Tests of control and substantive procedures

1 Introduction

The previous chapter introduced both the following diagram of the audit process and the components of audit risk:

and the audit risk model:

We now bring these concepts together to determine the audit approach.

2 General audit approaches

As shown by the diagram, there are only two general approaches to the auditor’s response to assessed risks:

• Either to use substantive procedures only (‘substantive approach’) – right side of diagram
  

• Or use tests of controls and substantive procedures (‘combined approach’) – left side of diagram
  

As explained in the next section, using tests of controls alone is not an audit approach.

Where it is possible to use tests of controls (ie controls are effective), the combined approach will usually be more efficient than the substantive approach. This is because, in the combined approach, substantive procedures will be reduced.

Tests of controls and substantive procedures are collectively referred to as ‘further audit procedures’ (i.e. the procedures to obtain audit evidence after performing the risk assessment procedures).

Test of controls – these provide indirect evidence about the accuracy/completeness, etc of transactions (and hence balances) because they are just that – a test of control – was the control applied – yes or no? Substantive procedures (which include substantive analytical procedures and tests of details) provide direct evidence about the accuracy/completeness etc of transactions and balances because they are concerned with monetary amounts

3 Further audit procedures

3.1 Tests of controls

If the internal control system of the company is good, then the control risk is low and this will result in a low audit risk – provided the controls are effective.

Consider for example the control that all purchases are authorised before an order is placed with a supplier. This should apply to all purchases regardless of the monetary amounts involved. The test of the control will not distinguish between a purchase order for $500 of goods and a purchase order for $50,000 of goods.

This is why it is not possible to use tests of controls alone - some substantive procedures must always be performed to obtain audit evidence about monetary amounts.

As another example, if an internal control is that all overtime claims have to be authorised by a supervisor, then the auditor would choose a sample of the claims to inspect them for the supervisor’s signature. As part of this test, the auditor is not really concerned with the amount of overtime: if the supervisor has been doing his job properly, the overtime payments will have been approved.

3.2 Substantive procedures

Substantive procedures are designed to detect material misstatements in the financial statements. They are therefore concerned with the monetary amounts of transactions (in the statement of profit or loss) and balances (in the statement of financial position).

There are two types of substantive procedure:

• Substantive analytical procedures
  

• Tests of details
  

So, using the overtime example, what procedures may be used to determine whether the overtime cost is correct?

Analytical procedures were introduced in the previous chapter as an essential risk assessment procedure carried out at the planning stage. In contrast, substantive analytical procedures will only be carried out when it is more effective than using tests of details alone. This will usually be the case for large volumes of transactions that tend to be predictable over time. So, for example:

• Comparing the total cost of overtime to the previous year and/or budgeted cost
  

• A month-by-month comparison of the cost of overtime and investigation of very high or low amounts
  

• Comparing actual overtime payments against predictions based on production volume
  

• Analysing overtime payments amongst staff in the same department to see if anyone appears to be consistently paid large amounts.
  

Tests of details

• Agree a sample of overtime hours claimed to work records.
  

• Recalculate a sample of overtime payments (number of hours x hourly overtime rate).
  

3.3 Internal controls not operating effectively

Sometimes the auditor will start the audit on the assumption that there is a good internal control system, but then discover that the controls are not operating effectively.

In such a case the auditor will have to change from the combined approach to the substantive approach – in the areas where internal control is not effective.

A management letter (see Chapter 11) will be sent by the auditors to management explaining:

• The internal control deficiencies.
  

• The possible consequences
  

• How the deficiencies can be fixed.

3.4 Reduced substantive procedures

Even where companies have very good systems of internal control, the auditor cannot obtain sufficient evidence to form an audit opinion through tests of internal controls alone. Even though the extent of substantive procedures necessary will be reduced - the need for substantive procedures cannot be eliminated altogether.

However 'good' or 'sound' a system of controls appears to be - it cannot be infallible. Controls can only reduce, but not eliminate, risks of material misstatement due to inherent limitations:

Human error   human error may lead to breakdowns in internal control. For example, in the design of computer processing controls.

Failure to understand or take action   there may be ineffective controls because individuals may not understand the purpose of a specific control. For example, the purpose of a payroll exception report.

Inappropriate management override   management may purposefully override existing controls. For example, a sales director may choose to opt to extend credit to a long-standing customer in order to create customer goodwill, in contravention of laid down credit control procedures.

Collusion by two or more people   cooperation to circumvent controls. For example, between a factory employee, factory manager and a wages data processing clerk to claim, authorise and process a fraudulent payment for overtime wages.

Cost benefit consideration   For example, the cost of employing additional accounts staff to ensure adequate segregation of duties may outweigh the maximum benefit to be derived from improved internal control.

Non-routine transactions   relatively rare transactions may fall outside routine control procedures (which may be highly automated). For example, the disposal of factory plant and equipment.

3.5 Audit efficiency

If there is a good internal control system, and this is verified by testing the operation and effectiveness of the controls, the auditor will assess control risk as low. This will result in a very efficient audit because relatively few instances of the control operating have to be tested: maybe 30, 60 or 100 (but typically not more than 100).

Therefore in a multi-million $ enterprise with thousands of invoices being processed daily, the auditor can collect sufficient appropriate audit evidence that, for example, an invoice cannot be paid twice, by inspecting relatively few paid invoices to make sure that they have been marked as paid in some way (eg stamped 'Paid'). Marking the invoices ‘Paid’ is part of the internal control system and if all invoices inspected have been properly stamped 'Paid' the auditor will have evidence that the control is operating correctly. This is obviously a very efficient audit approach. It’s not foolproof, of course, as there could be invoices that were not marked 'paid' but not in the sample selected. This 'sampling risk' is considered later in Chapter 7.

If the internal control system had originally been judged to be poor, the substantive approach will be the most efficient, even though this may require more audit effort than if the controls had been effective. What would be inefficient, would be to start taking the combined approach and then having to switch to the substantive approach (eg due to insufficient understanding in planning the audit).

Even if there appear to be good controls, the auditor may take the substantive rather than combined approach because it is the more efficient. For example, auditors may decide that 100% testing is appropriate where there are a small number of high value items that make up a population. An example would be a property development company that has only 20 purchase/sale transactions in the year. Each transaction is likely to be material and there is no gain in efficiency or audit effectiveness by not looking at all 20.