@Mouse – you need to do more m/c and simulations on internal control and audit evidence to understand what procedures to perform to gather the relevant evidence to satisfy balance sheet, transaction related, and disclosure F/S objectives. You kinda have to do enough m/c to know which procedures to perform for every major cycle – like liabilities, revenue, A/R, A/P, cash receipts/disbursements, payroll, fixed assets, and investments. Memorizing the audit procedure to go with each relevant assertion for each cycle or account is not good enough, cause it's so subjective, and you just need to see enough practice questions to see the life cycle of an audit. Also, know when you use analytical procedures, which accounts they are likely to be used on, and how to use them to design further audit procedures (nature, extent, and timing). For example, you might start out doing analytical procedures of revenue to gauge initial control deficiencies and gaps in operational processes. Then, during fieldwork you're gonna test a sample of A/R. What do you do? You're supposed to get confirmations. What if the confirmations aren't correct? Then you're supposed to perform additional procedures. What if the evidence still isn't good enough? Then you might do analytical procedures of the valuation accounts (those subject to a lot of management estimates/bias/subjectivity). Be aware of bad segregation/overlapping of duties (incorrect authorizations, management that is lying, committing fraud, negligent, or making aggressive, un-substantiated assertions). Any time they do that, you always need to follow up with additional evidence and document whenever their integrity is questionable to governance. Once your fieldwork testing uncovers all material misstatements, before you can know the the audit procedures that will detect those misstatements in the future, you have to know the preventative and detective controls that will detect and prevent that misstatement from happening again, as well, as needing to identify that control gap and which accounts or transactions that misstatement will happen again in the future. For non-subjective balances, you can do that through confirmations, examinations and reviews of documentation. For testing and understanding the design of controls, you can do that through walkthroughs and inquiry, observation, examination. For understanding effectiveness and implementation, that is reperformance, in addition to inquiry, observation, and examination. But if there is no documentation, and IT evidence is impossible to get, then you can only rely on inquiries of management, and very observant and document everything that comes out of managements mouth and look for anything questionable, omitted, or incomplete in their explanations or procedures, and ask a ton of questions, until you are satisfied with complete audit evidence.
.