ISA 330 - The Auditor's Responses to Assessed Risks

Question 1

ISA 330: The Auditor’s responses to assessed risks

Answer 1

ISA 330: The Auditor’s responses to assessed risks

This article considers the requirements of ISA 330,The Auditor’s Responses to Assessed Risks. The main objective of ISA 330 is to give guidance on how auditors should obtain sufficient appropriate evidence regarding the assessed risks of material misstatement by designing and implementing appropriate responses to those risks. UK and Irish students should note that there are no significant differences between ISA 330 and the UK and Ireland version of this standard.

Of central importance to both ISA 315 (Revised 2019) and ISA 330 is the recognition that assessing risk is at the core of the audit process, and these two ISAs specify that the auditor is required to obtain an understanding of the risk relevant to the financial statements. Paragraph 6 of ISA 330 requires that:

‘The auditor shall design and perform further audit procedures whose nature, timing, and extent are based on and are responsive to the assessed risks of material misstatement at the assertion level.’

Question 2

ISA 330: Definitions

Answer 2

Definitions

ISA 330 requires that auditors should carry out tests of control and substantive procedures, and paragraph 4 of the ISA gives the definitions shown inTable 1.

Students often find it quite difficult to comprehend what tests of control and substantive procedures are, to explain the difference between them, and also to give examples of both. One important difference between them is that tests of control are usually short, quick tests which generate either a ‘yes’ or a ‘no’ answer, where ‘yes’ is favourable (confirming the operation of an internal control), and ‘no’ is unfavourable (indicating that an internal control is not operating satisfactorily). Substantive procedures, however, as the name suggests, are more substantive and time consuming, requiring more detailed audit work to be carried out. The following examples, in the context of a purchases system, should help

Question 3

ISA 330: Tests of control – examples for a purchases system

Answer 3

Tests of control – examples for a purchases system

Consider when the auditor reviews a company’s purchases system and internal controls, and the assertion of occurrence (that recorded purchases represent goods and services received and which pertain to the entity). An appropriate internal control would be that purchase orders are raised for each purchase and are authorised by appropriate senior personnel.

Question 4

Table 1: ISA 330 tests of control and substantive procedures definitions

Answer 4

Table 1: ISA 330 tests of control and substantive procedures definitions

Test of control:
An audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detectingand correcting, material misstatementsat the assertion level.

A test of control would be to examine a sample of purchase orders to ensure that they have been appropriately authorised. A ‘yes’ answer would confirm that the internal control requiring authorisation of purchase orders is working, whereas a ‘no’ answer would indicate that the internal control does not appear to be working, hence requiring further audit investigation.

Another example of a test of control for a purchases system would be to inspect a sample of goods received notes to confirm that stores inwards staff sign for goods received. Once again, a ‘yes’ answer is positive, confirming that staff have signed the goods received note and a ‘no’ answer would be negative, requiring further audit work to be carried out to determine why the goods received note had not been signed. This test of control would also help to confirm the occurrence assertion.

Substantive procedure:
An audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detectingand correcting, material misstatementsat the assertion level.An audit procedure designed to detectmaterial misstatements at the assertionlevel. Substantive procedures comprisetests of details (of classes of transactions, account balances and disclosures) and substantiveanalytical procedures.

Question 5

ISA 330: Substantive procedures and tests of detail – overview

Answer 5

Substantive procedures and tests of detail – overview

ISA 330 requires that the auditor shall always carry out substantive procedures on material items irrespective of the assessed risks of material misstatement, and that the auditor shall design and perform substantive procedures for each material class of transactions, account balance, and disclosure. According to the IAASB Glossary of Terms 1, substantive procedures fall into two categories, ‘tests of details’ and ‘substantive analytical procedures’ (or simply ‘analytical procedures’, as they are usually described). ISA 330 says that auditors must decide when it is most appropriate to use which type of substantive procedure. Analytical procedures are outside the scope of this current article and the examples given below are examples of tests of details.

Question 6

ISA 330: Substantive Procedures – examples of tests of detail for a purchases system:

Answer 6

Substantive procedures – examples of tests of detail for a purchases system

Substantive procedures will invariably tend to involve more work than tests of control. Consider once again the example of the purchases system for a manufacturing company and the assertion of existence for account balances in the statement of financial position. Typical tests of detail would involve some physical verification of year-end balances outstanding, which would require obtaining and reviewing the closing purchase ledger account balances for a sample of purchase ledger accounts with selected suppliers. Typically, this could include agreeing the closing balance figure to the supplier’s statement, or even possibly requesting third party confirmation by the supplier of the amount outstanding.

Cut-off testing would also be typically carried out on year-end purchase ledger balances, which would involve obtaining a sample of pre- and post - year-end goods received notes and agreeing these to the matching pre- or post-year-end purchase invoices, to ensure that only goods received before the end of the accounting period were included. This test would also help to confirm the assertion of existence.

Question 7

ISA 330: Timing:

Answer 7

Timing

ISA 330 indicates that the auditor may perform tests of control or substantive procedures at an interim date or at the period end. If substantive testing is performed at an interim date then additional substantive procedures alone or combined with tests of control are required for the intervening period. This will provide a reasonable basis for extending the audit conclusions from interim date to the period end.

The standard also indicates that, in general, the extent of audit procedures increases as the risk of material misstatement increases

Question 8

ISA 330: Overall responses:

Answer 8

Overall responses

ISA 330 lists the following overall responses that may be used by auditors in order to address the assessed risks of material misstatement at the financial statement level:

Emphasising to the audit team the need to maintain professional scepticism.

Assigning more experienced staff, those with special skills, or using experts.

Changes to the nature, timing and extent of direction and supervision of members of the engagement team and the review of the work performed.

Incorporating additional elements of unpredictability in the selection of further audit procedures to be performed.

Changes to the overall audit strategy as required by ISA 300 or planned audit procedures, and may include changes to:

The auditor’s determination of performance materiality in accordance with ISA 320.

The auditor’s plans to test the operating effectiveness of controls, and the persuasiveness of audit evidence needed to support the planned reliance on the operating effectiveness of the controls, particularly when deficiencies in the control environment or the entity’s monitoring activities are identified.

The nature, timing and extent of substantive procedures. For example, it may be appropriate to perform substantive procedures at or near the date of the financial statements when the risk of material misstatement is assessed as higher.

Question 9

ISA 330: Summary

Answer 9

Summary

Assessing risk lies at the core of the audit process and this article has introduced and explained some of the terminology used by ISA 330, giving guidance to auditors on how to respond to assessed risks.

In general, tests of control are short, quick audit tests, whereas substantive procedures will require more detailed audit work. ISA 330 requires that, irrespective of the assessed risks of material misstatement, the auditor shall design and perform substantive procedures for each class of transactions, account balance and disclosure.

Finally, students should try to identify tests of control and substantive procedures for the main accounting systems.

Reference
(1)IAASB Auditing Handbook 2010, Glossary of Terms.