Introduction: Welcome to the World of Testing!
Hello there! So far in your Audit and Assurance (AA) journey, you’ve learned that companies set up internal controls (like locks on doors or passwords on computers) to keep things running smoothly and prevent errors. But as an auditor, you can’t just take the client’s word for it when they say, "Our system is perfect!"
Think of it like this: If a friend tells you they are a great cook, you might believe them. But you won’t know for sure until you watch them cook or taste the food. In auditing, Tests of Controls (ToC) are how we "taste the food." We are checking to see if the controls the company promised are actually working in real life.
Don't worry if this seems a bit technical at first. We’re going to break it down step-by-step so you can master this vital part of the exam!
1. What Exactly are Tests of Controls?
Tests of Controls are audit procedures designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level.
In simpler terms: We are checking if the control "does what it says on the tin" consistently throughout the year.
The Difference Between Design and Operation
Before we test if a control works, we usually check two things:
1. Design: Is the control capable of stopping an error? (e.g., Is there a lock on the door?)
2. Implementation/Operation: Is the control actually being used? (e.g., Is the door actually locked every night?)
Quick Review: We only perform Tests of Controls if we think the controls are strong enough to rely on. If the controls are rubbish (weak), we don't bother testing them—we just do more "substantive" testing (checking the actual numbers) instead!
2. Why Do We Do Tests of Controls?
Auditors aren't just being nosy. We test controls for a very specific reason related to Audit Risk. If we find that a company has "Effective Internal Controls," we can reduce our Control Risk.
The Logic Chain:
Strong Controls discovered via ToC → Lower Control Risk → Less Substantive Testing needed.
Weak Controls discovered via ToC → Higher Control Risk → More Substantive Testing needed.
Analogy: If you know a student is very studious and does all their homework (strong internal control), you might only need to check every fifth answer to trust their work. If a student is messy and skips class (weak control), you’ll probably want to check every single answer they write!
3. How Do We Test? (The "Methods")
To remember the methods of obtaining evidence for tests of controls, you can use the mnemonic I-O-R-E (pronounced like "Eeyore" from Winnie the Pooh, but with an 'I'!):
1. Inspection: Examining documents or reports to see if they have been signed, stamped, or matched.
Example: Looking at a purchase invoice to see if a manager has signed it to authorize payment.
2. Observation: Watching a process or procedure being performed by the client's staff.
Example: Watching the warehouse staff count inventory to make sure they follow the instructions.
3. Re-performance: The auditor independently executes the control that was originally performed by the company.
Example: Re-performing a bank reconciliation to see if you get the same result as the client.
4. Enquiry: Asking the staff questions about how they perform their jobs.
Note: Enquiry alone is never enough to support a conclusion on the effectiveness of a control. You must combine it with other methods!
Did you know? Observation is considered one of the weaker forms of evidence because people often behave much better when they know an auditor is watching them! This is sometimes called the "Hawthorne Effect."
4. Common Tests of Controls (By Cycle)
In the AA exam, you will often be asked to suggest a Test of Control for a specific business cycle. Here are some classic examples:
The Sales Cycle
The Control: New customers must have a credit limit approved by the Credit Manager.
The Test of Control: Inspect a sample of new customer files for a signature from the Credit Manager authorizing the credit limit.
The Purchase Cycle
The Control: Purchase orders should only be created if there is a valid requisition form.
The Test of Control: Select a sample of purchase orders and Inspect the related requisition form to ensure they match and are properly authorized.
The Payroll Cycle
The Control: The payroll summary is reviewed and authorized by a senior director before payments are made.
The Test of Control: Inspect the payroll summary sheets for the director’s signature of approval.
Key Takeaway: When writing a Test of Control in the exam, always start with a verb (Inspect, Observe, Re-perform) and explain exactly what you are looking for (e.g., "to ensure the signature is present").
5. When Controls Fail (Deviations)
Sometimes, we test 20 items and find that in 2 cases, the control wasn't followed. This is called a deviation.
If we find deviations, we shouldn't immediately panic. We need to:
1. Understand why it happened (was it a one-off human error?).
2. Determine if we need to do more testing.
3. Decide if we need to increase our substantive procedures because we can no longer rely on that control.
6. Summary and Quick Review
Quick Review Box:
- Purpose: Check if controls are operating effectively.
- Timing: Usually done during the interim audit.
- Methods: Inspection, Observation, Re-performance, and Enquiry (I-O-R-E).
- Result: If successful, it allows the auditor to perform less substantive testing.
Common Mistake to Avoid: Don't confuse a "Test of Control" with a "Substantive Procedure."
- Test of Control: Checking the process (Did they sign the invoice?).
- Substantive Procedure: Checking the number (Is the $5,000 on the invoice correct?).
You're doing great! Internal controls can feel a bit "dry," but once you realize it's just a game of "Checking the Checker," it becomes much more manageable. Keep practicing those exam questions!