Document ID: chunk:federal_register_of_legislation:F2021C01250:reg:27:p12
Version: federal_register_of_legislation:F2021C01250
Segment Type: reg
Provision Reference: reg 27 (pt 12/23)
Character Range: 41190–44236

controls.  However, the same types of audit procedures are used.  The auditor may, therefore, decide it is efficient to test the operating effectiveness of controls at the same time as evaluating their design and determining that they have been implemented.

A22.         Further, although some risk assessment procedures may not have been specifically designed as tests of controls, they may nevertheless provide audit evidence about the operating effectiveness of the controls and, consequently, serve as tests of controls.  For example, the auditor's risk assessment procedures may have included:

           * Enquiring about management's use of budgets.

           * Observing management's comparison of monthly budgeted and actual expenses.

           * Inspecting reports pertaining to the investigation of variances between budgeted and actual amounts.

    These audit procedures provide knowledge about the design of the entity's budgeting policies and whether they have been implemented, but may also provide audit evidence about the effectiveness of the operation of budgeting policies in preventing or detecting material misstatements in the classification of expenses.

A23.         In addition, the auditor may design a test of controls to be performed concurrently with a test of details on the same transaction.  Although the purpose of a test of controls is different from the purpose of a test of details, both may be accomplished concurrently by performing a test of controls and a test of details on the same transaction, also known as a dual-purpose test.  For example, the auditor may design, and evaluate the results of, a test to examine an invoice to determine whether it has been approved and to provide substantive audit evidence of a transaction.  A dual-purpose test is designed and evaluated by considering each purpose of the test separately.

A24.         In some cases, as discussed in ASA 315, the auditor may find it impossible to design effective substantive procedures that by themselves provide sufficient appropriate audit evidence at the assertion level.[4]  This may occur when an entity conducts its business using IT and no documentation of transactions is produced or maintained, other than through the IT system.  In such cases, paragraph 8(b) requires the auditor to perform tests of controls that address the risk for which substantive procedures alone cannot provide sufficient appropriate audit evidence.

Audit Evidence and Intended Reliance (Ref: Para. 9)

A25.         A higher level of assurance may be sought about the operating effectiveness of controls when the approach adopted consists primarily of tests of controls, in particular where it is not possible or practicable to obtain sufficient appropriate audit evidence only from substantive procedures.

Nature and Extent of Tests of Controls

Other audit procedures in combination with enquiry (Ref: Para. 10(a))

A26.         Enquiry alone is not sufficient to test the operating effectiveness of controls.  Accordingly, other audit