Читать книгу Wiley Practitioner's Guide to GAAS 2020 - Joanne M. Flood - Страница 215

Obtaining an understanding of the design and implementation of internal controls is different from testing their operating effectiveness.

 Understanding the design and implementation is required on every audit as part of the process of assessing the risks of material misstatement.

 Testing the operating effectiveness is necessary only when the auditor will rely on the operating effectiveness of controls to modify the nature, timing, and extent of substantive procedures or when substantive procedures alone do not provide the auditor with sufficient audit evidence at the assertion level.

The procedures necessary to understand the design and implementation of controls do provide some limited evidence regarding the operation of the controls. However, the procedures necessary to understand the design and implementation of controls generally are not sufficient to serve as a test of their operating effectiveness for the purpose of placing significant reliance on their operation.

Examples of situations where the procedures the auditor performs to understand the design and implementation of controls may provide sufficient audit evidence about their operating effectiveness include:

 Controls that are automated to the degree that they can be performed consistently provided that general information technology (IT) controls over those automated controls operate effectively during the period.

 Controls that operate only at a point in time rather than continuously throughout the period. For example, if the client performs an annual physical inventory count, the auditor’s observation of that count and other procedures to evaluate its design and implementation provide audit evidence that may affect the design of the auditor’s substantive procedures.