ACCY 405 Chap.10 Control Evaluation and Internal Control Evidence
Control Evaluation and Internal Control Evidence
Why controls matter to an assurer
The course objectives say attesters draw on frameworks to assess internal control strengths and weaknesses.
Evidence about the design and operational integrity of controls can verify assertions indirectly, even when controls are not the subject of the engagement, and weak controls raise the risk of material misstatement, which must then be reduced with direct substantive verification.
Two different questions
Evaluating design and implementation asks whether a control could prevent or detect a material misstatement and whether it exists and is used, considering how it is carried out and recorded, how frequently it runs, what it targets and who performs it.
Testing operating effectiveness asks whether it actually worked consistently throughout the period. The second is normally done only for controls expected to pass the first.
Walkthroughs and risk points
For routine classes of transactions, a walkthrough follows a transaction from where it starts in the business, through each processing step, to the ledger.
Its purpose is to find significant risk points, places where there is more than a remote likelihood of a misstatement large enough to matter, especially for completeness and accuracy.
IT, estimates and the direction rule
General IT controls support every system; application controls sit inside a process.
The monograph flags electronic manipulation, changes to data without an identifiable journal entry, and lists what matters for estimates, from key assumptions and bias to historical accuracy.
Strong control evidence lets substantive tests rely less on direct comparisons with the business; weak evidence makes them rely more.
Controls over estimates
For accounting estimates the auditor looks at the key assumptions, whether management's bias shows in one estimate or across many taken together, the estimator's competence, how complex the process is, the quality of the inputs, how accurate past estimates proved and how uncertain the estimate is by nature.
Each of these can make a well-drafted estimate unreliable.
What this chapter covers
- 01
Controls as indirect evidence
- 02
Design and implementation
- 03
Operating effectiveness
- 04
Walkthroughs and significant risk points
- 05
General IT and application controls
- 06
Controls over accounting estimates
- 07
How control evidence changes substantive work
Worked example · free
Decide whether to test a control's operation
- 2Evaluate the control's design against the risk.
- 2Decide whether operating tests are worthwhile.
- 2State the consequence for substantive work.
Key terms
- Design and Implementation
- Whether a control could prevent or detect a material misstatement and whether it exists and is used.
- Operating Effectiveness
- Whether a control actually worked consistently throughout the period, applied by the right people.
- Walkthrough
- Tracing a transaction from its start in the business through processing to the ledger.
- Significant Risk Point
- A place in processing with more than a remote likelihood of a misstatement large enough to matter.
- General IT Controls
- Controls over operations, system software, access security and development that support every application.
- Application Controls
- Controls inside a business process over initiation, authorisation, recording, processing and reporting.
Control Evaluation and Internal Control Evidence FAQ
Why not test every control's operating effectiveness?
Because a control that is poorly designed or not implemented gives no basis for reliance even if performed perfectly. Testing its consistency would add cost without reducing the risk of misstatement.
How do controls change the substantive work an auditor does?
Strong evidence that controls transform business events into records reliably lets substantive tests rely less on direct comparisons with the business. Weak evidence means substantive tests must lean more heavily on those comparisons.
What is electronic manipulation?
Changes to data, ledger amounts or balances made without a separately identifiable journal entry. It is one reason auditors care about access and change controls in IT systems.
Can good controls replace substantive testing entirely?
No. Controls can reduce the assessed risk and the amount of substantive work, but significant risks still call for direct evidence, and a weakness found later reopens the control conclusion.
Exam move
Draw one process you know, such as ordering food online, as a chain of steps from start to record. Mark where an error could enter and name one control that would catch it and one way it could fail.
Working through Control Evaluation and Internal Control Evidence in ACCY 405? Sia is AskSia’s AI Accounting tutor — ask any ACCY 405 Control Evaluation and Internal Control Evidence question and get a clear, step-by-step explanation grounded in how ACCY 405 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
