Document ID: chunk:federal_register_of_legislation:F2021C01250:reg:27:p13
Version: federal_register_of_legislation:F2021C01250
Segment Type: reg
Provision Reference: reg 27 (pt 13/23)
Character Range: 43944–46931

appropriate audit evidence only from substantive procedures.

Nature and Extent of Tests of Controls

Other audit procedures in combination with enquiry (Ref: Para. 10(a))

A26.         Enquiry alone is not sufficient to test the operating effectiveness of controls.  Accordingly, other audit procedures are performed in combination with enquiry.  In this regard, enquiry combined with inspection or re-performance may provide more assurance than enquiry and observation, since an observation is pertinent only at the point in time at which it is made.

A27.         The nature of the particular control influences the type of procedure required to obtain audit evidence about whether the control was operating effectively.  For example, if operating effectiveness is evidenced by documentation, the auditor may decide to inspect it to obtain audit evidence about operating effectiveness.  For other controls, however, documentation may not be available or relevant.  For example, documentation of operation may not exist for some factors in the control environment, such as assignment of authority and responsibility, or for some types of controls, such as automated controls.  In such circumstances, audit evidence about operating effectiveness may be obtained through enquiry in combination with other audit procedures such as observation or the use of CAATs.

Extent of tests of controls

A28.         When more persuasive audit evidence is needed regarding the effectiveness of a control, it may be appropriate to increase the extent of testing of the control.  As well as the degree of reliance on controls, matters the auditor may consider in determining the extent of tests of controls include the following:

           * The frequency of the performance of the control by the entity during the period.

           * The length of time during the audit period that the auditor is relying on the operating effectiveness of the control.

           * The expected rate of deviation from a control.

           * The relevance and reliability of the audit evidence to be obtained regarding the operating effectiveness of the control at the assertion level.

           * The extent to which audit evidence is obtained from tests of other controls related to the assertion.

    ASA 530[5] contains further guidance on the extent of testing.

A29.         Because of the inherent consistency of IT processing, it may not be necessary to increase the extent of testing of an automated control.  An automated control can be expected to function consistently unless the IT application (including the tables, files, or other permanent data used by the IT application) is changed.  Once the auditor determines that an automated control is functioning as intended (which could be done at the time the control is initially implemented or at some other date), the auditor may consider performing tests to determine that the control continues to function effectively.  Such tests may include