[barelystayingsane]

Is testing of controls necessary for the assessment of control risk?

Originally, I had thought it wasn’t, but in reviewing my notes, I came across an MCQ explanation that I had written down that said that assessment of control risk must be based on tests of controls and not solely on knowledge about the design of controls.

I was under the impression that you only had to test controls when you were performing an integrated audit of an issuer/nonissuer, when you were going to base your risk assessment on the effective functioning of internal control, or in cases such as IT controls.

Can someone please clarify this for me?

Thank you!

[Never_Give_Up1]

If you are auditing a public company then yes every year.

Only time you should not test internal controls is when the risk is so high that only substantive testing will satisfy the audit procedures. In most cases if you cant rely on internal controls often times a team will withdraw from the engagement because the risk is so high.

FAR - 81
REG - 81
AUD - 82
BEC - 81

Ethics - Done
State License Exam - Done

License - Licensed CPA in Utah

[Author]

Replies