Question

If a company’s control risk is initially assessed as low, the auditor needs to gather evidence on the operating effectiveness of the controls. For each of the following control activities listed as (1)–(10), do the following two tasks:  

a. Describe the test of control that the auditor would use to determine the operating effectiveness of the control.

b. Briefly describe how substantive tests of account balances should be modified if the auditor finds that the control is not working as planned. In doing so, indicate (a) what misstatement could occur because of the control deficiency, and (b) how the auditor’s substantive tests should be expanded to test for the potential misstatement.  

3. Payments for goods received are made only by the accounts payable department on receipt of a vendor invoice, which is then matched for prices and quantities with approved purchase orders and receiving slips.

A)

B)

Answer 1

Introduction: The control in the question is addressing two below risks

1. The segregation of duties among two different functions that is invoice payments and invoice processing function. The invoice processing person should not process the payment also because if he processes the fake invoice, then there wont be an independent person to verify the same and find out. The risk of fraud is high if this control fails

2. Payment is made only after the approved Purchase order and Invoice is received. Any body wants to make payment only for the quantity of goods that they receive and price which they agreed with the customer. That is the reason a Purchase Order is important and invoice from the vendor is important with price and quantities matched before payment is done.

Test of Control:- This control can be tested by obtaining the system configuration screenshots that a payment can be processed only after an Invoice quantity and price has been matched with PO quantity and price and a goods receipt has been created for the same. It can also be tested by creating a fake entity in the system and processing a dummy payment and checking if the system can process. If these controls are disabled in the system then the auditor has to modify his substantive procedures to ensure that there is no material misstatement. Below are the procedures that the auditor has to implement in order ascertain that there is no material misstatement.

1. Obtain the list of payments done during the audit period and check if there are authorized purchase orders for the same on sample basis

2.Check that the goods receipt is created for the samples after verifying the goods inward register. if not obtain the confirmation from the requesting department that the same has been received,

3. Check that Prices and quantities match between Invoice and Purchase order.

4. On a sample basis obtain a direct confirmation from vendors for the reconciliation statement.