Читать книгу Wiley Practitioner's Guide to GAAS 2020 - Joanne M. Flood - Страница 282

The results of your tests of activity-level controls should support your conclusion about their operating effectiveness. If your tests revealed no deviations or exceptions in the performance of control procedures, then you should be able to conclude that the control is operating effectively (assuming that the scope of your test work, as discussed earlier in this chapter, was sufficient).

When your tests of operating effectiveness uncover exceptions to the company’s prescribed control procedures, you should determine whether additional tests are required to assess operating effectiveness. A control testing exception is not necessarily a control deficiency. You may determine that the exception was an isolated instance of noncompliance with the established control procedure. However, if you do conclude that a testing exception is not a control deficiency, then you should perform and document additional test work to support your conclusion. In most instances, control testing exceptions usually are not considered to be isolated instances of noncompliance.

For example, when your test work reveals deficiencies in either the design or the operating effectiveness of a control procedure, you will need to exercise your judgment in order to reach a conclusion about control effectiveness.

Ultimately, you should consider that you are making a conclusion about the effectiveness of internal control as a whole. When you evaluate activity-level controls, you should consider the effectiveness of the entire information-processing stream, not individual control procedures in isolation.