Identified controls and evaluating design and implementation

In this lesson you will

Identify the controls required by AU-C 315.27.
Evaluate the design of a control against the risk it addresses.
Determine implementation using procedures beyond inquiry.
Document design and implementation conclusions.

Which controls to identify

AU-C 315.27 requires you to identify these controls in the control activities component that address assertion-level risks:

(a) Controls that address a significant risk.
(b) Controls over journal entries and other adjustments, as AU-C 240 requires, whether the entries are standard or nonstandard, automated or manual (AU-C 315.A182).
(c) Controls you plan to test for operating effectiveness, including controls over risks for which substantive procedures alone cannot provide sufficient appropriate evidence.
(d) Other controls that, in your professional judgment, are appropriate to identify to meet the objectives of AU-C 315.13 for assertion-level risks.

AU-C 315.28-.29 then require you to identify the IT applications and other aspects of the IT environment subject to risks arising from IT, based on the controls identified, along with those risks and the GITCs that address them. That is covered in the IT lesson.

Category (b) applies in every audit. Even a fully substantive audit of a small entity requires you to identify controls over journal entries and evaluate their design and implementation. If no formal controls exist, document that and the effect on the risk assessment.

Evaluating design

AU-C 315.30(a) requires you to evaluate whether the control is designed effectively to address the risk at the assertion level, or designed effectively to support the operation of other controls. Ask:

What risk does the control address, and which assertion?
Who performs it, and do they have the competence and authority?
How often, and is that frequent enough to prevent or detect a material misstatement on time?
What is the precision? For a review control, what threshold triggers follow-up?
What information does the performer use, and is it reliable?
What happens when an exception is found?

A review control described as "CFO reviews the reconciliation" without a threshold or evidence of follow-up is not designed precisely enough to address a specific misstatement.

Determining implementation

AU-C 315.30(b) requires you to determine whether the control has been implemented by performing procedures in addition to inquiry of the entity's personnel. Options:

Observe the control being performed.
Inspect documents showing it was performed (signed reconciliations, system approval logs).
Trace a transaction through the process in a walkthrough, inspecting evidence at each control point.

A walkthrough that combines inquiry, observation and inspection of one transaction usually covers both design and implementation. See the walkthrough guide.

Design and implementation is not reliance

Design and implementation work does not support control risk below maximum (AU-C 315.A257). It does inform your risk assessment: a well-designed control may lead you to plan tests of operating effectiveness, and a poorly designed one is a deficiency to evaluate under AU-C 265.

Documentation

AU-C 315.42(c) requires documentation of the evaluation of design and the determination of implementation for identified controls. For each: the risk and assertion, control description with performer, frequency and precision, procedures performed, and conclusion. The walkthrough documentation template captures each element.

Common findings

Control narratives with no design evaluation conclusion.
Implementation "confirmed" by inquiry.
No identification of journal entry controls.
Controls identified for significant risks in planning, then never evaluated.

Worked example

Evaluating a reserve review control

Fairmont Auto Parts, Inc. has inventory of $5.2 million and a significant risk over valuation of slow-moving items. Performance materiality is $95,000.

Identified control: each quarter the controller reviews the obsolescence reserve report, investigates SKUs with no sales in 12 months and a balance over $10,000, and approves the reserve adjustment.

Design evaluation:

Risk addressed: valuation of slow-moving inventory.
Performer: controller, with authority to adjust.
Frequency: quarterly, sufficient for a year-end balance.
Precision: the $10,000 threshold per SKU. With 1,800 SKUs, many items below $10,000 escape review. If 300 such SKUs average $4,000 of potential overstatement, the unreviewed exposure is 300 x $4,000 = $1,200,000.

The team concludes the control is not designed precisely enough to address the risk at the assertion level: unreviewed exposure is far above performance materiality.

Implementation: the team inspects the signed September review and agrees selections to the report. The control exists as described.

Conclusion: implemented but not effectively designed. The team records a deficiency, keeps control risk at maximum, and expands substantive testing of SKUs under $10,000.

Self-check

Answer each question before you open the answer.

Which identified controls apply in every audit, even a fully substantive one?
Show answer
Controls over journal entries and other adjustments (AU-C 315.27(b)). Controls over significant risks (AU-C 315.27(a)) also apply in every audit, because AU-C 240.31 treats management override of controls as a significant risk, and the presumed revenue fraud risk adds more unless it is rebutted.
Can implementation be determined by inquiry alone?
Show answer
No. AU-C 315.30(b) requires procedures in addition to inquiry, such as observation, inspection or a walkthrough.
What design question exposes a weak review control most often?
Show answer
Precision: the threshold or criteria that trigger follow-up. If the threshold lets misstatements larger than performance materiality pass, the control is not designed to address the risk.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error