Tests of controls and the main transaction cycles

Every audit of a trading company comes back to three cycles: sales, purchases and payroll. They produce most of the transactions, they feed most of the balance sheet, and they are where controls matter most. The auditor does not memorise control lists for each. The auditor learns one method: ask what could go wrong, what the control must achieve, what controls would do it and how to test them. That method works on any system an examiner invents.

This topic covers planning tests of controls, computer-assisted audit techniques and test data, the major transaction cycles, the risk-objective-control-test method, tests of controls in smaller entities and exam technique. The next topics apply the method to each cycle.

Key terms in plain English

Syllabus check

This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:

• the techniques for evaluating internal controls: walk-through, compliance test, substantive test
• internal controls in a computerised accounting environment
• evaluating internal controls in a given scenario

CAMA 2020 and tests of controls

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

Planning tests of controls

The auditor takes a systems-based approach wherever possible. The focus is on testing the systems and controls that produce the figures, not the figures themselves. If the systems and controls are satisfactory, the figures they produce should be reliable. Two conditions must be met first:

1. The systems and controls must be designed to minimise the risk of misstatement. The auditor checks this in the documentation and evaluation of the controls.
2. The systems and controls must operate effectively. The auditor gets evidence of this from tests of controls.

A test of control is a procedure done to get evidence that a control operated effectively during the period. It differs from a walk-through, which checks understanding, and from a substantive test, which checks figures. The auditor decides the nature, timing and extent of the tests from the assessed risk and the planned reliance.

Computer-assisted audit techniques

Where systems use IT, the auditor may need special ways of getting evidence. Computer-assisted audit techniques (CAATs) are any techniques that let the auditor use IT systems as a source of evidence. CAATs are often necessary because IT systems may not give an adequate audit trail, and because processing is invisible. The auditor has to "get inside the computer" to check completeness and accuracy. Two commonly used types are:

• Audit software, which is more relevant to substantive testing and is covered later.
• Test data, which is most relevant to tests of control.

Test data means the auditor processes a sample of data through the client's system and compares the results with results worked out in advance. It gives evidence of the operation of specific application controls. A problem is that it gives evidence only at the time the data is processed. To deal with this, procedures may be written into the client's system to generate test data every time the process runs.

One way to avoid corrupting the client's files is to set up an extra "dummy" department to which the test data results are allocated, with access only for the auditor.

Disadvantages of CAATs: they can be expensive, so their use should be judged on cost and benefit. Costs include buying or developing programs, keeping them up to date with changes in hardware and software, and training audit staff. CAATs are of no value unless the auditors are properly trained to use them.

Test data for the Dolally sales system. (1) Input a dummy order for goods that are out of stock and check that no dispatch note is produced. (2) Input a dummy order for goods that are in stock, check that a dispatch note is produced, view it on screen and trace it to the copy in the distribution centre.

(3) Input dummy dispatch notes without flagging them for invoicing and check that they appear on the exception report. (4) Flag dummy dispatch notes and check that invoices are raised.

The major transaction cycles

The auditor focuses much of the work on the major transaction cycles, which together cover most of the day-to-day transactions:

• Sales (revenue);
• purchases; and
• payroll.

These affect both the statement of financial position and the income statement. Tests of control also apply to key statement of financial position headings linked to the main cycles: bank and cash, inventory, and revenue and capital expenditure on non-current assets. The following topics set out for each cycle the risks, control objectives, controls and tests. The lists are guides and are not complete.

The method: risks, objectives, controls and tests

1. Risks. What could go wrong in processing so that the statements are not true and fair? For sales: not all goods dispatched are invoiced.
2. Control objectives. What must the controls achieve or prevent? Eliminate or reduce the risk. For sales: all dispatches are invoiced.
3. Controls. Devise controls that achieve the objective. The ISA 315 categories are a good checklist: performance reviews, application controls (authorisation, arithmetic and accounting controls), general IT controls, physical controls and segregation of duties.
4. Tests of controls. If the controls look adequate, devise tests of whether they work, using inspection, observation, enquiry, confirmation, recalculation and reperformance, and test data for computer systems.

If there are obvious weaknesses, the auditor tells management. In an answer, explain why the control is needed and how the test shows it is effective. A table is a good layout.

Tests of controls in smaller entities

Control systems in smaller entities are usually less sophisticated because of limited resources, and proper segregation of duties is often very hard. Senior management or the owner is often heavily involved in control. The auditor looks for "minimum business controls", which are identified, recorded and tested as in any other system.

The auditor is unlikely to be able to use the controls of a small entity as the basis of a systems-based approach, so a large amount of substantive testing is likely. The controls may still give assurance on certain aspects, for example the completeness of the accounting records.

Exam technique: generating controls and tests

You do not need to learn all the lists, because each business and system differs. Apply the general method. Think what could go wrong, to get the risks; what controls must achieve, to get the objectives; what controls would prevent or detect the problem; and how to test them.

Example: fast-food chain. Six standard meals are ordered weekly by the restaurant managers from head office, and unused meals are returned at the end of each week for disposal.

Controls to prevent losses are:

• a monthly reconciliation by each manager of meals bought, sold and returned
• agreement of meals sold to the sales figure, because a difference could indicate theft
• investigation by head office of returns that are above a set level, which may show over-ordering or falling demand
• investigation of very low returns, which may show customers turned away for lack of stock
• strict physical controls such as refrigerated lorries and working refrigerators
• authorisation limits for orders by each branch, based on budgets and past use
• surprise stock counts by head office

Consequences and controls when invoices are wrong. If invoices have the wrong prices or quantities, sales and receivables will be misstated, goodwill may be lost if customers are overcharged, correction will delay payment and may cause cash flow problems, undercharged amounts may never be recovered, and goods may go to customers who would have been over their credit limit if charged correctly.

The controls are to check each invoice to the dispatch note, price list and agreed discounts and to check the arithmetic; or, in an IT system, automatic invoicing with strong physical controls over master files and good general IT controls; edit checks such as field and range checks on data entry; independent authorisation of changes to customer details and price lists; and printing and review of amendments to standing data.

Worked examples

1. Risk: goods received are not recorded, so liabilities are understated.
2. Objective: all goods received are recorded.
3. Control: goods received notes are numbered and matched to supplier invoices; unmatched notes are reviewed weekly.
4. Test: inspect a sample of weekly reviews; check the sequence of notes for gaps.

1. Input a dummy payroll record with an invalid code.
2. Check that the system rejects it and produces an error report, as expected.

1. This is a minimum business control and can be tested by inspecting evidence of the owner's approval on a sample of large payments.
2. It does not support a systems-based approach for the whole audit, so substantive testing remains extensive.

1. The cost outweighs the benefit for such a small population.
2. Manual testing is more cost-effective.

How to score full marks

• Use the four-column method: risk, objective, control, test.
• Explain why each control is needed and how the test shows it works.
• Match procedures to tests: inspection, observation, enquiry, recalculation, reperformance.
• For IT mention test data and audit software.

Common mistakes in the exam

• Giving tests of controls that are really substantive tests of balances.
• Listing controls with no risk.
• Memorising lists instead of applying the method.
• Ignoring the cost of CAATs.

Quick revision

• Systems-based: design adequate and operating effectively.
• CAATs: audit software and test data; costs and training.
• Cycles: sales, purchases, payroll, plus cash, inventory, assets.
• Method: risk, objective, control, test.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.