Assessing control risk: maximum unless you test

In this lesson you will

Assess control risk in line with AU-C 315.38.
Determine when tests of controls are required under AU-C 330.08.
Explain the difference between design and implementation work and operating effectiveness testing.

The rule

AU-C 315.38 requires you to assess control risk for each assertion-level risk based on your understanding of controls and your plan to test their operating effectiveness. If you do not plan to test operating effectiveness, you assess control risk at the maximum, so that the risk of material misstatement equals inherent risk.

AU-C 315.A257 confirms: assessing control risk below maximum contemplates reliance on controls, and tests of operating effectiveness are required to support it.

SAS 145 made this explicit, which ends the practice of assessing control risk at "moderate" because a walkthrough looked good. A walkthrough supports design and implementation. It does not show the control worked all year.

Design and implementation versus operating effectiveness

Work	What it shows	Supports control risk below maximum?
Design and implementation (AU-C 315.30)	The control is capable of addressing the risk and exists	No
Operating effectiveness (AU-C 330.08-.17)	The control operated consistently throughout the period	Yes

You evaluate design and implementation for identified controls whether or not you plan to rely on them. Operating effectiveness testing is a choice in most areas, and a requirement in two.

When tests of controls are required

AU-C 330.08 requires tests of operating effectiveness when:

(a) your assessment includes an expectation that controls are operating effectively, meaning you plan to rely on them to reduce substantive work; or
(b) substantive procedures alone cannot provide sufficient appropriate evidence at the assertion level.

AU-C 315.37 requires you to determine whether case (b) applies to any risk. It comes up with high-volume automated processing where no paper trail exists outside the system, such as a utility billing millions of meter reads or an online retailer with fully automated order-to-cash.

Choosing a strategy

Reliance makes sense when controls are well designed, the process is high volume, and testing them is cheaper than the substantive work saved. For many small entities, a fully substantive approach with control risk at maximum is efficient. Both are acceptable; what is not acceptable is assessing below maximum without testing.

When you do rely:

AU-C 330.09: the greater the reliance, the more persuasive the evidence needed.
AU-C 330.10(a): perform other procedures in combination with inquiry.
AU-C 330.11: test throughout the period of reliance; AU-C 330.12 covers roll-forward from interim.
AU-C 330.14: if no changes, you may use prior audit evidence but must test each relied-on control at least once in every third audit and some controls each year. Controls over significant risks need current-period testing (AU-C 330.15).
AU-C 330.17: deviations require inquiry into causes and a decision on whether reliance is still supported.

Testing a combination of controls, including GITCs that support automated controls, may be needed (AU-C 315.A258). Sample sizes for control tests are covered in the materiality and sampling track via the attribute sampling worksheet.

Common findings

Control risk below maximum with only walkthroughs performed.
Control risk "low" in the risk matrix while the program is fully substantive.
Automated controls relied on without testing the GITCs that support them.
No determination under AU-C 315.37.
Deviations found in a control test, then reliance kept with no AU-C 330.17 analysis.

Worked example

Two strategies for the same risk

Ridgeway Hardware Supply, Inc. has 48,000 sales invoices a year totaling $22 million. The risk is occurrence of revenue, inherent risk assessed elevated but not significant (the team placed the presumed revenue fraud risk on cutoff). Performance materiality is $110,000.

Strategy A, fully substantive. Control risk at maximum, so RMM equals elevated. The team's methodology yields a sample of 85 invoices vouched to shipping documents and cash receipts, plus a cutoff test of 30 items. Estimated hours: 46.

Strategy B, controls reliance. The team tests the automated match that blocks invoicing without a sales order and shipping record (8 hours, including a test of one configured transaction), the GITCs over access and change management for the billing system (12 hours), and a sample of 25 for the manual credit approval control (included in the 8). Control risk assessed low. RMM becomes moderate and the substantive sample drops to 40 invoices (20 hours), plus the cutoff test (6 hours). Estimated hours: 8 + 12 + 20 + 6 = 46.

Hours are equal this year. Next year, if GITCs remain effective and the automated control is unchanged, the team can use prior-year evidence for the automated control under AU-C 330.14, after confirming it has not changed, and save most of the time spent testing it. The manager picks Strategy B and documents the tests that support control risk below maximum.

Self-check

Answer each question before you open the answer.

What control risk assessment does AU-C 315.38 require if you do not plan to test operating effectiveness?
Show answer
Maximum, so the risk of material misstatement equals the inherent risk assessment.
Does a successful walkthrough support control risk below maximum?
Show answer
No. A walkthrough supports design and implementation. Operating effectiveness testing is required to assess control risk below maximum (AU-C 315.A257).
Name the two situations in which AU-C 330.08 requires tests of controls.
Show answer
When the auditor plans to rely on controls in determining substantive procedures, and when substantive procedures alone cannot provide sufficient appropriate evidence for an assertion.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error