[Anonymous]

Hi everyone,

Any help on this concept would be greatly appreciated! I use Becker and I don’t know if it’s that they aren’t explaining it right, or if it doesn’t make sense to me. It has to do with assessing control risk too high/low and increasing/decreasing substantive testing.

An example MCQ is below:

As a result of tests of controls, an auditor assessed control risk too low and decreased substantive testing. This assessment occurred because the true deviation rate in the population was:

a.

Less than the risk of assessing control risk too low, based on the auditor’s sample.

b.

More than the risk of assessing control risk too low, based on the auditor’s sample.

c.

Less than the deviation rate in the auditor’s sample.

d.

More than the deviation rate in the auditor’s sample.

The answer is:

Choice “d” is correct. If the actual deviation rate in the population exceeds the maximum deviation rate based on the sample, control risk will be understated, since the control will be less effective than sample results would indicate.

I don’t understand the concept of assessing control risk too low, and whether the auditor decides to increase or decrease substantive testing (and I’ve noticed there’s lots of questions on this concept!). I “know” that the risk of assessing it too low is an incorrect acceptance/beta risk that is ineffective, but besides memorizing that part, I really don’t understand what this means.

Thanks ahead of time! 🙂

[JeremiahFletcher]

“Assessing control risk too low” is the fancy way to say “Relying too much on management's controls.”
If management has effective controls, then we reduce our substantive testing (because if the controls are effective, it is less likely that there will be errors that we do not detect).
If their controls suck (or we assume they suck and we don't test controls) then we have to test extra sets of docs, and assuming that they come back flawless, we believe that the account balance is properly stated.
If they have great controls (like how a computer processes transactions) we can say “hey, this calculates just a few exactly correctly, so they are likely doing all of them correctly, so we just need to test a few.
Hope that helps,

AUD - 92
BEC - 89
REG - 86
FAR - 92
One and done!

[Anonymous]

azfrench,

The sample deviation rate is what the auditor guesses to be the true deviation rate, from sampling. But since the true deviation rate was higher (unknown to the auditor), the auditor has underrated the control risk.

[Anonymous]

@Jeremiah,

Thank you for wording it differently. That helps understand what they are saying when asking the question/answer. I guess I got tripped up on the “decreased substantive testing” part because if management does not have good controls, would we not increase substantive testing? Or am I focusing on the wrong idea for the question here?

Thank you to both you and @calvinus! Both of you helped me make more sense of this concept.

[waffle_house]

This is an sampling question pertaining to attribute sampling. All this question is saying is that based on the auditor's sample he determined that the control was effective so based off the sample he assessed control risk low (he relied on the control). However, based on the population the true deviation rate was greater than the tolerable rate (if the auditor actually tested every single item in the population, which he wouldn't), so in reality the control is not effective and the auditor placed too much reliance on the control based off his sample. This is sampling risk. Good to know the definitions when it comes to the sampling section of your review course.

Sorry for grammar I'm super tired.

[Anonymous]

@waffle,

No, thank you! That makes much more sense. I now understand that the “decreased substantive testing” portion means that the auditor relied on the control when they shouldn't have (thus the assessed control risk too low). I was so tired, that part was tripping me up, but I get it now, yay!

[Author]

Replies