Limit Audit Procedures When Controls Are Strong

By Kenneth Boyd, Lita Epstein, Mark P. Holtzman, Frimette Kass-Shraibman, Maire Loughran, Vijay S. Sampath, John A. Tracy, Tage C. Tracy, Jill Gilbert Welytok

The whole point of doing a test of internal controls is for you to rely on your results to reduce the extent of your substantive procedures. Substantive procedures involve checking the client’s financial statement facts, such as confirming a customer’s accounts receivable balance by directly contacting the customer. Face it: If internal controls are strong, you (and your firm) don’t want to do unnecessary work.

A positive evaluation of internal controls influences the nature, extent, and timing of the audit procedures in these ways:

  • Nature: The types of audit procedures include inspection, observation, inquiry, confirmation, analytical procedures, and re-performance. With good internal controls, you concentrate the nature of your procedures on checking for completeness, occurrence, and accuracy. Ask yourself the following questions to verify these aspects:

    • Completeness: Are all transactions included that took place during the year being audited?

    • Occurrence: Did all transactions the client includes actually take place?

    • Accuracy: Are the transactions fairly reported?

    Analytical procedures compare what you expect to see versus what actually happens. For example, you review the ebbs and flows of financial statement results quarter by quarter. Sudden spikes or drop-offs should be explainable. Comparing budgeted figures to actual numbers is another analytical procedure.

  • Extent: The better a client’s internal controls, the fewer records you have to test.

  • Timing: The question here is whether certain audit procedures must be done at the end of the audit year. When internal controls are strong, interim results may suffice. In other words, the substantive procedures you conduct during your interim tests of controls may be sufficient for accounts with good internal controls, reducing the amount of year-end procedures you have to do.

For lower-risk accounts with good internal controls, you may need only to round out your tests of controls with analytical procedures that address the completeness, occurrence, and accuracy of transactions.