Lesson 7: Tests of controls in business processes

Lesson 7.1: Tests of controls in the revenue and receipts business process

Study

The sections under the heading AUDITING THE CYCLE and the sections
dealing with tests of controls under the heading AUDITING PROCEDURES –
TESTS OF CONTROLS AND SUBSTANTIVE PROCEDURES in chapter 10 of
auditing notes.

Note the following:

- Financial statement assertions in the revenue and receipts business

process (remember the assertions are also described in ISA 315:
Para A129)
- Remember that the auditor will mostly perform tests of controls
through inspection, observation, reperformance and enquiry. Inspect
and reperform are the best tests of controls to perform,
alternatively, if evidence of an internal control cannot be obtained
by inspecting or reperforming, the auditor can consider whether he
or she can observe or enquire if the internal control is performed
correctly.

To formulate tests of controls to test internal controls in the revenue and

receipts business process you need to be able to identify internal controls.
To be able to identify internal controls, you need to be familiar with the
internal control concepts in the revenue and receipts business process.
Activity 7.1.1

Required:

Refer to working paper D entitled “System description of computer

equipment sales”. Formulate the tests of controls that you will perform to
test the manual and automated internal controls applicable to the
receiving and processing of customer orders.

Refer to working paper E entitled “Masterfile amendments for new

customers”. Formulate the tests of controls that you will perform to test
the manual and automated internal controls applicable to Masterfile
amendments for new customers.

Feedback:

Notes

- Tests of controls are required (not substantive procedures)

- To answer this type of question you should describe all relevant
tests of controls to test both manual and automated internal
controls, for example, inspect, observe, reperform and enquire,
including audit procedures using invalid test data, which is also a
form of reperformance

Additional comments

- Formulate tests of controls asking HOW, WHAT and WHY

- You must first identify the internal controls implemented, and then
formulate tests of controls to test the identified internal controls.
Remember, you can only rtest the internal controls described in the
question. Manual and some automated internal controls can be
tested by means of inspection, observation, reperformance and
enquiry. However, some automated controls (for example, some
application controls) should be tested with audit procedures using
test data (this question only required you to describe invalid test
data)
 - Regarding the wording of tests of controls, inspect and reperform
are the best tests of controls to perform; alternatively, if evidence of
an internal control cannot be obtained by inspecting or
reperforming, the auditor can consider whether he or she can
observe or enquire that the internal control is performed correctly.
You should be careful not to observe a document – documents must
be inspected.

Solution: Tests of controls: Receiving and processing customer orders

- Attempt to gain access to an electronic order request on CompTechs

website by entering a fictitious username and password
- Attempt to generate an electronic order request by entering an
invalid customer account number, for example, a customer code
with a different field length or alphanumeric combination than
specified
- When completing the electronic order request, attempt to submit
the electronic order request without completing all the required
fields
- When completing the required fields on the electronic order request,
attempt to, for example:
o Enter negative amounts in the quantity or item code fields
o Enter an alphabetical character in the quantity field
o Enter a numeric degit in the inventory description field
- When processing an order, attempt to enter an inventory item code
that does not appear on the inventory list
- Attempt to supress or redirect the sending of an electronic order
request from the website to CompTechs electronic order mailbox
- Attempt to upload an electronic order onto the ordering system
where the customers account is in arrears and confirm that the
ordering system automatically blocks the customers account so that
no further orders will be processed
- Attempt to process an order that exceeds the quantity on hand of
the inventory
- Attempt to continue with an order where the credit limit will be
exceeded when placing the current order and confirm that the
ordering system automatically block the customers account so that
no further orders can be processed for the customer

Tests of controls: Masterfile amendments for new customers

- Inspect the file with the Masterfile amendment request and confirm
that the credit record check documentation and an approval
certificate are attached
- Inspect the file with the Masterfile amendment request forms for
completeness to confirm whether the forms are issued in sequence,
and investigate missing numbers
- Inspect a sample of Masterfile amendment request forms for the
signature of the credit manager as proof that the forms have been
approved
- Attempt to gain access to the Masterfile amendment module by
entering a fictitious username and password
- When completing the electronic Masterfile amendment form,
attempt to submit the electronic Masterfile amendment form
without completing all the required fields
- When completing the required fields on the electronic Masterfile
amendment form, attempt to, for example:
o Enter negative amounts where none should exist
o Enter an alphabetic character in the contact information or
credit limit field
o Enter a numerical digit where none should exist
- Attempt to enter a credit limit for a new customer that exceeds
R1 200 000 and confirm that the system does not allow it
- Inspect a sample of Masterfile amendment approval/request forms
to confirm that the credit limit does not exceed R1 200 000
- Attempt to approve a masterfile amendment without entering a
multilevel password or by entering a fictitious multilevel password.
Lesson 7.2: Tests of controls in the acquisitions and payment business
process

Study

The sections under the heading AUDITING THE CYCLE and the sections
dealing with tests of controls under the heading AUDITING PROCEDURES –
TESTS OF CONTORLS AND SUBSTANTIVE PROCEDURES in chapter 11 of
auditing notes

Note the following in the above study sources:

- The financial statement assertions in the acquisition and payment

cycle are important (remember the assertions are also described in
ISA 315 para A190)
- Remember that the auditor will mostly perform tests of controls
through inspection, observation, reperformance and enquiry.
Inspection and reperformance are the best controls to perform,
alternatively, the auditor can consider whether he or she can
observe or enquire whether the internal control is performed
correctly.
- As mentioned, manual and automated controls can be tested by
inspection, observation, enquiry and reperformance. However, some
automated controls can be tested by means of system oriented
CAATs using test data.

Activity 7.2.1:

- Inspect the purchase orders to confirm whether the forms have been
issued in sequence
- Inspect a sample of purchase orders and compare the supplier on
the purchase order with the supplier that appear on the list of
approved suppliers.
- When completing the fields on the purchase order, attempt to, for
example:
o Enter alphabetical characters where none should exist, for
example, enter alphabetical characters when completing the
ISBN number and quantity
o Enter negative values where none should exist, for example,
enter a negative quantity
- Attempt to capture a purchase order, but leave out one of the
required fields (quantity, book titles and ISBN number), and inspect
that an error message appears on the computer screen
- Attempt to override the automatic generation prices from the
approved suppliers price list by trying to change the prices
- Inspect a sample of purchase orders and compare the price on the
purchase order with the prices that appear on the approved
suppliers price list
- Enquire from the CFO whether the suppliers price list is updated and
approved by the CFO on an annual basis
- Attempt to approve a purchase order by entering a password that
consists of fewer than eight characters
- Attempt to enter a password that consists of an incorrect
combination of characters, for example, alphabetical characters or
numerical or symbols only, or a combination of only two types of
character, for example, alphabetical characters or symbols only but
no numerical digits
- Observe that ordered books have been delivered to the designated
goods receiving section
- Inspect an exception report that indicates the outstanding orders for
which books have not been received and enquire whether the
outstanding orders have been followed up
Lesson 7.3: Tests of controls in the inventory and production business
process

Study

The sections under the heading AUDITING THE CYCLE and the sections
dealing with tests of controls under the heading AUDIT PROCEDURES –
the tests of controls and substantive procedures in chapter 12 of auditing
notes and the international standard on auditing (ISA 501 para 04)

Note the following:

- Remember when the auditor will mostly perform tests of controls

through inspection, observation, reperformance and enquiry.
Inspection and reperformance are the best controls to perform, as
evidence obtained via inspection and reperformance cannot be
altered by the client and are completely under the control of the
auditor. Alternatively, if evidence of an internal control cannot be
obtained by inspection or reperformance, the auditor can consider
whether he or she can observe or enquire whether the internal
control is performed correctly.
- As mentioned, manual and automated controls can be tested
whether he or she can observe and reperform. However, some
automated controls can be tested by means of system oriented
CAATs using test data
- Attendance of the inventory count by the auditor includes both
substantive procedures and tests of controls.
Activity 7.3.1

Required:

Refer to working paper A1 entitled “inventory”. Describe the tests of

controls (excluding audit procedures using test data) that you will perform
at the inventory count of Goldrush on 28 February 20x1.

- Inspect a sequence of the inventory sheets before the inventory

count begins
- Inspect the floor plan and confirm that the entire inventory will be
counted by comparing the inventory sheets with the different floor
plan areas
- Enquire from Dan Brown whether damaged or obsolete is kept
separately
- Enquire from Dan Brown whether he walked through the warehouse
to confirm that all inventory items were labelled
- Inspect the inventory control sheet for the signatures of the staff
members in the counting teams to confirm that the stationery has
been controlled, as the counting teams were required to sign for
each inventory sheets that was taken from and brought back to Dan
Brown
- Observe/enquire whether the counting teams for the inventory
count
o Consists of two staff members each (one to count and the
other to record)
o Are comparing inventory items on the inventory sheets with
the inventory item number and its description on the shelf to
confirm that the correct inventory is counted
o Are attached a green sticker to the inventory label on the shelf
if the inventory item is damaged
o Are attaching a red sticker to the inventory label on the shelf if
the inventory item is damaged
o Are attaching a blue sticker to the inventory label on the shelf
after the inventory item has been counted twice
- Inspect a sample of inventory sheets for the signatures of the staff
members on the counting teams as proof that they are finished
counting the sections for which they were responsible. (At the end of
the count, there should be four signatures as proof that items have
been counted twice)
 - Inspect a sample of inventory sheets and confirm that staff
members recorded quantities in ink (this means that no changes
could be made after the inventory count had taken place)
- Observe that Dan Brown is present and available during the
inventory count and that he supervises the inventory counting
process
- Inspect a sample of inventory sheets to identify items whose
quantity differe between the first and the second (final) counts.
Inspect Dan Browns signature for authorisation of the differences,
for which changes or corrections should be made
- Inspect a sample of inventory sheets and identify inventory items
whose quantities differ between the first and the second count, and
enquire whether Dan Brown has recounted these inventory items.
- Perform the following test counts:
o Select a sample of inventory items from the inventory sheets
and compare the quantity on the inventory sheet with the
quantity of items on the floor
o Select a sample of inventory items from the floor and compare
their quantity with the quantity of the items on the inventory
sheets
- Inspect from Dan Brown whether he has been notified by all the
counting teams of damaged or obsolete inventory (marked with a
red sticker) to confirm that he includes these items as potential
write offs
- Walk through the warehouse and conform that every item has been
counted by inspecting whether all shelf labels have green or blue
stickers
- Inspect the inventory control sheet and confirm that all the count
sheets have been signed in after the counting teams have finished
the inventory count
- Observe that no manufacturing or dispatching takes place during
the inventory count.

Activity 7.3.2

Formulation of tests of controls for manual and automated control

activities

Required:
Refer to working paper B1, entitled “Inventory adjustments”. Describe the
tests of controls that you will perform on the internal controls when
adjustments are made to the inventory.

Tests of controls on master file changes

- Inspect the file containing the inventory adjustment forms to

confirm that the forms are sequenced
- Inspect a sample of inventory adjustment forms for the signature of
Pieter de Beer as proof that he has approved the inventory
adjustment forms
- Attempt to gain access to the inventory master file by entering a
fictitious username and password
- Attempt to enter an incorrect inventory item code, for example an
inventory item code that consists of an alphanumeric combination
different to the one specified, such as three alphabetical characters
and four digits
- When completing the second count on the inventory adjustment
screen, attempt to, for example:
o Enter a negative second (final) count
o Enter a alphanumeric character in the numeric field
- Reperform the calculation of inventory adjustments on a sampel of
inventory adjustment forms
- Through reperformance, complete the second (final count field on
the inventory adjustment screen and confirm that the inventory
adjustment has been calculated correctly by comaring it to the
quantity on the inventory adjustment form
- Inspect the log containing the inventory adjustment to an inventory
item of more than 10% of the quantity on hand and confirm that it
must be approved electronically by entering a username and
password on the automated inventory system
- Attempt to approve an inventory adjustment of more than 10% of
the quantity on hand by entering a fictitious username and
password
Lesson 7.4: Tests of controls in the payroll and personnel business process

Study

Section 1 to 2, under the heading AUDITING THE CYCLE chapter 13,

auditing notes (ignore the sections dealing with substantive procedures
for now)

Note the following in the above study sources

- The financial statement assertions in the payroll and personnel cycle

are important (remember the assertions are also described in ISA
315: Para A190)
- Remember that the auditor will mostly perform tests of controls
through inspection, observation, reperformance and enquiry (refer
to lesson 5.2). inspect and reperform are the best tests of controls
to perform; alternatively, if evidence of internal control cannot be
obtained by inspecting or reperforming, the auditor can consider
 whether he or she can observe or enquire that the internal control
has been performed correctly.
- As mentioned, manual and automated controls can be tested by
inspection, observation, enquiry and reperformance. However, some
automated controls can be tested by means of system oriented
CAATs using test data.

To formulate tests of controls in order to test internal controls in the

payroll and personnel business process you need to be abler to identify
internal controls.

Activity 7.4.1

Required: Formulate tests of controls that you will perform to test the
manual and automated internal controls applicable to the payroll and
personnel function of C4U.

- Inspect a sample of master file amendment forms for the signature

of Ms Dress to confirm that the amendment has been authorised
- To make the master file amendments attempt to gain access to the
employee master file by entering a fictitious username and
password
- Attempt to gain access to the employee Masterfile by entering a
password that consists of more or fewer than eight characters, or a
character combination that is incorrect according to that specified in
the IT policy of C4U.
- When completing the master file amendment, attempt to submit the
Masterfile amendment without completing all the required fields
- When completing the required fields on the Masterfile amendment,
attempt to, for example:
o Enter alphabetical characters where none should exist, for
example the employee number field
o Enter numerical digits where none should exist, for example
the individuals name
o Enter characters with an incorrect field size, for example the
identification number that should comprise of 13 digits only.
- Attempt to approve a Masterfile amendment by entering a fictitious
password or by entering one password only
- Observe wage workers entering and exiting the warehouse to
confirm that hours are recorded only for employees presenting their
thumb print
- Observe a sample of wage workers and record the time of arrival at
or departure from the warehouse, and compare these times with the
times that are updated to the employee Masterfile to confirm that
they are accurate
- Inspect a sample of schedules of hours worked for the signature of
Mr Hat to confirm that the hours worked were authorised
- Attempt to access the payroll software by entering a fictitious
username and password
- Inspect a sample of payment records for the initials of Mr Socks as
proof that he reviewed the payment record to confirm that the hours
worked are correct
- Inspect a sample of payment records with adjustments and inspect
the signature of Mr Suit next to adjustments as proof that
adjustments have been approved
- Inspect the payroll file for the signature of Mr Suit to confirm that he
performed verification checks to ensure that the payroll is accurate
before payments are made
- Inspect a sample of payroll copies for the signature of Mr Socks and
Mr Suit as proof of authorisation of the payroll.
Lesson 7.5: Using the work of a service organisation (ISA 402)

Learning objectives:

- Demonstrate an understanding of the service provided by a service

organisation

Study

Study the section AUDIT CONSIDERATIONS RELATING TO AN ENTITY USING

A SERVICE PROVIDER – ISA 402 in auditing notes chapter 8 and ISA 402,
para 1 – 8.

Study
Study ISA 402, para 9 – 14

Study

Study ISA 402, para 15 (A24 – A28)

Summary

In this lesson we introduced you to considerations that an auditor has to

take into account when auditing an entity that makes use of a service
organisation. The auditor therefore has a responsibility to identify and
evaluate the risks of misstatement arising from the use of a service
organisation.