Читать книгу Wiley Practitioner's Guide to GAAS 2020 - Joanne M. Flood - Страница 274

Whenever you test activity-level controls, you will have to determine the extent of your tests. If you are testing the reconciliation of significant general ledger accounts to the underlying detailed trial balance, how many reconciliations should you look at? If the control is something that is performed on every transaction—for example, the authorization of payments to vendors—how many should you test?

The extent of your tests should be sufficient to support your conclusion on whether the control is operating effectively at a given point in time. Determining the sufficiency of the extent of your tests is a matter of judgment that is affected by a number of factors. Exhibit 12.1 lists these factors and indicates how they will affect the extent of your tests.

Exhibit 12.1 Determining the Extent of Tests

	Effect on the Extent of Tests
Factor to consider	Increase number of tests	Decrease number of tests
How frequently the control procedure is performed	Procedure performed often (e.g., daily)	Procedure performed occasionally (e.g., once a month)
Importance of control	Important control (e.g., control addresses multiple assertions or is a period-end detective control)	Less important control
Degree of judgment required to perform the control	High degree of judgment	Low degree of judgment
Complexity of control procedure	Relatively complex control procedure	Relatively simple control procedure
Level of competence of the person performing the control procedure	Highly competent	Less competent

When determining the extent of tests, you also should consider whether the control is manual or automated. When a control is performed manually, the consistency with which that control is performed can vary greatly. In contrast, once a control becomes automated, it is performed the same way each and every time. For that reason, you should plan on performing more extensive tests of manual controls than you will for automated controls.

In some circumstances, testing a single operation of an automated control may be sufficient to obtain a high level of assurance that the control operated effectively, provided that IT general controls operated effectively throughout the period.