control), including a simple example. In the actual practice, the process of assessment on controls is not easy, complex, and require a lot of professional judgement and of works. These complexity makes our colleagues have a difficulty to understand and to perform test of control.
So we try to explain the assessment process in a very simple way. We believe that this process is good for unexperienced auditors to practice how to assess the functioning of internal control.
To simplify our discussion, we will skip some of the processes. Example: we will skip the procedures for assessing whether:
- the control is designed to mitigate the identified significance risk,
- there are compensating controls in the absence of key controls.
By definition, attribute is the characteristic being tested for in the population. Attributes of interest and exception conditions for audit sampling are taken directly from the auditor’s audit procedures. It means, what attributes should be exist in our sampling, and whether there are exceptions in the sampling, are resulted from the the design and the implementation of our audit procedures.
This an example of attributes of voucher, if one or more attributes is (are) not exist than there is (are) exceptions:
To conclude the functioning of internal control, we should take the following step (note: simplified):
Client: PT DEWA ARJUNA Year-end: 12/31/14
Audit Area: Test of controls and substantive test of transactions – billing functions: Pop-size: 5.764
- Define the objectives:
Example: to test the operating effectiveness of controls, related to sales process.
- Define the population precisely (including stratification, if any).
Example: sales invoices for the period 1/1/14 to 10/31/14. First invoice number 3689 and last invoice number: 9452, so population size is 5.764 invoices.
- Define the sampling unit, organization of population items, and random selection procedures.
Example: sales invoice number: recorded in the sales journal sequentially, computer generation of random numbers.
- Specify the tolerable exception rate (TER).
TER = the highest exception rate the auditor will permit in the control being tested and still be willing to conclude the control is operating effectively. Example, TER = 9%, means that even if 9% of the duplicate sales invoices are not approved for credit, the credit approval control is still effective.
Lower TER = larger sample size. Example, a larger sample size is needed for the test of credit approval if the TER is decreased from 9% to 6%.
- Specify acceptable risk of assessing control risk too low (ARACR).
Auditors using attributes sampling assign a specific amount, such as 10% or 5% risk.
ARACR = the risk the auditor is wrong for concluding that a control is effective. For statistical sampling, it is common to use a percent, such as 5% or 10%. A low ARACR = the tests of controls are important and will correspond to a low assessed control risk and reduced substantive tests of details of balances. A larger sample size is required to lower this risk.
- Estimate the population exception rate (EPER).
Auditors often use the preceding year’s audit results to estimate EPER. If prior-year results are not available, the auditor can take a small preliminary sample of the current year’s population for this purpose.
Determine the initial sample size.
Four factors determine the initial sample size: population size, TER, ARACR, and EPER. In attributes sampling, auditors determine sample size by using computer programs or tables developed from statistical formulas.
- Develop audit procedure Procedure audit for test of control, related to billing of customer and recording the sales in the records:
- Accounts for a sequence of sales invoices in the sales journal.
- Trace selected sales invoices numbers from the sales journal to:
- Accounts receivable master file and test for amount, date, and invoice number.
- Duplicate sales invoice and check for the total amount recorded in the journal, date, customer name, and account classification. Check the pricing, extensions, and footings. Examine underlying documents for indication of internal verification.
- Bill of lading and test for customer name, product, description, quantity, and date.
- Duplicate sales order and test for customer name, product description, quantity, date and indication of internal verification.
- Customer order and test for customer name, product description, quantity, date, and credit approval.
|Attribute No||Description of Attributes||Planned Audit||Exception Conditions|
|Attribute No||Description of Attributes||EPER (%)||TER (%)||ARACR (%)||Initial sample size (IS)||Exception Conditions|
|1||Existence of the sales invoice number in the sales journal (completeness)||0||4.0||5||74||No record of sales invoice number in the sales journal|
|2||Amount and other data in the master file agree with sales journal entry (posting and summarization)||1||5.0||5||93||The amount recorded in the master file differs from the amount recorded in the sales journal|
|3||Amount and other data on the sales invoice agree with the sales journal entry (posting and summarization)||1||5.0||5||93||Customer name and account number on the invoice differ from the information recorded in the sales journal|
|4||Evidence that pricing, extensions, and footing are cheked (initials and correct amounts) (accuracy)||1||5.0||5||93||Lack of initials indicating verifikation of pricing, extensions, and footings|
|5||Quantity and other data on the customer order agree with the sales invoice (occurance)||1.5||9.0||5||51||Quantity on the sales order differs from the quantity on the duplicate sales invoice|
|6||Credit is approved (occurance, valuation)||1.5||9.0||5||51||Lack of initials indicating credit approval|
|No||Identity of item selected||Test of Control on Attributes|
|No||Identity of item selected||1||2||3||4 = 1 exception||5||6 = 1 exception|
|1||3787||Invoice number is EXIST in journal||Data in master file AGREE with journal||Data in invoice AGREE with journal||Pricing, extensions, and footing are NOT cheked||Data on customer order AGREE with invoice||Credit is NOT approved|
|No||Identity of item selected||Attributes|
X = exception
|No||Identity of item selected||1||2||3||4||5||6||...|
|...||Number of exceptions||0||2||0||10||0||12||0|
From the result of the test, then we can determine CUER for each attribute. CUER is calculated from statistic table, by looking number of exception founds and number of sampel, with ARACR 5%.
The CUER can be shown as follows:
|Attribute No||Description of Attributes||Planned Audit||Actual Results|
|Attribute No||Description of Attributes||EPER (%)||TER (%)||ARACR (%)||Initial sample size (IS)||Actual sample size (AS)||Number of except ion||Sample except ion rate (SER)||CUER|
|1||Existence of the sales invoice number in the sales journal (completeness)||0||4.0||5||74||75||0||0||4.0|
|2||Amount and other data in the master file agree with sales journal entry (posting and summarization)||1||5.0||5||93||100||2||2||6.2|
|3||Amount and other data on the duplicate sales invoice agree with the sales journal entry (posting and summarization)||1||5.0||5||93||100||0||0||3.0|
|4||Evidence that pricing, extensions, and footing are cheked (initials and correct amounts) (accuracy)||1||5.0||5||93||100||10||10||16.4|
|5||Quantity and other data on the customer order agree with the duplicate sales invoice (occurance)||1.5||9.0||5||51||50||0||0||5.9|
|6||Credit is approved (occurance)||1.5||9.0||5||51||50||12||24||> 20|
- As we can see from the above table, attributes 1, 3, dan 5 has CUER < TER, and attributes 2, 4, and 6 has CUER > TER.
- Effect on audit plan: controls tested through attributes 1, 3, and 5 can be viewed as operating effectively, given that TER equals or exceed CUER. Additional emphasis is needed in confirmation, allowance for uncollectibne accounts, cutoff tests, and price test for the financial statement audit due to results of tests attributes 2, 4, and 6.
- Effect on Report on Internal Control: CUER exceeds TER for attributes 2, 4, and 6 These findings should be communicated to management to allow an opportunity for correction of the control deficiency to made before year-end. If timely correction is made by management, the corrected controls will be tested before year-end for purpose of reporting on internal control over financial reporting.
- The overall result of test of control will effect the auditor conlusion on the adequacy and the effectiveness/function of internal control over financial reporting.
- Recommendations to Management: each of exceptions should be discussed with management. Specific recommendations are needed to correct the internal verification of sales invoice to improve the approach to credit approvals.