Question

Audit Coverage & Design Adequacy

Answer the following concerns when performing an assurance engagement:

1. What are the consequences of identifying too many or too few key process-level risks

in performing an assurance audit?

2. What are some of the considerations when evaluating the design adequacy of

controls for a business process?

Answer 1

1. Identifying too many key process-level risks involves use of too many resources to test controls. Identifying too few key process-level risks could result in not testing main controls. The internal auditor may not find observations or evidence if main controls are not tested. Both scenario impacts an assurance engagement and could leave a company vulnerable and susceptible to an event that may affect the achievement of objectives of the company.

2. Some of the considerations when evaluating the design adequacy of controls for a business process are:

• To check whether the controls that are identified are relevant for audit and key considerations.
• To check whether the controls identified will meet the objectives of the company.
• To obtain evidence that these controls have been implemented through tests like walkthrough tests.

It may not be possible for management to check on the effective implementation of controls in day to day action. Hence, above important considerations must be checked when evaluating the design adequacy of controls for a business process.