Responding to Assessed Risks: Further Audit Procedures

1. From Risk Assessment to Risk Response

Remember the principle of a risk-based audit: the nature, timing, and extent of your audit work are directly driven by the risks you've identified. SA 315 helps us assess the risk, and SA 330 tells us how to respond. They are two sides of the same coin.

Let's begin with a video that positions SA 330 as the direct sequel to SA 315, explaining how your risk assessment logically leads to your audit response.

As the video highlighted, Further Audit Procedures (FAP) are composed of two key types of tests:

1. Tests of Controls (ToC)
2. Substantive Procedures

Let's explore each of these in detail.

2. Tests of Controls (ToC): Are the Controls Working?

Tests of controls are audit procedures designed to evaluate the operating effectiveness of an entity's internal controls. You're not just understanding the control design (as you did in SA 315); you are testing whether the control is actually working as intended to prevent, or detect and correct, misstatements.

A common exam question is: when must an auditor perform tests of controls? SA 330 gives two specific situations.

To summarize and build on that reading:

1. When you plan to rely on the controls: If your risk assessment assumes that controls are effective (leading to a lower assessed control risk), you must test them to justify that reliance. If you don't test them, you have no evidence to support your assessment, and you can't reduce your other testing.
2. When substantive procedures alone are not enough: This often happens in highly automated systems where transactions are initiated, recorded, processed, and reported electronically with little or no manual intervention. In such cases, simply testing the final numbers (substantive testing) might be impossible or insufficient. You have to test the system's controls to get assurance.

Designing Tests of Controls: Nature, Timing, and Extent

Once you decide to perform ToC, you must determine their nature, timing, and extent.

• Nature: How you test. This involves a mix of procedures like inspection (of documents showing the control was performed, like a signed reconciliation), observation (watching the control being performed), inquiry, and re-performance (independently executing the control yourself).
• Timing: When you test. This can be at a point in time (e.g., observing year-end inventory counting controls) or throughout the period (e.g., testing controls over monthly bank reconciliations).
• Extent: How much you test. The more you plan to rely on a control, the more persuasive evidence you need, and thus the more extensive your testing must be.

The video below explains key factors to consider when deciding the extent of your tests and discusses the crucial topic of using evidence from previous audits.

3. Substantive Procedures: The Auditor's Safety Net

Substantive procedures are designed to detect material misstatements at the assertion level. They are your direct tests of the numbers and disclosures in the financial statements.

There are two types:

• Tests of Details: Involve examining individual transactions and balances. This includes vouching, tracing, and verifying items like invoices, contracts, and physical assets.
• Substantive Analytical Procedures: Involve evaluating financial data by studying plausible relationships between both financial and non-financial data (e.g., comparing gross profit margin to prior years).

A fundamental principle of SA 330 is that substantive procedures are mandatory for each material class of transactions, account balance, and disclosure, irrespective of the assessed level of risk.

Why is this? Even if you think controls are perfect, you can never fully eliminate risk.

4. Designing Procedures for Specific Assertions

Now, let's connect these procedures to the management assertions we discussed in previous modules. The whole point of designing FAP is to gather evidence about these assertions (e.g., Occurrence, Completeness, Accuracy, Valuation, Existence).

The following image provides a great visual link between different assertions and the types of audit procedures used to test them.

Let's take a practical example to see how this works:

• Risk: The company may have recorded fictitious sales to inflate revenue.
• Assertion at Risk: The Occurrence assertion for revenue. (Are you sure the recorded sales actually happened?)
• Response (Further Audit Procedures):
  • Test of Control: You might test the company's control that requires a customer-signed delivery note before a sales invoice is raised. You would select a sample of invoices and check if they have a corresponding signed delivery note.
  • Substantive Procedure: You would select a sample of sales transactions from the sales ledger and vouch them back to supporting evidence, such as dispatch notes, delivery confirmations, and customer purchase orders.

This flowchart illustrates the methodology for designing these tests for a specific cycle like sales.

5. Application in an Exam Scenario

Let's solidify this with a classic exam-style question. This scenario tests your understanding of the mandatory nature of substantive procedures.

This example perfectly demonstrates how to structure an answer for your CA Final exam. You state the rule from the Standard, explain the underlying logic (the 'why'), and apply it to the facts of the case to draw a conclusion.

Conclusion

Today, we've moved from high-level audit strategy to the specific, detailed procedures that form the core of audit fieldwork. You've learned how to design responses to risks at the assertion level, which is a critical skill for any auditor.

Key Takeaways:

• Further Audit Procedures (FAP) are the auditor's response to risks at the assertion level and consist of Tests of Controls (ToC) and Substantive Procedures.
• Tests of Controls are performed when you intend to rely on controls or when substantive procedures alone are insufficient. Their results determine the extent of substantive testing.
• Substantive Procedures are always mandatory for material items to address the risk that your assessment was wrong or that controls were circumvented.
• The entire process is a logical flow: the risk identified (SA 315) drives the selection of procedures (SA 330), which are designed to gather evidence on specific management assertions.

Preview of the Next Lesson

We've discussed how to respond to risks in general. However, some risks are so significant that they require special attention. In our next lesson, we will focus on one such area by examining SA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements. We will distinguish between fraud and error and explore the specific procedures and mindset required when dealing with the risk of fraud.