The auditor has recorded the client's payment system. On paper it is excellent: invoices are matched, payments need two signatures and a manager reviews the bank reconciliation. But a walk-through shows that the second signature is often added days later by the finance clerk. On paper the controls would prevent loss. In practice they do not work.
Evaluating controls is the step that separates what is designed from what is done, and it decides whether the auditor can rely on the system.
This topic covers the purpose and two stages of evaluating controls, the paper review, when the auditor goes straight to substantive testing, when tests of controls are needed, the effect on the audit approach and the link to the management letter. The previous topic covered limits and recording, and the next covers the risks of IT systems.
In 30 seconds
Two stages: (1) are the controls effective on paper, in design; (2) are they applied properly, in operation. If the paper review shows major weaknesses: skip tests of controls and go to substantive testing. If controls look good on paper: test them; if they work, use a systems-based approach with reduced substantive testing. Always do some substantive testing for each material class, balance and disclosure (ISA 330). Report weaknesses in a management letter.
Key terms in plain English
| Term | What it means |
|---|---|
| Evaluation on paper | Judging whether controls would work if applied |
| Evaluation in operation | Judging whether controls actually work |
| Control risk | The risk that controls fail to prevent or detect error |
| Systems-based approach | An audit relying on tested controls |
| Transactions-based approach | An audit relying mainly on substantive tests |
| Management letter | A report to management of control weaknesses |
Syllabus check
This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:
- the techniques for evaluating internal controls
- the evaluation of internal controls in a given scenario
- the contents of a management letter
CAMA 2020 and evaluating controls
The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.
| Section | What it says | Link to this topic |
|---|---|---|
| s. 404(2) | The auditor reports on whether proper books of account have been kept | Evaluation supports this part of the report |
| s. 404(7)(c) and (d) | The audit committee reviews management findings with the auditor and keeps controls under review | The management letter goes to the committee |
| s. 407(3) | Right of access to books, accounts and vouchers | Needed to test the controls |
The rules in more depth
The purpose of evaluating controls
Having established the control systems and recorded them in the working papers, the auditor evaluates the controls and decides how effective they are. The result lets the auditor identify control risk, an element of audit risk, and then choose a systems-based or a transactions-based approach. Evaluation is a two-stage process. The auditor must establish:
- Whether the controls are effective on paper. If it can be assumed that they are applied properly, are they sufficient? This is a question of design.
- Whether the controls are applied properly, so that they are actually working. Controls adequate on paper may not be applied as intended. This is a question of operation, and the tests of controls in a later topic answer it.
The evaluation process
The auditor first gets a general picture of the effectiveness of the controls by reviewing the documentation of the system. This is the evaluation on paper. A sound method is to ask, for each control objective such as that all sales are recorded, which controls should exist, whether they do, and whether any gaps would let a material error pass unnoticed.
Strengths and weaknesses are listed for each cycle. Using the questionnaire, a pattern of yes answers shows strength and a pattern of no answers shows weakness.
- Major weaknesses on paper. The auditor will probably decide that the audit must focus on tests of transactions, which are substantive tests, and not on tests of controls. A systems-based approach is not appropriate when control risk is high. The auditor then moves straight to substantive testing and does not trouble to test controls that are plainly inadequate.
- Controls acceptable on paper. The auditor still cannot rely on them or follow a systems-based approach unless confident that they actually work. The next stage is tests of controls. If they show that the controls operate effectively, the audit can be systems-based with a reduced amount of substantive testing.
Substantive procedures are always needed
Whatever the evaluation, the auditor always performs some substantive testing, because of the inherent limitations in any control system. ISA 330 requires substantive procedures for each material class of transactions, account balance and disclosure. Controls change how much substantive work is needed and when it is done. They never remove it.
| Result of evaluation | Control risk | Approach | Substantive testing |
|---|---|---|---|
| Weak on paper | High | Transactions-based; no tests of controls | Extensive, with more at the year end |
| Good on paper, but tests of controls show they do not operate | High | Transactions-based; tests of controls wasted but findings reported | Extensive |
| Good on paper and tests show they operate | Low | Systems-based | Reduced, with more at the interim audit |
| Mixed: some cycles strong, others weak | Varies by cycle | A combination, cycle by cycle | Planned by cycle |
Evaluating by assertion
A good evaluation links each control to the assertion it addresses. An approval of purchase orders addresses the occurrence of purchases. Numerical sequence checks on despatch notes address the completeness of sales. A bank reconciliation addresses the existence and completeness of cash. If no control addresses an assertion that matters, the auditor cannot rely on controls for it and plans substantive tests of that assertion directly.
Evaluating computerised controls
For IT systems the auditor evaluates the general controls first and then the application controls. If general controls over access, program changes and operations are weak, the auditor cannot rely on automated controls that depend on them. The auditor then plans more substantive testing, perhaps using audit software to test whole populations.
Management letter
It is common practice for the external auditor to prepare a management letter for the client. It is a report, usually in columns, listing weaknesses seen in the client's internal controls, the possible consequences, recommendations and management's response. Finding control weaknesses is a by-product of the audit and not its objective.
In the illustration, details of employees leaving are sent by e-mail from personnel to payroll with no confirmation of receipt. There is no check that every e-mail is received. This could result in payments to former employees. The recommendation is sequentially numbered e-mails with a confirmation for each received. Management's response is: agreed, a new control to be installed at once. A later topic covers the letter in full.
A worked evaluation for one cycle
Consider the cash receipts cycle. Objectives: all cash received is recorded, banked intact and promptly, and posted to the right accounts. Controls that should exist:
- an independent person opens the post and lists receipts
- takings are banked daily
- the cashier does not post the ledger
- the bank reconciliation is done by someone other than the cashier and reviewed
If the post is opened by the cashier alone and the reconciliation is done by the cashier, the key controls over completeness are missing and the auditor cannot rely on them. The auditor goes to substantive tests on completeness of receipts, such as examining post-year-end receipts and testing the bank reconciliation in detail.
If instead the controls exist, the auditor tests a sample over the year to confirm that they operate before reducing substantive work.
Worked examples
Example 1: paper review. The recorded system shows that the same clerk raises, approves and pays supplier invoices.
- The design is weak on paper: no segregation, no authorisation.
- The auditor does not test controls but moves straight to extensive substantive testing of purchases and payables.
Example 2: paper good, practice poor. The system requires two approvals but a sample of 40 payments shows that 15 had one approval.
- On paper the controls were adequate; tests show they do not operate effectively.
- Control risk is high and substantive testing increases; the deviation is reported to management.
Example 3: systems-based. A company has strong controls over payroll, and tests of 60 payroll runs found no deviations.
- The auditor assesses control risk as low for payroll.
- Substantive tests on payroll are reduced, but not removed.
Example 4: mixed. Sales controls are strong, but inventory controls are weak.
- The auditor uses a systems-based approach on sales and a transactions-based approach on inventory.
- More work is planned at the year end for inventory.
How to score full marks
- State the two stages: on paper and in operation.
- Say what the auditor does if the paper review is poor and what if it is good.
- End with the point that substantive testing is always needed.
- Name the management letter as the way weaknesses are reported.
Common mistakes in the exam
- Testing controls that are plainly weak on paper.
- Relying on controls without testing them.
- Saying strong controls remove the need for substantive tests.
- Treating finding weaknesses as the objective of the audit.
Quick revision
- Two stages: design on paper, then operation.
- Weak on paper: go to substantive testing.
- Good on paper: test the controls; if they work, systems-based.
- Always some substantive testing.
- Report weaknesses in a management letter.
Practice questions
Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.
Question 1. The first stage of evaluating controls is whether they are effective:
- On paper
- By tax law
- In practice only
- By fees
Show the answer
A. Design on paper.
Question 2. If the controls are weak on paper, the auditor should:
- Go straight to substantive testing
- Test the controls fully
- Stop the audit
- Rely on them
Show the answer
A. Tests of controls would be wasted.
Question 3. If controls appear good on paper, the next step is:
- Tests of controls
- The report
- No work
- Fee negotiation
Show the answer
A. To check they operate.
Question 4. A systems-based audit means:
- Reduced substantive testing based on tested controls
- No testing
- Testing every transaction
- Only analytics
Show the answer
A. Reliance on controls.
Question 5. ISA 330 requires substantive procedures for:
- Each material class of transactions, balance and disclosure
- Only large items
- Nothing
- Only cash
Show the answer
A. Always some.
Question 6. A management letter reports:
- Weaknesses in internal control
- The audit fee
- The audit opinion
- The tax due
Show the answer
A. And recommendations.
Question 7. Finding control weaknesses is:
- A by-product of the audit
- The main objective
- Illegal
- Not reported
Show the answer
A. Not the main objective.
Question 8. If general IT controls are weak, the auditor:
- Cannot rely on automated controls
- Relies fully on them
- Skips testing
- Ignores IT
Show the answer
A. They depend on the general controls.
Question 9. A control that exists but is not applied has failed in:
- Operation
- Design
- Tax
- Presentation
Show the answer
A. Design may be adequate.
Question 10. Mixed assessments across cycles lead to:
- A different approach for each cycle
- The same approach for all
- No audit
- Only analytics
Show the answer
A. Cycle-by-cycle planning.
Question 11 (10 marks). Explain the two stages of the evaluation of internal controls and the effect of the results on the audit approach. (8 marks)
Question 12 (10 marks). Explain why substantive procedures are always required even where controls are assessed as strong. (4 marks)
Question 13 (10 marks). Describe a management letter and give an example of an entry. (8 marks)
Model answers
Show the model answer to Question 11
Stage one: effective on paper, in design; stage two: applied properly, in operation, tested by tests of controls. (3) If weak on paper, go to substantive testing; if good on paper and tests confirm, systems-based with reduced substantive testing. (3) Mixed results are handled cycle by cycle. (2)
Show the model answer to Question 12
Controls have inherent limits (error, override, collusion, cost); ISA 330 requires substantive procedures for each material class, balance and disclosure; controls change only the amount and timing. (4)
Show the model answer to Question 13
A report to management, usually in columns, listing weaknesses in internal controls, the consequences, recommendations and management response. (4) Example: leaver details e-mailed to payroll with no confirmation of receipt; payments could be made to former employees; recommendation of numbered e-mails and confirmations; management agrees. (4)
Spotted a mistake? Tell us and we will check it.
