Test of Control: How?

Continuing our previous posting, “assessing the adequacy of internal control”, in this posting we will try to share how to assess the functioning of internal control (test of
control), including a simple example. In the actual practice, the process of assessment on controls is not easy, complex, and require a lot of professional judgement and of works. These complexity makes our colleagues have a difficulty to understand and to perform test of control.
So we try to explain the assessment process in a very simple way. We believe that this process is good for unexperienced auditors to practice how to assess the functioning of internal control.
To simplify our discussion, we will skip some of the processes. Example: we will skip the procedures for assessing whether:

• the control is designed to mitigate the identified significance risk,

• there are compensating controls in the absence of key controls.

For our illustration, we will use attribute testing approach, which can be used in either statistical or judgemental method and widely used in assessing control. Attribute testing approach is also applicable for assessing the internal control over financial reporting (ICoFR).
By definition, attribute is the characteristic being tested for in the population. Attributes of interest and exception conditions for audit sampling are taken directly from the auditor’s audit procedures. It means, what attributes should be exist in our sampling, and whether there are exceptions in the sampling, are resulted from the the design and the implementation of our audit procedures.
This an example of attributes of voucher, if one or more attributes is (are) not exist than there is (are) exceptions:

CASE:
To conclude the functioning of internal control, we should take the following step (note: simplified):
Client: PT DEWA ARJUNA    Year-end: 12/31/14
Audit Area: Test of controls and substantive test of transactions – billing functions:    Pop-size: 5.764

1. Define the objectives:
   Example: to test the operating effectiveness of controls, related to sales process.
2. Define the population precisely (including stratification, if any).
   Example: sales invoices for the period 1/1/14 to 10/31/14. First invoice number 3689 and last invoice number: 9452, so population size is 5.764 invoices.
3. Define the sampling unit, organization of population items, and random selection procedures.
   Example: sales invoice number: recorded in the sales journal sequentially, computer generation of random numbers. 
4. Specify the tolerable exception rate (TER).
   TER = the highest exception rate the auditor will permit in the control being tested and still be willing to conclude the control is operating effectively. Example, TER = 9%, means that even if 9% of the duplicate sales invoices are not approved for credit, the credit approval control is still effective.
   Lower TER = larger sample size. Example, a larger sample size is needed for the test of credit approval if the TER is decreased from 9% to 6%. 
5. Specify acceptable risk of assessing control risk too low (ARACR).
   Auditors using attributes sampling assign a specific amount, such as 10% or 5% risk.
   ARACR = the risk the auditor is wrong for concluding that a control is effective. For statistical sampling, it is common to use a percent, such as 5% or 10%. A low ARACR = the tests of controls are important and will correspond to a low assessed control risk and reduced substantive tests of details of balances. A larger sample size is required to lower this risk.
6. Estimate the population exception rate (EPER). 
   Auditors often use the preceding year’s audit results to estimate EPER. If prior-year results are not available, the auditor can take a small preliminary sample of the current year’s population for this purpose.
7. Determine the initial sample size.
   Four factors determine the initial sample size: population size, TER, ARACR, and EPER. In attributes sampling, auditors determine sample size by using computer programs or tables developed from statistical formulas. 
8. Develop audit procedure
Procedure audit for test of control, related to billing of customer and recording the sales in the records:

• Accounts for a sequence of sales invoices in the sales journal.
• Trace selected sales invoices numbers from the sales journal to:
• Accounts receivable master file and test for amount, date, and invoice number.
• Duplicate sales invoice and check for the total amount recorded in the journal, date, customer name, and account classification. Check the pricing, extensions, and footings. Examine underlying documents for indication of internal verification.
• Bill of lading and test for customer name, product, description, quantity, and date.
• Duplicate sales order and test for customer name, product description, quantity, date and indication of internal verification.
• Customer order and test for customer name, product description, quantity, date, and credit approval.
9. By skipping the detail process how to calculate EPER, TER, ARACR, and initial sample, then we can summarize the above steps, as follows.

Attribute No

Description of Attributes

Planned Audit

Exception Conditions

Attribute No	Description of Attributes	EPER (%)	TER (%)	ARACR (%)	Initial sample size (IS)	Exception Conditions
1	Existence of the sales invoice number in the sales journal (completeness)	0	4.0	5	74	No record of sales invoice number in the sales journal
2	Amount and other data in the master file agree with sales journal entry (posting and summarization)	1	5.0	5	93	The amount recorded in the master file differs from the amount recorded in the sales journal
3	Amount and other data on the sales invoice agree with the sales journal entry (posting and summarization)	1	5.0	5	93	Customer name and account number on the invoice differ from the information recorded in the sales journal
4	Evidence that pricing, extensions, and footing are cheked (initials and correct amounts) (accuracy)	1	5.0	5	93	Lack of initials indicating verifikation of pricing, extensions, and footings
5	Quantity and other data on the customer order agree with the sales invoice (occurance)	1.5	9.0	5	51	Quantity on the sales order differs from the quantity on the duplicate sales invoice
6	Credit is approved (occurance, valuation)	1.5	9.0	5	51	Lack of initials indicating credit approval

For example: for testing attribute 1, base on statistic table, with EPER = 0%, TER = 4%, and ARACR = 5%, then initial sample size would be 74 invoice.

10. Using an approptiate sampling method (example random or purposive), and base on sampling size determined eralier, then we take sampling data from avalaible population. For attribute 1, we take 74 invoices as our sampling.
    
    
11. Then, we conduct our audit procedures. For example: invoice no. 3787, after perfor audit procedures on invoice no.3787, we found that, all attributes are exist, except for attribute no.4 and no.6.
    

    No

    Identity of item selected

    Test of Control on Attributes

    No	Identity of item selected	1	2	3	4 = 1 exception	5	6 = 1 exception
    1	3787	Invoice number is EXIST in journal	Data in master file AGREE with journal	Data in invoice AGREE with journal	Pricing, extensions, and footing are NOT cheked	Data on customer order AGREE with invoice	Credit is NOT approved

    After testing all sampling invoices, then we get the result as follows:
    

    No

    Identity of item selected

    Attributes X = exception

    No	Identity of item selected	1	2	3	4	5	6	...
    1	3787	OK	OK	OK	X	OK	X	OK
    2	3924	OK	OK	OK	OK	OK	OK	OK
    3	3990	OK	OK	OK	X	OK	X	OK
    4	4058	OK	OK	OK	OK	OK	OK	OK
    5	4117	OK	OK	OK	OK	OK	OK	OK
    6	4222	OK	OK	OK	X	OK	X	OK
    7	4488	OK	OK	OK	OK	OK	OK	OK
    8	4635	OK	OK	OK	OK	OK	OK	OK
    9	4955	OK	OK	OK	X	OK	X	OK
    10	4969	OK	OK	OK	X	OK	X	OK
    11	5101	OK	OK	OK	X	OK	X	OK
    12	5166	OK	OK	OK	OK	OK	OK	OK
    13	5419	OK	OK	OK	OK	OK	OK	OK
    14	5832	OK	OK	OK	OK	OK	X	OK
    15	5890	OK	OK	OK	OK	OK	OK	OK
    16	6157	OK	OK	OK	OK	OK	OK	OK
    17	6229	OK	X	OK	X	OK	X	OK
    18	6376	OK	OK	OK	OK	OK	X	OK
    19	6635	OK	OK	OK	X	OK	X	OK
    20	7127	OK	OK	OK	OK	OK	OK	OK
    21	8338	OK	OK	OK	OK	OK	OK	OK
    22	8871	OK	X	OK	X	OK	X	OK
    23	9174	OK	OK	OK	OK	OK	OK	OK
    ...	9371	OK	OK	OK	X	OK	X	OK
    ...	Number of exceptions	0	2	0	10	0	12	0
    ...	Sample size	75	100	100	100	50	50	...

12. Calculate CUER
    From the result of the test, then we can determine CUER for each attribute. CUER is calculated from statistic table, by looking number of exception founds and number of sampel, with ARACR 5%.
    The CUER can be shown as follows:

Attribute No

Description of Attributes

Planned Audit

Actual Results

Attribute No	Description of Attributes	EPER (%)	TER (%)	ARACR (%)	Initial sample size (IS)	Actual sample size (AS)	Number of except ion	Sample except ion rate (SER)	CUER
1	Existence of the sales invoice number in the sales journal (completeness)	0	4.0	5	74	75	0	0	4.0
2	Amount and other data in the master file agree with sales journal entry (posting and summarization)	1	5.0	5	93	100	2	2	6.2
3	Amount and other data on the duplicate sales invoice agree with the sales journal entry (posting and summarization)	1	5.0	5	93	100	0	0	3.0
4	Evidence that pricing, extensions, and footing are cheked (initials and correct amounts) (accuracy)	1	5.0	5	93	100	10	10	16.4
5	Quantity and other data on the customer order agree with the duplicate sales invoice (occurance)	1.5	9.0	5	51	50	0	0	5.9
6	Credit is approved (occurance)	1.5	9.0	5	51	50	12	24	> 20



13. Use of sampling result
    
    • As we can see from the above table, attributes 1, 3, dan 5 has CUER < TER, and attributes 2, 4, and 6 has CUER > TER.
    • Effect on audit plan: controls tested through attributes 1, 3, and 5 can be viewed as operating effectively, given that TER equals or exceed CUER. Additional emphasis is needed in confirmation, allowance for uncollectibne accounts, cutoff tests, and price test for the financial statement audit due to results of tests attributes 2, 4, and 6.
    • Effect on Report on Internal Control: CUER exceeds TER for attributes 2, 4, and 6 These findings should be communicated to management to allow an opportunity for correction of the control deficiency to made before year-end. If timely correction is made by management, the corrected controls will be tested before year-end for purpose of reporting on internal control over financial reporting.
    • The overall result of test of control will effect the auditor conlusion on the adequacy and the effectiveness/function of internal control over financial reporting.
    • Recommendations to Management: each of exceptions should be discussed with management. Specific recommendations are needed to correct the internal verification of sales invoice to improve the approach to credit approvals.