September 4, 2020 at 5:28 am #3095228VooParticipant
Are auditors required to test operating effectiveness of internal control in an audit?
Thanks in advance.September 4, 2020 at 4:29 pm #3095618SamParticipant
Can you provide some context? It depends on the control and how prevalent/important it is. Sometimes yes, but other times, no. In those cases, control risk is just set at high because we aren't bothering to test it.September 4, 2020 at 11:05 pm #3095840
You understand and ASSESS, not TEST operating effectiveness of internal control over financial reporting. Auditors assess the internal control first to determine if they're functioning as management intend them to be. For instance, auditors assess if management have internal control that can respond to changes of external factors such as technological change, changes in GAAP and laws and regulations. Auditors also evaluate managements written self assessment on internal contol as required by PCAOB. They also assess the design of the internal control to see if its effective or not.
Once they are done with the assessment, they can now determine how MUCH to TEST the control activities within internal control to find its effectiveness. If they determine internal contol to be shitty and not working as intended, they will set control risk as high, meaning they have to set detection risk low. This means they do minimal testing on control activities and test more on substantive testing.September 7, 2020 at 12:41 pm #3097676
Just to add another point, if the assessment of internal control is horrendously weak, auditors do not even bother to test them.September 8, 2020 at 1:48 pm #3098528etm890Participant
It depends on whether you're talking about a private company or a public company.
For a private company, an auditor MUST “gain an understanding” of the company's internal controls and perform a walk-through to assess whether they are properly designed, implemented, and that there are no design gaps in internal controls. This is NOT testing the operating effectiveness of internal controls. A private company audit opinion does not require the testing of operating effectiveness of internal controls. The auditor may determine it can create audit efficiencies by placing reliance on the internal controls, and thus would test their operating effectiveness.
For a public company (excluding non-accelerated filers), the annual 10K requires both an audit opinion and an opinion over the Internal Controls over Financial Reporting (ICFR). Thus, you would required to perform substantive audit testing as well as testing the operating effectiveness of internal controls.September 8, 2020 at 7:42 pm #3098849
Yes, theres that distinction between private vs public. As i recall, private companies arent required to test operating effectiveness of internal control. Nicely put!
- You must be logged in to reply to this topic.