-->
Home » » Test of Control: How?

Test of Control: How?

Written By YCS on Thursday, November 26, 2015 | 4:41 PM

Continuing our previous posting, “assessing the adequacy of internal control”, in this posting we will try to share how to assess the functioning of internal control (test of
control), including a simple example. In the actual practice, the process of assessment on controls is not easy, complex, and require a lot of professional judgement and of works. These complexity makes our colleagues have a difficulty to understand and to perform test of control.
So we try to explain the assessment process in a very simple way. We believe that this process is good for unexperienced auditors to practice how to assess the functioning of internal control.
To simplify our discussion, we will skip some of the processes. Example: we will skip the procedures for assessing whether:
  • the control is designed to mitigate the identified significance risk,
  • there are compensating controls in the absence of key controls.
For our illustration, we will use attribute testing approach, which can be used in either statistical or judgemental method and widely used in assessing control. Attribute testing approach is also applicable for assessing the internal control over financial reporting (ICoFR).
By definition, attribute is the characteristic being tested for in the population. Attributes of interest and exception conditions for audit sampling are taken directly from the auditor’s audit procedures. It means, what attributes should be exist in our sampling, and whether there are exceptions in the sampling, are resulted from the the design and the implementation of our audit procedures.
This an example of attributes of voucher, if one or more attributes is (are) not exist than there is (are) exceptions:

CASE:
To conclude the functioning of internal control, we should take the following step (note: simplified):
Client: PT DEWA ARJUNA    Year-end: 12/31/14
Audit Area: Test of controls and substantive test of transactions – billing functions:    Pop-size: 5.764
  1. Define the objectives:
    Example: to test the operating effectiveness of controls, related to sales process.
  2. Define the population precisely (including stratification, if any).
    Example: sales invoices for the period 1/1/14 to 10/31/14. First invoice number 3689 and last invoice number: 9452, so population size is 5.764 invoices.
  3. Define the sampling unit, organization of population items, and random selection procedures.
    Example: sales invoice number: recorded in the sales journal sequentially, computer generation of random numbers. 
  4. Specify the tolerable exception rate (TER).
    TER = the highest exception rate the auditor will permit in the control being tested and still be willing to conclude the control is operating effectively. Example, TER = 9%, means that even if 9% of the duplicate sales invoices are not approved for credit, the credit approval control is still effective.
    Lower TER = larger sample size. Example, a larger sample size is needed for the test of credit approval if the TER is decreased from 9% to 6%. 
  5. Specify acceptable risk of assessing control risk too low (ARACR).
    Auditors using attributes sampling assign a specific amount, such as 10% or 5% risk.
    ARACR = the risk the auditor is wrong for concluding that a control is effective. For statistical sampling, it is common to use a percent, such as 5% or 10%. A low ARACR = the tests of controls are important and will correspond to a low assessed control risk and reduced substantive tests of details of balances. A larger sample size is required to lower this risk.
  6. Estimate the population exception rate (EPER). 
    Auditors often use the preceding year’s audit results to estimate EPER. If prior-year results are not available, the auditor can take a small preliminary sample of the current year’s population for this purpose.
  7. Determine the initial sample size.
    Four factors determine the initial sample size: population size, TER, ARACR, and EPER. In attributes sampling, auditors determine sample size by using computer programs or tables developed from statistical formulas. 
  8. Develop audit procedure
  9. Procedure audit for test of control, related to billing of customer and recording the sales in the records:
    • Accounts for a sequence of sales invoices in the sales journal.
    • Trace selected sales invoices numbers from the sales journal to:
      • Accounts receivable master file and test for amount, date, and invoice number.
      • Duplicate sales invoice and check for the total amount recorded in the journal, date, customer name, and account classification. Check the pricing, extensions, and footings. Examine underlying documents for indication of internal verification.
      • Bill of lading and test for customer name, product, description, quantity, and date.
      • Duplicate sales order and test for customer name, product description, quantity, date and indication of internal verification.
      • Customer order and test for customer name, product description, quantity, date, and credit approval.
  10. By skipping the detail process how to calculate EPER, TER, ARACR, and initial sample, then we can summarize the above steps, as follows.
  11. Attribute No Description of Attributes Planned Audit Exception Conditions
    Attribute No Description of Attributes EPER (%) TER (%) ARACR (%) Initial sample size (IS) Exception Conditions
    1 Existence of the sales invoice number in the sales journal (completeness) 0 4.0 5 74 No record of sales invoice number in the sales journal
    2 Amount and other data in the master file agree with sales journal entry (posting and summarization) 1 5.0 5 93 The amount recorded in the master file differs from the amount recorded in the sales journal
    3 Amount and other data on the sales invoice agree with the sales journal entry (posting and summarization) 1 5.0 5 93 Customer name and account number on the invoice differ from the information recorded in the sales journal
    4 Evidence that pricing, extensions, and footing are cheked (initials and correct amounts) (accuracy) 1 5.0 5 93 Lack of initials indicating verifikation of pricing, extensions, and footings
    5 Quantity and other data on the customer order agree with the sales invoice (occurance) 1.5 9.0 5 51 Quantity on the sales order differs from the quantity on the duplicate sales invoice
    6 Credit is approved (occurance, valuation) 1.5 9.0 5 51 Lack of initials indicating credit approval
    For example: for testing attribute 1, base on statistic table, with EPER = 0%, TER = 4%, and ARACR = 5%, then initial sample size would be 74 invoice.
  12. Using an approptiate sampling method (example random or purposive), and base on sampling size determined eralier, then we take sampling data from avalaible population. For attribute 1, we take 74 invoices as our sampling.
  13. Then, we conduct our audit procedures. For example: invoice no. 3787, after perfor audit procedures on invoice no.3787, we found that, all attributes are exist, except for attribute no.4 and no.6.
    No Identity of item selected Test of Control on Attributes
    No Identity of item selected 1 2 3 4 = 1 exception 5 6 = 1 exception
    1 3787 Invoice number is EXIST in journal Data in master file AGREE with journal Data in invoice AGREE with journal Pricing, extensions, and footing are NOT cheked Data on customer order AGREE with invoice Credit is NOT approved
    After testing all sampling invoices, then we get the result as follows:
    No Identity of item selected Attributes
    X = exception
    No Identity of item selected 1 2 3 4 5 6 ...
    1 3787 OK OK OK X OK X OK
    2 3924 OK OK OK OK OK OK OK
    3 3990 OK OK OK X OK X OK
    4 4058 OK OK OK OK OK OK OK
    5 4117 OK OK OK OK OK OK OK
    6 4222 OK OK OK X OK X OK
    7 4488 OK OK OK OK OK OK OK
    8 4635 OK OK OK OK OK OK OK
    9 4955 OK OK OK X OK X OK
    10 4969 OK OK OK X OK X OK
    11 5101 OK OK OK X OK X OK
    12 5166 OK OK OK OK OK OK OK
    13 5419 OK OK OK OK OK OK OK
    14 5832 OK OK OK OK OK X OK
    15 5890 OK OK OK OK OK OK OK
    16 6157 OK OK OK OK OK OK OK
    17 6229 OK X OK X OK X OK
    18 6376 OK OK OK OK OK X OK
    19 6635 OK OK OK X OK X OK
    20 7127 OK OK OK OK OK OK OK
    21 8338 OK OK OK OK OK OK OK
    22 8871 OK X OK X OK X OK
    23 9174 OK OK OK OK OK OK OK
    ... 9371 OK OK OK X OK X OK
    ... Number of exceptions 0 2 0 10 0 12 0
    ... Sample size 75 100 100 100 50 50 ...
  14. Calculate CUER
    From the result of the test, then we can determine CUER for each attribute. CUER is calculated from statistic table, by looking number of exception founds and number of sampel, with ARACR 5%.
    The CUER can be shown as follows:
  15. Attribute No Description of Attributes Planned Audit Actual Results
    Attribute No Description of Attributes EPER (%) TER (%) ARACR (%) Initial sample size (IS) Actual sample size (AS) Number of except ion Sample except ion rate (SER) CUER
    1 Existence of the sales invoice number in the sales journal (completeness) 0 4.0 5 74 75 0 0 4.0
    2 Amount and other data in the master file agree with sales journal entry (posting and summarization) 1 5.0 5 93 100 2 2 6.2
    3 Amount and other data on the duplicate sales invoice agree with the sales journal entry (posting and summarization) 1 5.0 5 93 100 0 0 3.0
    4 Evidence that pricing, extensions, and footing are cheked (initials and correct amounts) (accuracy) 1 5.0 5 93 100 10 10 16.4
    5 Quantity and other data on the customer order agree with the duplicate sales invoice (occurance) 1.5 9.0 5 51 50 0 0 5.9
    6 Credit is approved (occurance) 1.5 9.0 5 51 50 12 24 > 20

  16. Use of sampling result
    • As we can see from the above table, attributes 1, 3, dan 5 has CUER < TER, and attributes 2, 4, and 6 has CUER > TER.
    • Effect on audit plan: controls tested through attributes 1, 3, and 5 can be viewed as operating effectively, given that TER equals or exceed CUER. Additional emphasis is needed in confirmation, allowance for uncollectibne accounts, cutoff tests, and price test for the financial statement audit due to results of tests attributes 2, 4, and 6.
    • Effect on Report on Internal Control: CUER exceeds TER for attributes 2, 4, and 6 These findings should be communicated to management to allow an opportunity for correction of the control deficiency to made before year-end. If timely correction is made by management, the corrected controls will be tested before year-end for purpose of reporting on internal control over financial reporting.
    • The overall result of test of control will effect the auditor conlusion on the adequacy and the effectiveness/function of internal control over financial reporting.
    • Recommendations to Management: each of exceptions should be discussed with management. Specific recommendations are needed to correct the internal verification of sales invoice to improve the approach to credit approvals.
Share this article :

4 comments:

  1. how can i calculate a 15% aracr?

    ReplyDelete
  2. Thanks for visiting. As definition of ARACR = a risk the auditor is wrong for concluding that a control is effective, so ARACR is determined using professional judgment. Usually, auditors use ARACR = 5% or 10%.

    ReplyDelete
  3. How can i obtain de 10% or 5% aracr table?

    ReplyDelete

Total Pageviews

  • Posts
  • Comments
  • Pageviews



 
Support : IIA Website | CPA Room | Your Link
Copyright © 2015. Internal Auditor's Corner - All Rights Reserved
Template Created by Creating Website Modified by CaraGampang.Com
Proudly powered by Blogger