[VD]

Hi,

Are auditors required to test operating effectiveness of internal control in an audit?

Thanks in advance.

[Sam]

Can you provide some context? It depends on the control and how prevalent/important it is. Sometimes yes, but other times, no. In those cases, control risk is just set at high because we aren't bothering to test it.

[CPAHOPE]

You understand and ASSESS, not TEST operating effectiveness of internal control over financial reporting. Auditors assess the internal control first to determine if they're functioning as management intend them to be. For instance, auditors assess if management have internal control that can respond to changes of external factors such as technological change, changes in GAAP and laws and regulations. Auditors also evaluate managements written self assessment on internal contol as required by PCAOB. They also assess the design of the internal control to see if its effective or not.
Once they are done with the assessment, they can now determine how MUCH to TEST the control activities within internal control to find its effectiveness. If they determine internal contol to be shitty and not working as intended, they will set control risk as high, meaning they have to set detection risk low. This means they do minimal testing on control activities and test more on substantive testing.

[CPAHOPE]

Just to add another point, if the assessment of internal control is horrendously weak, auditors do not even bother to test them.

[etm890]

It depends on whether you're talking about a private company or a public company.

For a private company, an auditor MUST “gain an understanding” of the company's internal controls and perform a walk-through to assess whether they are properly designed, implemented, and that there are no design gaps in internal controls. This is NOT testing the operating effectiveness of internal controls. A private company audit opinion does not require the testing of operating effectiveness of internal controls. The auditor may determine it can create audit efficiencies by placing reliance on the internal controls, and thus would test their operating effectiveness.

For a public company (excluding non-accelerated filers), the annual 10K requires both an audit opinion and an opinion over the Internal Controls over Financial Reporting (ICFR). Thus, you would required to perform substantive audit testing as well as testing the operating effectiveness of internal controls.

[CPAHOPE]

@etm890
Yes, theres that distinction between private vs public. As i recall, private companies arent required to test operating effectiveness of internal control. Nicely put!

[CPAHOPE]

It is examining and not testing the effectiveness of internal control over financial reporting. Using the correct word is critical in auditing. This falls under attestation engagement AT 501

Examination is similar to Audit but different in that Audit audits historical financial statement whereas Examination audits anything other than historical financial statements.

[AGI]

In general, what an auditor is expected to do depended on the industry and contract terms. It also depends if you are auditing for an opinion, a recommendation,or some other random projects. In large companies, auditors are called up to do a “certain part” of the audit instead of the full round, several teams (or even several different companies) might show up at once for various reasons.

Do as what the contract terms said.

New York - NYC
Passed CPA Exam (11/2014)
In search for a position in NYC that will fulfills the license requirement.

[CPAHOPE]

My bad guys, you do use the word test. This is how it is phrased.

Audit test of controls is a type of audit EXAMINATION on the internal control of an entity after they perform an understanding of IC over financial reporting

[Author]

Replies