection is made from a population
independent of the population being tested (see paragraphs 480.01-.03).
In one approach, the auditor might select a random or systematic sample
of the individual items. For example, items might be randomly selected
from a shipping log to test the completeness assertion for revenue.
.37:
For this type of test, the sample size may be approximated from the
total dollar amount of either the population that the auditor is
sampling from (the total dollars of the shipping log if the total
dollar amount is available) or the dollar amount of the population that
the auditor is testing (the total recorded revenue). Because this
method is less efficient than DUS, the preliminary estimate of sample
size for this sample should exceed the sample size that would result
from using DUS. GAO auditors should use at least a 25 percent increase
in sample size.[Footnote 14]
.38:
The auditor should consult with the Statistician in performing the
evaluation. If the misstatement rate is large, they should consider
using classical variables estimation sampling. While attribute sampling
may be used to estimate the misstatement rate in the population, this
will yield acceptable results only if just one or two misstatements are
found. The auditor generally should use the upper limit of the
misstatement rate to make a conservative estimate of the dollar amount
of misstatement in the population. If the upper limit is less than
materiality, the auditor has evidence that the population is free of
material misstatement.
EVALUATION OF SAMPLE RESULTS:
.39:
Evaluation involves several steps:
a. Projecting the results of the sample to the population (for
nonstatistical samples, making a judgment about likely misstatement in
the population).
b. Calculating either the upper limit of misstatement in the
population or an interval estimate of misstatement or of the
population audited value at the desired confidence level (for
nonstatistical samples, considering the risk of further misstatement).
c. Considering the qualitative aspects of misstatements.
d. Reaching a conclusion as to whether the population is fairly stated.
e. Considering the effect of misstatements on the financial statements
taken as a whole.
Steps a. and b. are usually done with software such as IDEA in
consultation with the Statistician.
.40:
The effects of any misstatements detected in a sample should be
projected to the population. In doing so, the auditor should ask the
auditee to determine the cause of any misstatement found. The auditor
should project all misstatements unless he or she has obtained highly
persuasive evidence that the misstatement is not representative of the
entire population. If the evidence is highly persuasive that a
misstatement is not representative of the population, the auditor
should (1) perform procedures to test that the same type of
misstatement does not exist elsewhere in the population, (2) evaluate
the misstatement that is not representative, (3) evaluate the sample,
excluding the misstatement that is not representative, and (4) obtain
the approval of the Audit Director that the evidence is highly
persuasive. The projected misstatement amount should be included in the
Summary of Possible Adjustments as a likely misstatement, the
evaluation of which is discussed in section 540.
.41:
At the conclusion of the test, the auditor also should consider whether
the assessment of combined risk remains appropriate, particularly in
light of any misstatements identified. If the preliminary combined risk
assessment was not appropriate, the auditor should consult with the
Reviewer to determine whether the extent of substantive procedures is
adequate.
.42:
When understated amounts are detected in any sample designed primarily
to test the existence assertion (i.e., designed to test primarily for
overstatement), the auditor should consult with the Statistician in
evaluating the sample results.
Calculating the projected misstatement for DUS:
.43:
If the auditor does not use software to evaluate sample results, he or
she may calculate projected misstatement as follows. For a misstatement
detected in which the item equals or exceeds the amount of the sampling
interval (each of which is selected for testing), the projected
misstatement is the amount of the misstatement detected. For any other
misstatement detected, the projected misstatement is computed as
follows: (1) divide the amount of misstatement by the recorded amount
of the sample item and (2) multiply the result by the amount of the
sampling interval. The sum of all projected misstatements represents
the aggregate projected misstatement for the sample. For example,
assume the following two misstatements are detected in a sample for
which the sampling interval is $300,000: (1) a $50,000 misstatement
detected in a $500,000 item (which exceeds the amount of the sampling
interval) results in a projected misstatement of $50,000, and (2) a
$100 misstatement in a $1,000 sample item represents a 10 percent
misstatement, which results in a projected misstatement of $30,000 (10
percent of the $300,000 sampling interval). In this case, the aggregate
projected misstatement is $80,000.
Converting a DUS to a Classical PPS sample:
.44:
If a dollar-unit sample results in a large number of misstatements, it
is likely that the evaluation calculated using the method illustrated
above would indicate that the upper limit of misstatement in the
population exceeds materiality (IDEA indicates the number of
misstatements that would yield acceptable results). However, if there
are a large number of misstatements,[Footnote 15] the auditor, in
consultation with the Statistician, should evaluate the sample using
classical PPS. This evaluation is complex and cannot be done directly
using IDEA.
Evaluating the results of a classical variables estimation sample:
.45:
The auditor should consult with the Statistician in evaluating the
results of a classical variables estimation sample.
Evaluating the results of other samples:
.46:
When misstatements are detected in a sample for which guidance on
evaluation is not described above, the auditor should consult with the
Statistician.
EFFECTS OF MISSTATEMENTS ON THE FINANCIAL STATEMENTS:
.47:
The quantitative and qualitative effects of all misstatements detected
in the audit --both known and likely --must be evaluated in relation to
the financial statements as a whole. Section 540 provides guidance on
this evaluation.
[End of section]
490 - DOCUMENTATION:
.01:
The auditor should document the nature, timing, and extent of tests
performed during this phase of the audit, as well as the conclusions
reached. The auditor should specifically identify the procedures used
to obtain substantive assurance for an account balance. This
identification is particularly important if detail tests are relied on
for complete substantive assurance and supplemental analytical
procedures are performed to increase the auditor's understanding of the
account balances and transactions.
.02:
For example, assume an entity incurs and accounts for operating
expenses at 50 locations. After considering the guidance in section 295
C regarding multiple-location audits, the auditor decides to obtain all
the required substantive assurance from detail tests. The auditor
subjects all operating expenses to a statistical sample and visits only
the locations for which selections were made. Assume that the auditor
decides to obtain additional knowledge of the current-year operations,
particularly for locations not visited, through supplemental analytical
procedures at all locations. These procedures consist of comparing
current-year operating expenses with prior-year audited information by
location and between locations.
.03:
In the above situation, the auditor is obtaining the entire required
amount of substantive assurance from detail tests. The comparison of
the current-and prior-year amounts is considered a supplemental
analytical procedure and does not provide substantive audit assurance
that the auditor may use to reduce the detail tests. During this
supplemental analytical procedure, the auditor may detect misstatements
that were not detected during the detail tests. The auditor must
consider the implications of these misstatements to determine if the
original assessment of combined risk was appropriate and if the amount
of substantive testing performed (the detail tests) was adequate. Even
though misstatements may be detected during supplemental analytical
procedures, these procedures cannot be relied on for substantive
assurance.
.04:
In the audit program, the auditor generally should explain the
objectives of audit procedures. Also, written guidance either within or
accompanying the audit program to explain possible exceptions, their
nature, and why they might be important, may help auditors focus on key
matters, more readily determine which exceptions are important, and
identify significant exceptions.
.05:
The auditor also should document, usually in the audit program, whether
a selection is intended to be a representative selection (a sample
projectable to the population) or a nonrepresentative selection (not
projectable to the population). If it is a nonrepresentative selection,
the auditor also should document the basis for concluding that enough
work has been done to obtain sufficient assurance that the items not
tested are free from aggregate material misstatement.
.06:
As the audit work is performed, the auditors may become aware of
possible reportable conditions or other matters that should be
communicated to the auditee. The auditor generally should document and
communicate these as described in paragraph 290.02.
.07:
Documentation of this phase should specifically include (see section
495 E for example workpapers):
For tests involving sampling:
** the sampling method used and any key factors regarding selection;
** the sample size and the method of determining it;
** the audit procedures performed; and:
** the results of tests, including evaluations of sample results, and
conclusions.
For substantive analytical procedures:
** the model used to develop the expectation and the basis for the
model;
** the data used and the data sources;
** the auditor's assessment of the reliability of the data used and
procedures performed to establish or increase the amount of
reliability, if applicable;
** the amount of the limit and the criteria for establishing the limit;
** explanations for fluctuations considered significant, sources of
these explanations, and corroborating evidence obtained;
** the additional procedures performed and related conclusions if
misstatements are detected or if the initial procedures are not
considered adequate; and:
** conclusions regarding findings, including proper treatment of any
misstatements detected and assessment of any other effects of these
misstatements.
Interim testing procedures (see section 495 C for documentation
guidance).
Any misstatements detected (which also should be referenced to their
posting on the Summary of Possible Adjustments (see section 540) where
they will be considered further).
[End of section]
495 A - DETERMINING WHETHER SUBSTANTIVE ANALYTICAL PROCEDURES WILL BE
EFFICIENT AND EFFECTIVE:
.01:
The following factors should be considered when determining whether
analytical procedures will be effective and efficient as a substantive
test:
* nature of the account balance, the specific audit objective
(including the assertions being tested), and any identified inherent
or control risks;
* expected availability and reliability of explanations for fluctuations
and related corroborating evidence;
* plausibility and predictability of the relationship;
* availability and reliability of data; and:
* preciseness of the expectation.
NATURE OF THE ACCOUNT BALANCE, THE SPECIFIC AUDIT OBJECTIVE, AND ANY
IDENTIFIED INHERENT OR CONTROL RISKS:
.02:
Analytical procedures are usually more effective for testing net cost
statement amounts than balance sheet amounts. Balance sheet amounts are
more difficult to predict because they are as of a specific point in
time. Additionally, net cost statement amounts generally have
relationships with various types of other data, such as cost of sales
as a percentage of sales, interest expense as a function of the debt
balance and interest rates, or sales revenue as a function of the
number of units shipped and the average sales price. Analytical
procedures are usually less effective for testing amounts that are
subject to management discretion or are unpredictable, such as repairs
or miscellaneous expenses.
.03:
The auditor should consider the specific audit objective, including the
assertions being tested, and any identified inherent and control risks
to determine whether substantive analytical procedures will be
effective and efficient in achieving the audit objective and level of
assurance. The procedures need to be more effective if fraud, inherent,
and control risks have been identified. The auditor can obtain three
levels of substantive assurance from analytical procedures--complete,
partial, or none. The effectiveness and the amount of assurance
provided by an individual procedure are matters of the auditor's
judgment and are difficult to measure.
.04:
As discussed, the auditor may choose to rely completely on analytical
procedures when the level of combined risk has been assessed as high.
In these cases, the analytical procedures should be extremely effective
and persuasive to serve as the sole source of audit evidence for
achieving the audit objective. This level of effectiveness is very
difficult to achieve when combined risk is assessed as high; therefore,
complete reliance on analytical procedures for substantive assurance in
these situations is rare, particularly for balance sheet accounts.
EXPECTED AVAILABILITY AND RELIABILITY OF EXPLANATIONS FOR FLUCTUATIONS
AND RELATED CORROBORATING EVIDENCE:
.05:
Explanations for fluctuations and related, reliable corroborating
evidence may not always be readily available. This audit evidence is
essential to using analytical procedures as a substantive test. The
relative ease of obtaining explanations for significant differences and
relevant, reliable corroborating evidence should be considered when
determining whether analytical procedures will be the most efficient
and effective substantive test.
PLAUSIBILITY AND PREDICTABILITY OF THE RELATIONSHIP:
.06:
Relationships between the amount being tested (the recorded amount) and
other data are an essential component of substantive analytical
procedures. The relationships identified and used for these procedures
should be good indicators of the account balance of the item being
tested. To be considered a good indicator of the recorded balance, the
relationship between the recorded amount and the other data should be
plausible and predictable.
Plausibility:
.07:
If one set of data provides a reasonable basis for predicting another
set of data, the relationship between the two sets of data is
considered to be plausible. As the plausibility of the relationship
increases, so does the effectiveness of analytical procedures as a
substantive test.
.08:
For example, there is a plausible relationship between payroll expense,
the average number of employees, and the average pay rate. This
relationship generally is effective for estimating payroll expense for
salaried employees. Alternatively, there is not usually a plausible
relationship between revenue and interest expense; therefore, this
relationship would not be used for testing.
Predictability:
.09:
The more predictable the relationship is, the more effective the
substantive analytical procedure will be. Relationships are more
predictable in a stable environment. As relationships become more
complex as a result of increases in the number and type of contributing
factors, related amounts become more difficult to effectively and
efficiently predict.
.10:
For example, payroll expense generally is very predictable if there is
little employee turnover during the period, if all employees receive
the same percentage raise at the same time, and if all employees are
salaried. Payroll expense becomes more difficult to predict if any of
these factors changes (e.g., high turnover resulting in a different mix
of employee pay, a wide range of raises awarded at different times, or
a mix of hourly and salaried employees). Therefore, to effectively
estimate payroll expense, the auditor may need to use a more complex
relationship that considers these factors.
.11:
The relationships identified may be between the recorded amount and
either prior-year or current-year data, using financial or nonfinancial
data, including underlying business factors. For example, the auditor
may estimate current-year (1) interest expense using current-year
audited, long-term debt amounts and interest rate information or (2)
sales revenue based on the auditor's estimate of the expected gross
margin percentage applied to the audited cost of sales amounts. When
using current-year relationships, the data used to estimate the
recorded amount must be audited by a method other than a substantive
analytical procedure that uses a relationship with the recorded amount.
.12:
The auditor should exercise caution when using prior-year amounts as
the basis for the expectation of the current-year recorded amount. The
workpapers must document why, in the auditor's judgment, the prior-year
amount, and any adjustments to that amount, have a plausible and
predictable relationship with the current-year recorded amount. Any
adjustments to the prior amount, such as for the effects of inflation,
must be supported by reliable data and must be corroborated.
Additionally, the prior-year amount must meet the criteria discussed
below for reliable data. The easiest way to meet these criteria is if
the prior-year amount is audited.
.13:
As an example of prior-year relationship, assume that the payroll
raises for the year were authorized at 5 percent and that the number
and salary mix of employees have remained relatively stable. In this
example, the auditor might reasonably expect current-year payroll
expense to be 5 percent higher than the prior-year's payroll expense.
However, the auditor would need to test the reliability of the
percentage pay increase and the assumptions regarding the number and
mix of employees.
AVAILABILITY AND RELIABILITY OF DATA:
Availability of Data:
.14:
Data needed to perform analytical procedures as a substantive test may
not always be readily available. The relative ease of obtaining
relevant, reliable data should be considered when determining whether
analytical procedures will be the most efficient and effective
substantive test.
Reliability of Data:
.15:
The reliability of the data used is important in determining the
effectiveness of the substantive analytical procedures. The more
reliable the data are, the more effective these procedures will be as a
substantive test. In assessing the reliability of data, which is a
matter of auditor judgment, the auditor should consider the following:
* the source of the data, including whether the data are audited or
unaudited;
* conditions under which the data were gathered, including related
internal controls; and:
* other knowledge the auditor may have about the data.
Sources of Data:
.16:
Data obtained from an independent source outside the entity are
generally more reliable than data obtained from inside the entity;
however, the auditor should determine if the outside information is
comparable to the item being tested. This issue of comparability is
particularly important if the auditor is using industry statistics.
.17:
Data obtained from entity sources are considered more reliable if the
sources are independent of the accounting function and if the data are
not subject to manipulation by personnel in the accounting function. If
multiple data sources are used, the reliability of all sources should
be considered.
Audited versus unaudited data:
.18:
The auditor should consider whether the data are audited or unaudited
because audited data are considered more reliable than unaudited data.
If data are audited by the entity's IG office, they may be as reliable
as data audited by independent auditors if the IG's work is considered
adequate. (See FAM section 650.):
.19:
Unaudited data are not considered reliable unless procedures are
followed to establish their reliability. These procedures could consist
of either tests of controls over data production or tests of the data.
The extent of such procedures is left to the auditor's judgment. For
example, interest rates from an entity's loan register may be used to
estimate interest income. The reliability of this information may be
established by including the interest rate on loan confirmations that
are sent to the borrowers or by reviewing original loan documents.
Conditions under which the data were gathered:
.20:
Another consideration of internal data is whether the data were
developed under a reliable system with adequate financial reporting or
operations controls. In some instances, testing operations controls may
be appropriate to assess the reliability of the data used for
substantive analytical procedures. The extent of this testing is a
matter of the auditor's judgment.
.21:
If the system used to develop internal data is computerized rather than
manual, the auditor must perform additional procedures before relying
on the data. The auditor must test either (1) the general controls and
the specific application controls over the IS system that generated the
report or (2) the data in the report.
.22:
An auditor might choose to test operations controls when using entity-
prepared statistics for a substantive analytical procedure. For
example, the auditor might choose to use Air Force statistics to test
the reasonableness of its Airlift Services aircraft operating costs.
The auditor might compare the per hour fuel and maintenance costs for
Airlift Services cargo and passenger aircraft with the "block hour"
costs incurred by major airlines for similar aircraft as published by
Aviation Week and Space Technology. The auditor should first determine
if the industry statistics are comparable, e.g., if the statistics are
for the same or similar types of aircraft and if the types of items
included in maintenance costs are similar. If appropriate, the auditor
should identify and test the internal controls over the production of
these operating statistics.
PRECISENESS OF THE EXPECTATION:
.23:
The expectation, the auditor's estimate of the account balance, should
be precise enough to provide the desired level of substantive
assurance. When determining how precise the expectation should be, the
auditor should determine the proper balance between effectiveness and
efficiency. Any work to make the expectation more precise than the
desired level of assurance is unnecessary and inefficient.
.24:
To maximize efficiency, the auditor should conduct procedures at the
minimum level of effort that can reasonably be expected to provide the
assurance needed. If the audit objective cannot be achieved with the
original expectation, the auditor may be able to perform additional
procedures to make the expectation more precise. The preciseness of the
expectation and changes in this preciseness are difficult to measure in
quantifiable terms, unless the auditor uses regression analysis for the
analytical procedures. If the auditor uses regression analysis, he or
she should consult with the Statistician.
.25:
Factors that influence the expectation's preciseness follow:
* The identification and use of key factors when building the model
based on the relationships identified by the auditor: The expectation
generally becomes more precise as additional key factors are
identified.
* The reliability of the data used to develop the expectation: The
expectation becomes more precise as the reliability of the data
increases.
* The degree of disaggregation of the data: The expectation becomes
more precise as the disaggregation of the data increases.
[End of section]
495 B - EXAMPLE PROCEDURES FOR TESTS OF BUDGET INFORMATION:
.01:
This section includes example procedures auditors may perform in
testing budget information for the statements of budgetary resources
and financing.
.02:
In addition, if budget controls are ineffective and quantitative
provisions of budget-related laws and regulations are considered
significant, the auditor should perform audit procedures sufficient to
detect the types of budget information misstatements listed in
paragraph 460.04. Following is an example of procedures for testing
obligation and expended authority transactions for these misstatements.
(Test materiality for determination of sample sizes is discussed in
paragraph 460.03.):
* Validity, cutoff, recording, and classification: Select obligations
recorded as of the end of the audit period and expended authority
transaction recorded during the audit period. Determine if each
selected item is a valid obligation or expended authority transaction
based on the criteria set forth in section 395 F and if each is
recorded in the appropriate period. If the obligation or expended
authority transaction is not recorded or is recorded in the incorrect
period, determine the effects of this misstatement on budget amounts
and consider whether the auditor's evaluation of budget controls is
affected.
Also determine if each selected item is:
** recorded at the proper amount and:
** classified in the proper appropriation or fund account (also by
program and by object, if applicable), including the proper
appropriation year.
* Completeness and cutoff: First, select obligations and expended
authority transactions recorded during the period following the balance
sheet date. Second, examine open purchase orders, unpaid invoices, and
contracts as of the report date. Third, select items representing
payments by Treasury or cash disbursements by the entity during the
audit period. (Substantive detail test selections of expenses and
additions to inventory, property, and prepaid accounts may be used for
this purpose if the populations from which they are selected are
complete.) For each selection, determine whether the obligation or
expended authority transaction is recorded in the proper period. If it
is not recorded or is recorded in the incorrect period, determine the
effects of this misstatement on budget amounts and consider any impact
on the evaluation of budget controls.
If the selected obligation or expended authority transaction relates to
the audit period and is recorded in that period, determine if it is:
** recorded at the proper amount and:
** classified in the proper appropriation or fund account (also by
program and by object, if applicable), including the proper
appropriation year.
* Summarization: Test the footing of the detail of the obligation
account balance recorded as of the end of the audit period and expended
authority accounts recorded during the audit period. Then reconcile the
total of these details to the recorded totals for obligation and
expended authority accounts as of the end of the audit period. (Audit
software is often an effective tool for footing the transactions
recorded in the accounts and for simultaneously selecting items for
this test.):
.03:
The audit procedures discussed above for testing expended authority
transactions should be coordinated with the audit of the other
financial statement amounts. For example, if appropriate, the tests of
accounts payable for completeness may be coordinated with the selection
of subsequent obligations and expended authority transactions described
above.
.04:
Following is an example of procedures for testing outlay transactions.
These audit procedures also should be coordinated with the audit of the
other financial statement amounts, chiefly cash disbursements.
* Validity and classification: Select outlays recorded during the audit
period. Determine if an invoice and receiving report supports each
selected outlay and determine the obligation that was liquidated by the
outlay. Examine the support for the obligation and determine if the
invoice billed for goods or services is related to (or properly
"matches") the obligation (and, in turn, the appropriation). Obtain the
accounting data of the matched obligation to include appropriation and
year. Match these data to the type of services paid for of the selected
outlay. Determine if the related appropriation authorizes payment for
the services billed and paid.
.05:
The auditor also generally should audit upward and downward adjustments
of prior year obligations. If any of these adjustments relate to closed
accounts, the auditor generally should determine whether the
adjustments are in compliance with the requirements of the National
Defense Authorization Act for fiscal year 1991, section 1405(a),
Closing Appropriation Accounts, 31 U.S.C. 1551-1558.
[End of section]
495 C - MISSTATEMENTS IN INTERIM TESTING:
MISSTATEMENTS IN INTERIM BALANCES:
.01:
The auditor should use judgment to determine whether any misstatements
detected in interim tests (see section 295 D for a discussion of
factors to consider in deciding whether to use interim substantive
testing of balance sheet accounts) warrant a revision of (1) the
auditor's combined risk assessment and (2) the nature, timing, and
extent of planned audit procedures. In determining the effects of such
misstatements, the auditor should consider all relevant factors,
including:
* the nature and cause of the misstatement,
* the estimated effects on the overall line item/account balance,
* whether the entity has subsequently corrected the misstatement, and
* the impact of the misstatement on other parts of the audit.
.02:
Any financial statement misstatements detected should be discussed with
entity management. Based on the nature and cause of the misstatements
detected, the auditor should determine, and obtain supporting evidence
on, whether the misstatements are isolated or are likely to occur in
the remainder of the line item/account balance at the interim testing
date and at the year's end. (See paragraph 480.40 for a discussion of
the need to project all misstatements unless evidence is highly
persuasive that a misstatement is isolated and the Audit Director
approves.) The auditor should encourage management to correct any such
misstatements in the population. Based on the following guidance, the
auditor should use judgment to determine the extent, if any, that
interim testing can be relied on, in conjunction with substantive tests
of the rollforward period, to provide evidence on the year-end line
item/account balance:
* If the misstatements are not material when projected to the entire
population and are expected to be representative of the misstatements
of the year-end balance, the auditor may rely on the results of the
interim testing.
* If the auditor has obtained highly persuasive evidence that the
misstatements are isolated (generally by nature, cause, or extent), the
auditor may be able to rely on unaffected parts of the interim testing
and apply procedures at the year's end to test only those financial
statement assertions associated with the misstatements. For example, in
interim testing of inventory, the auditor might determine that the
misstatements concern only the costing of inventory; accordingly,
reliance could be placed on other parts of the interim testing, such as
those for the accuracy of the physical count, and only cost testing and
related procedures would be required at the year's end.
* If the misstatements are material or pervasive, it might be necessary
to place no reliance on the interim testing and to perform extensive
substantive testing of the line item/account balance as of the balance
sheet date.
.03:
For any misstatements found during interim testing, the auditor should
use judgment to evaluate, in a manner appropriate for the
circumstances, the effects on the year-end balance.
TESTING THE ROLLFORWARD PERIOD:
.04:
Because the auditor reports on the financial statements as of the
year's end, not the interim test date, additional procedures must be
performed to extend the interim conclusions to the year's end. The
auditor should perform substantive tests of the rollforward period
activity or the year-end balance. For example, after interim testing of
the accounts receivable balance, the auditor might examine supporting
documents for selected debits and credits to the balance during the
rollforward period and/or might apply analytical procedures to compare
the amount of rollforward activity, on a month-by-month basis, with
that of preceding months or similar periods of preceding years.
.05:
The auditor should determine the extent of the required substantive
procedures based on the assessment of combined risk and test
materiality, in substantially the same manner as for other substantive
tests. In some instances, the auditor may determine that specific
combined risk warrants additional substantive procedures at the year's
end (such as cutoff tests). If control risk is moderate or low, the
auditor should determine whether the internal controls as of the
interim testing date were in place and were functioning effectively
during the rollforward period (generally by reference to the results of
tests of financial reporting controls which generally cover the entire
year under audit for significant systems).
DOCUMENTATION:
.06:
The auditor should document:
* the line items/accounts (and assertions, where applicable) to which
interim testing is applied;
* the factors considered when determining whether to use interim
testing;
* the audit procedures used to test interim balances and the rollforward
period (including tests of controls, findings, and conclusions); and:
* the effects of any misstatements found during interim testing.
The following table illustrates the correlation between combined risk
and the substantive assurance obtained from substantive analytical
procedures and detail test. This example is based on 95 percent audit
assurance.[Footnote 16] The table also provides the statistical risk
factors to be used when the auditor manually computes sample size using
DUS (see paragraph 480.17).
[End of section]
495 D - EXAMPLE OF AUDIT MATRIX WITH STATISTICAL RISK FACTORS:
Figure 495 D.1: Example Audit Matrix:
Assessed combined risk level: Low; Substantive assurance: 63%;
Substantive assurance from analytical procedures[A]: Complete; Minimum
confidence level for detail tests: 0%; Statistical risk factor[B]:
N/A[C]; Substantive assurance from analytical procedures[A]: Partial;
Minimum confidence level for detail tests: 50%; Statistical risk
factor[B]: 0.7; Substantive assurance from analytical
procedures[A]: None; Minimum confidence level for detail tests:
63%; Statistical risk factor[B]: 1.0.
Assessed combined risk level: Moderate; Substantive assurance: 86%;
Substantive assurance from analytical procedures[A]: Complete; Minimum
confidence level for detail tests: 0%; Statistical risk factor[B]:
N/A; Substantive assurance from analytical procedures[A]: Partial;
Minimum confidence level for detail tests: 77%; Statistical risk
factor[B]: 1.5; Substantive assurance from analytical
procedures[A]: None; Minimum confidence level for detail tests:
86%; Statistical risk factor[B]: 2.0.
Assessed combined risk level: High; Substantive assurance: 95%;
Substantive assurance from analytical procedures[A]: Complete; Minimum
confidence level for detail tests: 0%; Statistical risk factor[B]:
N/A; Substantive assurance from analytical procedures[A]: Partial;
Minimum confidence level for detail tests: 92%; Statistical risk
factor[B]: 2.5; Substantive assurance from analytical procedures[A]:
None; Minimum confidence level for detail tests: 95%; Statistical risk
factor[B]: 3.0.
[A] Complete assurance from analytical procedures requires procedures
that are extremely effective and persuasive to serve as the sole source
of audit evidence for achieving the audit objective. This level of
effectiveness or persuasiveness is very difficult to achieve when
combined risk is assessed as high. Therefore, complete reliance on
analytical procedures for substantive assurance in these situations is
rare, particularly for balance sheet accounts.
[B] Based on the Poisson distribution; used if sample size computed
manually.
[C] Not applicable.
[End of table]
[End of section]
495 E - SAMPLING:
SAMPLING FLOWCHARTS AND EXAMPLE WORKPAPERS:
.01:
This section contains sampling flowcharts (pages 495 E-2 through 495 E-
6) and example workpapers for sampling (pages 495 E-7 through 495 E-
19).
.02:
Flowchart 1 (page 495 E-2) is to assist the auditor in deciding
selection method: nonrepresentative selections versus sampling
(statistical or nonstatistical). Flowchart 2 (page 495 E-3) is to help
the auditor determine which type of sampling to use in various
situations. The second, third, and fourth pages of this flowchart are
to assist the auditor in performing attribute, dollar unit, and
classical variables estimation sampling.
.03:
Example workpapers for documenting sampling are given for attribute
sampling (pages 495 E-7 through 495 E-10), for dollar unit sampling
(pages 495 E-11 through 495 E-15), and for classical variables sampling
(pages 495 E-16 through 495 E-19).
[See PDF for images]
[End of figures]
[End of section]
495 F - MANUALLY SELECTING A DOLLAR UNIT SAMPLE:
.01:
Even though auditors usually use software (such as IDEA) to select a
dollar-unit sample, it is helpful to understand the process for
manually selecting a dollar-unit sample. To select a dollar-unit sample
manually, the following steps should be performed:
a. Determine the sampling interval using the following formula:
sampling interval = test materiality  statistical risk factor:
b. Clear the calculator:
c. Select and document a random start and enter as a negative number in
the calculator. The random start should be a number between 1 and the
sampling interval.
d. Enter the positive amounts in the test population (items) until the
calculator's running subtotal becomes positive. The item that caused
the subtotal to become positive is the item selected for testing.
[See page 495 F-3. Note that the calculator subtotals were positive for
invoices #3, 10, 17, 19, and 24.]
Do not enter into the calculator any items in the population with zero
or credit balances. These items should be accumulated separately and
tested in conjunction with tests of completeness of the account balance
or class of transactions if they are expected to be significant.
e. After each selection, subtract the sampling interval until the
subtotal is negative. Even if the last item in the population is
selected, the sampling interval should be subtracted until the
subtotal is negative.
[See page 495 F-3. For invoice #19, the auditor had to subtract the
sampling interval twice to get a negative subtotal.]
f. Repeat steps d. and e. until all items in the test population have
been entered into the calculator and the ending subtotal is negative.
g. To test the footing of the population, reconcile the sample to the
recorded amount of the test population as follows:
Add:
(a) Random start:
(b) Sampling interval multiplied by the number of times the sampling
interval was subtracted during selection of the sample:
(c) The remaining subtotal on the calculator.
The total should equal the test population amount.
If the total on the reconciliation is not equal to the population
amount, there is either an error in the total population amount or
there was an error in entering the population items into the adding
machine.
The auditor should consider the amount of any difference when
determining whether investigation of the difference is necessary.
Immaterial amounts generally do not require investigation.
[See page 495 F-4 for an example reconciliation to test the footing.]
[PAGE 495 F-3]: Example of Systematic Selection for DUS:
[See PDF for image]
[End of table]
PAGE 495 F-4:
Reconciliation of book amounts footed to test population:
Random start: $6,000:
+ Sampling interval x number of times subtracted: 300,000:
($50,000 x 6):
+ Remaining subtotal: (14,400):
Population total: $291,600:
[End of section]
FOOTNOTES
[1] The FAM generally uses the same terminology as the Audit Guide.
[2] Many factors influence efficiency in addition to number of sampling
applications, such as sample size, number of locations it is necessary
to visit to achieve audit objectives, nature of the audit procedures,
extent of review required, whether rework can be avoided by designing
easy-to-follow procedures.
[3] Tables I and II assume a large population (generally over 5,000
items). If the population is small, the auditor may ask the
Statistician to calculate a reduced sample size and to evaluate the
results. Generally, the effect is small unless the sample size per the
table is more than 10 percent of the population.
[4] Using the AICPA guidance, the auditor computes the deviation rate
and the upper limit at the desired confidence level (usually the same
confidence level used to determine sample size). If the upper limit of
deviations is less than the tolerable rate, the results support the
control risk assessment. If not, the control risk should be increased
in designing substantive tests.
[5] Tolerable rate of 5 percent, expected population deviation rate of
0, and a large population (see footnote on page 450-3). If the
population is small, the auditor may ask the Statistician to compute a
reduced sample size and to evaluate the results.
[6] The proprietary accounting system supports the accrual basis of
accounting.
[7] If the data are disaggregated, the limit is still applied on an
annual basis.
[8] IDEA is the primary software GAO uses. It is distributed by
Audimation Services, Inc., Houston, Texas.
[9] Usually the auditor applying nonstatistical sampling will select a
"haphazard sample." A haphazard sample is a sample consisting of
sampling units selected without conscious bias, that is, without any
special reason for including or excluding items from the sample. It
does not consist of sampling units selected in a careless manner;
rather it is selected in a way the auditor expects to be representative
of the population.
Since a haphazard sample is not the same as a statistical sample, the
auditor using a haphazard sample cannot calculate precision at a given
confidence level. However, AICPA guidance indicates that the auditor
may use the haphazard sample to make a judgment of what a statistical
sample might have shown. For example, he or she might use the haphazard
sample to make a judgment as to the likely misstatement in areas that
are not very significant. Even though the judgment will not be a
statistical projection, it may assist the auditor in determining
whether the possible misstatement could be material. Thus, the auditor
should not avoid making the judgment.
Professional standards and the FAM do not use the term "judgment
sample." All selections (including statistical selections) require
judgment. The term "judgment sample" is often used to refer to
nonrepresentative selections, although it sometimes refers to
nonstatistical samples.
[10] See Dollar Unit Sampling, by Leslie, Teitlebaum, and Anderson
(Copp Clark Pitman, 1979), for a more technical discussion of DUS.
[11] This expectation affects the efficiency of the sample, not its
effectiveness. GAO auditors who use IDEA to calculate sample size
(based on the binomial distribution) generally use classical variables
estimation sampling when they expect that more than 30 percent of the
sampling units contain misstatements (no matter what the size of the
misstatement). When GAO auditors expect that 10 percent or fewer of the
sampling units contain misstatements, GAO auditors generally use
dollar-unit sampling. When GAO auditors expect between 10 and 30
percent of the sampling units contain misstatements, GAO auditors
consult with the Statistician. If a large misstatement rate is found,
the auditor, in consultation with the Statistician, should consider
whether to use classical PPS to evaluate the sample to obtain a smaller
precision. Other auditors, in consultation with their Statisticians,
may use different rules of thumb in deciding when to use DUS versus
classical variables estimation sampling.
[12] This means, for example, that an item that has a selected amount
of $1,000 cannot be misstated by more than $1,000. This is usually not
an issue in testing existence or valuation (overstatement). However, it
might be an issue in testing completeness (understatement). Thus, if
understatements larger than the selected amount are expected, classical
variables estimation sampling generally should be used.
[13] IDEA offers two methods of selecting a dollar-unit sample. The
auditor generally should use the cell method rather than the fixed
interval method. In the cell method, the program divides the population
into cells such that each cell is equal in size to an interval. Then
the program selects a random dollar in each cell. The random dollar
selected identifies the transaction, account, or line item to be tested
(sometimes called the logical unit).
[14] The 25 percent is a rough estimate that is used because there is
no way to calculate the correct sample size.
[15] As a general rule, this means 10 misstatements if the sample size
is between 75 and 100, 10 percent if the sample size is between 100 and
300, and 30 if the sample size is over 300. Minimum sample size for
classical PPS is 75.
[16] Audit assurance is not the same as statistical confidence level.
Assurance is a combination of quantitative measurement and auditor
judgment.
[End of section]