[viperbmx03]

Hello there. I have audit coming up in a couple of days and while doing my final review prep I came across this.. If anyone can shed some light I’d appreciate it….

On http://www.cpa-exam.org – I was browsing through the sample exam and came across the below question in the simulation section where you have to pick how the scenario affects various risks:

---

“During year 2, the company instituted a new procedure whereby the internal audit department distributes payroll checks to employees for selected payroll cycles.”

---

The answer is listed below

---

Impact on component of audit risk : “Decreases Control Risk” = correct answer

However based on Becker review materials and related homework assignments I see this:

“In planning an audit, the auditor’s knowledge about the design of relevant internal controls should be used to:”

with an incorrect answer being “Document the assessed level of control risk”. The reason for this answer being incorrect is “Assessment of control risk (and documentation of that assessment) must be based on tests of controls, and not solely on knowledge about design of controls”.

---

So how can control risk be reduced just because the client had internal auditors handing out payroll checks without auditors actually testing that control and upon testing assessing if the risk should be reduced..?

Thanks!

FAR - 2008 - 73 ~ Retook 8/28/2010 ~ 92
BEC - 2008 - 86 ~ Lost it 10/23/2010 ~ 90
AUD - 2009 - 79 ~ Lost it 11/30/2010 ~ ??
REG - 1/8/2011 ~ ??

[whitesoxfancpa]

From what I remember from Becker, having internal auditors does decrease control risk.

AUD 96 FAR 95 REG 94 BEC 88

[viperbmx03]

Hm. I don't seem to recall that anywhere within Becker. I may have missed it however. If all the internal auditors are doing is surfing the web as opposed to doing their job then control risk shouldn't be lowered. I'm going to go with the assumption that you must test a control in order to reduce control risk and that the mere fact of having internal auditors doing a particular task doesn't lower the risk of control over that assertion. I don't agree with the sample question's answer. I wish they would share the logic behind their answer.

FAR - 2008 - 73 ~ Retook 8/28/2010 ~ 92
BEC - 2008 - 86 ~ Lost it 10/23/2010 ~ 90
AUD - 2009 - 79 ~ Lost it 11/30/2010 ~ ??
REG - 1/8/2011 ~ ??

[tulip]

This took some thinking, but finally I came up with this:

Having the internal auditors distribute payroll checks to the employees for selected payroll cycles decreases the control risk because this is a control procedure to verify that the employees being paid actually exist.

I was thrown off for a minute thinking it had something to do with separation of duties and the treasury function, but that wasn't it.

BEC - 10/18/2010 - 79
FAR - 10/28/2010 - 82
AUD - 11/04/2010 - 73; 02/18/2011 - 86 - IT'S OVER!!!!!!
REG - 11/21/2010 - 83

[Anonymous]

Try emailing Becker.. they will respond quickly and let you know why they came to their answer. I got a lot of “that's incorrect, the answer should be…” However, they do not put the correct answer on the updates section of their website. No lie! I remember there is an incorrect formula in A5.

[viperbmx03]

@CPA Someday – Ha do you remember which becker question had the wrong formula :)? I'm reviewing chap 5 next!

Actually I'm O.K with Becker's explanation.. My problem is with the sample question on the cpa-exam.org site.

@Tulip – How do you know if the internal auditors are doing their job if you don't test the control. I think that's what Becker is getting at as well as the accounting firm I work for. We don't lower control risk unless we tested the control and came to the conclusion that it wasn't only implemented but also operating effectively. It seems like the sample question is lowering control risk by the mere implementation or as they call it in the question “instituted a new procedure”..

FAR - 2008 - 73 ~ Retook 8/28/2010 ~ 92
BEC - 2008 - 86 ~ Lost it 10/23/2010 ~ 90
AUD - 2009 - 79 ~ Lost it 11/30/2010 ~ ??
REG - 1/8/2011 ~ ??

[tulip]

Also, I'm not sure that Becker and the sample exam differ – the company did decrease its control risk by having the internal auditors hand out the checks. How the external auditors document the level of control risk is a different issue.

BEC - 10/18/2010 - 79
FAR - 10/28/2010 - 82
AUD - 11/04/2010 - 73; 02/18/2011 - 86 - IT'S OVER!!!!!!
REG - 11/21/2010 - 83

[viperbmx03]

@Tulip – At first I also thought that perhaps the sample question is referring to the company's ‘own' assessment of control risk as opposed to the independent auditor's however after re-reading a few times I'm sure that the examiners are referring to the independent auditor's assessment of control risk as their question is about the “Impact on component of audit risk”. Audit risk is assessed by the independent auditor not the company itself as far as I know.. right?

FAR - 2008 - 73 ~ Retook 8/28/2010 ~ 92
BEC - 2008 - 86 ~ Lost it 10/23/2010 ~ 90
AUD - 2009 - 79 ~ Lost it 11/30/2010 ~ ??
REG - 1/8/2011 ~ ??

[tulip]

@viper – I see your point and agree that the company's assessment of its own risk is irrelevant.

However, in the sample exam, the statement is definitive – the internal auditors are doing ‘x', and it impacts the company's control risk in ‘y' way.

The control risk is assessed by the auditor, but its level isn't created by the work of the auditor (the “documentation”). Its level is created by what the company is doing.

BEC - 10/18/2010 - 79
FAR - 10/28/2010 - 82
AUD - 11/04/2010 - 73; 02/18/2011 - 86 - IT'S OVER!!!!!!
REG - 11/21/2010 - 83

[Anonymous]

Yes I do. I have it saved from when someone else had told me about it:

Anybody studying for Audit, Pg A5-12, evaluation example (d4) the statement should read as “The auditor is 95% sure the deviation rate does not exceed 6% (tolerable rate).

Email from the academic support:

Hi Ruchi. If the upper deviation rate is less than the tolerable rate,

…

I don't have the remainder part of the email with the explanation. Good Luck!

[Author]

Replies