Using the PCAOB, was the engagement teams assessment of the evaluation of the design of each control appropriate? Does the control identified by the team address the specific risk of material misstatement and associated assertion?
Identification of risk of material misstatement All orders shipped are not recorded as revenue. Relevant assertion Completeness. Significant risk? No. Risk of material misstatement because of No. fraud? Control #1: Sales are automatically recorded and invoices are automatically generated upon the release of the Control activity that addresses risk of material order in the Warehouse K-Series System. Orders are not released until the goods have been confirmed for misstatement shipping in the system (which occurs when the goods are scanned as they are loaded in the shipping area). Does the control rely on information used in No. the control (or IUC)? If yes, list relevant information Will we obtain audit evidence of the accuracy N/A and completeness of information used in the control by testing controls? Is the control automated? Yes Relevant application system (if we are testing Warehouse K System, which is subject to IT controls performed by management and tested within the IT controls information used in the control through tests workpaper. of controls or the control is automated) On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The control is the automation of the invoicing of goods shipped the system will automatically record revenues when goods are shipped from the warehouse (revenue generating activity), thus resulting in no shipped goods going unrecorded in the system that appropriately addresses the related risk of material misstatement and assertion. 2. Automated control prevents errors from occurring as opposed to identifying them once they have occurred Tests of controls: evaluation of design (preventive control). 3. Control operates at the transaction level and, as such, is sufficiently precise mitigate the risk. 4. Control is performed on a continual basis and thus addresses the risk directly and for the period under audit. 5. There are no historical issues with the operation of the control and the control has not been modified in the period under audit. Risk Associated with the Control Not Higher Interim Procedures (test as of 9/30): 1. As this is an automated control, we will perform a test of one and follow one transaction through the system to make sure the automated control is operating effectively. 2. In addition, we will verify the understanding through testing of general IT controls; i.e., program change controls that there have been no changes to the control since the previous year. Tests of controls: planned operating effectiveness testing Rollforward Procedures: 1. Make inquiries of the controller and the IT manger to determine if any events have occurred that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) after our interim testing date. If any significant changes are noted, retest control. Identification of risk of material misstatement All orders shipped are not recorded as revenue. Relevant assertion Completeness. Significant risk? No. Risk of material misstatement because of No. fraud? Control #1: Sales are automatically recorded and invoices are automatically generated upon the release of the Control activity that addresses risk of material order in the Warehouse K-Series System. Orders are not released until the goods have been confirmed for misstatement shipping in the system (which occurs when the goods are scanned as they are loaded in the shipping area). Does the control rely on information used in No. the control (or IUC)? If yes, list relevant information Will we obtain audit evidence of the accuracy N/A and completeness of information used in the control by testing controls? Is the control automated? Yes Relevant application system (if we are testing Warehouse K System, which is subject to IT controls performed by management and tested within the IT controls information used in the control through tests workpaper. of controls or the control is automated) On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The control is the automation of the invoicing of goods shipped the system will automatically record revenues when goods are shipped from the warehouse (revenue generating activity), thus resulting in no shipped goods going unrecorded in the system that appropriately addresses the related risk of material misstatement and assertion. 2. Automated control prevents errors from occurring as opposed to identifying them once they have occurred Tests of controls: evaluation of design (preventive control). 3. Control operates at the transaction level and, as such, is sufficiently precise mitigate the risk. 4. Control is performed on a continual basis and thus addresses the risk directly and for the period under audit. 5. There are no historical issues with the operation of the control and the control has not been modified in the period under audit. Risk Associated with the Control Not Higher Interim Procedures (test as of 9/30): 1. As this is an automated control, we will perform a test of one and follow one transaction through the system to make sure the automated control is operating effectively. 2. In addition, we will verify the understanding through testing of general IT controls; i.e., program change controls that there have been no changes to the control since the previous year. Tests of controls: planned operating effectiveness testing Rollforward Procedures: 1. Make inquiries of the controller and the IT manger to determine if any events have occurred that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) after our interim testing date. If any significant changes are noted, retest control
