@cparunner210 The question is asking what caused the auditor to over-rely on the IC. It was caused by the auditor's sample results. The auditor thought that s/he could rely on the IC because the the sample results showed a deviation rate that was below the Tolerable Deviation Rate (aka “maximum deviation rate based on the sample”), BUT the actual deviation rate in the population is far more than the sample's deviation rate. That is an “uh-oh” moment. How did the auditor find that out?
By testing the control.
The auditor finds out whether the CR was set too low by testing the control itself. Remember, if the auditor is choosing to rely on a control, the auditor has to do a ToC on that control to justify reliance on the control. The auditor needs some level of assurance on whether to rely on a control in order to reduce the amount of substantive testing. The ToC becomes a waste of time because the IC is not working. The auditor's efforts are ineffective by doing too little SUB testing as well.
If we flip this scenario around, it would be auditor under-reliance on the IC done by assuming that the sample results show a deviation rate that is more than the Tolerable Deviation Rate (maximum deviation rate), BUT the actual deviation rate in the population is below the sample's deviation rate. The auditor's efforts are inefficient by doing way too much SUB testing than needed to get to the proper assessment.
Key is to think that there are checks and balances built into the risk model. Hope this helps. Back to beating compilation report forms into my head. Ach
.