Risk Assessment and Internal Control - Test 4: answer key

Question 1 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s Sharma & Associates has been appointed statutory auditor of Delta Engineering Pvt Ltd, a family-owned fabrication business operating one factory and two warehouses. The company has grown quickly, but it has no formal accounting manual, written purchase procedure or documented delegation matrix. The proprietor approves large payments verbally, while routine purchases are initiated by the production supervisor and recorded by a single accounts clerk. During the preliminary review, the audit team finds that some goods-received notes are missing and the proprietor is reluctant to permit interviews with warehouse employees, stating that the accounting clerk can explain the entire system. The team needs to record how purchase requests originate, who selects suppliers, how goods are received and inspected, who approves invoices, how payments are released and how entries reach the ledger. A senior suggests preparing a detailed written description of the system actually in operation after walkthroughs and observation. Another team member proposes a graphical representation to show the flow of documents, inventory and cash between departments. The audit manager also considers circulating a structured set of questions to the responsible executives, with answers of Yes, No or Not Applicable and explanatory notes for negative responses. Separately, staff are asked to use an on-the-job set of instructions and initial each completed item. Management has provided an old purchase-policy document that does not reflect current practice. The engagement partner therefore cautions the team against treating written policies as proof that controls are implemented. The team must select appropriate methods to document the actual system, identify gaps and decide which matters require further testing before the control risk assessment is finalised.

The audit manager wishes to prepare a complete written description of Delta Engineering's purchase and payment system as it actually operates. Given the absence of formal procedures, which method would be most appropriate, and what precaution is essential?

1. Use an internal control questionnaire and accept management's Yes responses as conclusive evidence of the actual functioning of the system.
2. Use a check-list containing standard instructions and assume that completion of every item establishes the existence of an effective control.
3. Use a narrative record based on actual testing and observation, documenting the complete system as found in operation. (correct answer)
4. Use a flow chart prepared exclusively from the organisation chart, without examining actual transaction-processing procedures.

Answer: C — Use a narrative record based on actual testing and observation, documenting the complete system as found in operation.

Explanation. ICAI Study Material, Chapter 3, §6.2(A), describes a narrative record as a complete and exhaustive description of the system as found in operation. Actual testing and observation are necessary before developing it. This method is particularly suitable for small businesses and situations where no formal control system exists. A manual or management explanation alone cannot establish actual practice. Questionnaires, check-lists and flow charts are alternative documentation methods, but they do not replace verification of the system actually operating.

Where it goes wrong. Confusing a description of the prescribed system with a description of the system actually operating.

Authority. SA 315; SA 330

Question 2 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The audit manager proposes sending structured questions to Delta Engineering's executives, requesting Yes, No or Not Applicable answers with explanations for negative responses. Several answers appear inconsistent with the missing goods-received records. What is the most appropriate subsequent action?

1. Discuss the inconsistencies with the concerned employees, investigate apparent weaknesses and prepare a report of deficiencies and recommendations. (correct answer)
2. Accept all Yes responses, since management's written answers establish that the procedures were properly designed and implemented.
3. Replace all negative answers with Not Applicable responses, because missing documents do not necessarily indicate control deficiencies.
4. Treat each unanswered question as evidence of fraud and immediately conclude that the entire accounting system is unreliable.

Answer: A — Discuss the inconsistencies with the concerned employees, investigate apparent weaknesses and prepare a report of deficiencies and recommendations.

Explanation. ICAI Study Material, Chapter 3, §6.2(C), explains that an Internal Control Questionnaire is generally completed by concerned executives, with Yes indicating a satisfactory position, No suggesting weakness and Not Applicable covering irrelevant questions. Apparent inconsistencies must be discussed with employees to obtain a clear picture. The auditor subsequently prepares a report of deficiencies and recommendations. Management's answers are not conclusive evidence of effective operation, and a negative response does not automatically establish fraud.

Where it goes wrong. Treating questionnaire responses as final audit evidence instead of investigating inconsistencies and negative answers.

Authority. SA 315; SA 330

Question 3 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The engagement partner wants a concise representation of how purchase requests, goods receipts, invoices, approvals, payments and accounting entries move between departments. Which evaluation method would most suitable satisfy this requirement?

1. Prepare a narrative record describing each employee's responsibilities in several pages of chronological written explanations.
2. Prepare a check-list containing standard questions about purchase approvals and invoice processing for the audit staff.
3. Prepare an internal control questionnaire requesting Yes, No or Not Applicable responses from the concerned executives.
4. Prepare a flow chart graphically representing the system, providing a concise overview of transaction flows and control weaknesses. (correct answer)

Answer: D — Prepare a flow chart graphically representing the system, providing a concise overview of transaction flows and control weaknesses.

Explanation. ICAI Study Material, Chapter 3, §6.2(D), describes a flow chart as a graphic presentation of each part of the internal control system. It is regarded as the most concise method of recording the auditor's review and provides a bird's-eye view of transaction flows and their integration. Potential gaps and improvements can be spotted easily. Narrative records provide detailed written descriptions, whereas check-lists and questionnaires are primarily question-based documentation techniques.

Where it goes wrong. Confusing the detailed written description of a system with its concise graphical presentation.

Authority. SA 315; SA 330

Question 4 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

An audit junior is instructed to verify whether purchase orders are pre-numbered, whether tenders are invited and whether inventory accounting is maintained independently of inventory custody. The junior must initial each completed instruction. Which method is being used?

1. A narrative record, because the junior is preparing an exhaustive written description of all purchase activities.
2. A check-list, because the auditor follows predefined instructions and initials each completed item during the review. (correct answer)
3. An internal control questionnaire, because management is required to complete a comprehensive questionnaire about its procedures.
4. A flow chart, because the auditor is graphically presenting the sequence of documents and approvals.

Answer: B — A check-list, because the auditor follows predefined instructions and initials each completed item during the review.

Explanation. ICAI Study Material, Chapter 3, §6.2(B), defines a check-list as a series of instructions and/or questions that an audit staff member must follow or answer. The staff member initials the space against each completed instruction, and answers are generally Yes, No or Not Applicable. Unlike an Internal Control Questionnaire, which is generally issued to the client for completion by concerned executives, a check-list is an on-the-job requirement for the audit staff.

Where it goes wrong. Confusing a check-list completed by audit staff with an Internal Control Questionnaire completed by client personnel.

Authority. SA 315; SA 330

Question 5 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s V. Raman & LLP is auditing Zenith Manufacturing Pvt Ltd, a producer of industrial pumps. The company's written procedure requires every supplier invoice above ₹5 lakh to be matched with a goods-received note and approved by the finance controller before posting. The approval is evidenced by a dated electronic workflow stamp. During the design review, the auditor confirms that the prescribed workflow, if followed, would prevent invoices from being posted without the required matching and approval. Management therefore requests that the auditor classify the control as effective without further work. The engagement team plans to rely on the control in determining the nature, timing and extent of substantive procedures. It selects a sample of transactions from April to August and inspects workflow evidence. In September, the finance controller resigns and a replacement is appointed. The company also experiences a sharp seasonal increase in purchases during October and November. In several sampled transactions, the approval stamp is absent, although the accounts manager claims that verbal approvals were obtained. Management refuses to provide a list of transactions processed during the controller transition, saying that extracting it would disrupt operations. The audit manager must distinguish whether the control is suitably designed from whether it actually operated throughout the period. The team must also determine whether inquiry alone can support reliance, whether its testing should cover the personnel transition and seasonal peak, and whether the preliminary control risk assessment remains justified if deviations are confirmed. Any revised assessment may affect the substantive audit procedures planned for purchases and trade payables.

The prescribed supplier-invoice approval workflow is appropriately designed to prevent posting without matching and authorisation. Management argues that this establishes effective internal control for the entire year. Which response is technically correct?

1. The auditor must separately obtain evidence about operating effectiveness, because suitable design does not establish that the control operated consistently throughout the period. (correct answer)
2. The auditor may conclude that the control is effective because a properly designed workflow automatically establishes compliance with the prescribed approval procedure.
3. The auditor should consider only the design of the control because operating effectiveness is management's responsibility and outside audit procedures.
4. The auditor should disregard the control because a documented authorisation procedure cannot provide relevant evidence about financial reporting.

Answer: A — The auditor must separately obtain evidence about operating effectiveness, because suitable design does not establish that the control operated consistently throughout the period.

Explanation. SA 330 and ICAI Study Material, Chapter 3, §7, distinguish between obtaining evidence about the design of internal controls and obtaining evidence about their operation throughout the period. A suitably designed procedure indicates that the control could prevent or detect misstatements if properly implemented and followed. It does not establish consistent operation. Management's documentation is therefore insufficient to support reliance without appropriate tests of controls examining actual performance and deviations.

Where it goes wrong. Confusing suitability of control design with evidence that the control operated effectively during the audit period.

Authority. SA 330

Question 6 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Zenith's auditor intends to rely on supplier approval controls when determining substantive procedures. Which circumstance creates an express requirement under SA 330 to design and perform tests of controls?

1. Management has provided a written accounting manual describing the approval procedure, although the auditor does not intend to rely on it.
2. The purchase department has formally communicated its responsibilities, even though substantive procedures can independently provide sufficient appropriate evidence.
3. The auditor expects the relevant controls to operate effectively and intends to rely on them, or substantive procedures alone cannot provide sufficient appropriate evidence. (correct answer)
4. The auditor has identified a material purchase balance and therefore intends to replace every substantive procedure with a test of controls.

Answer: C — The auditor expects the relevant controls to operate effectively and intends to rely on them, or substantive procedures alone cannot provide sufficient appropriate evidence.

Explanation. SA 330, paragraph 8, requires the auditor to design and perform tests of controls when the risk assessment includes an expectation that relevant controls are operating effectively and the auditor intends to rely on them, or when substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level. A written manual or a material balance alone does not automatically create this requirement. The purpose is to obtain sufficient appropriate evidence about the operating effectiveness of relevant controls.

Where it goes wrong. Assuming that tests of controls are compulsory for every documented control, irrespective of the auditor's intended reliance or evidence requirements.

Authority. SA 330

Question 7 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The auditor has tested Zenith's approval control from April to August. The finance controller was replaced in September, and purchase transactions increased substantially during October and November. What should the auditor do?

1. Accept the earlier testing because changes in responsible personnel and seasonal transaction volumes cannot affect the operating effectiveness of an established control.
2. Make specific inquiries, investigate the changes and ensure that tests appropriately cover the personnel transition and significant seasonal fluctuation. (correct answer)
3. Discontinue tests of controls and assume that management's verbal explanation establishes effective operation during the remaining months.
4. Restrict testing to the year-end date because evidence obtained at that date necessarily establishes operation throughout the financial year.

Answer: B — Make specific inquiries, investigate the changes and ensure that tests appropriately cover the personnel transition and significant seasonal fluctuation.

Explanation. ICAI Study Material, Chapter 3, §7, requires consideration of how controls were applied and by whom they were applied. It recognises changes in key personnel, significant seasonal fluctuations and human error as possible causes of deviations. When deviations or changes are identified, the auditor should make specific inquiries, particularly about the timing of personnel changes, and ensure testing appropriately covers the affected period. Testing only the earlier months would not support reliance over the remaining period.

Where it goes wrong. Assuming that evidence obtained before a change in personnel automatically supports reliance after the change.

Authority. SA 315; SA 330

Question 8 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The accounts manager claims that missing supplier approval stamps were replaced by verbal approvals. The engagement team proposes relying on inquiries of the accounts manager and controller. Which alternative provides a more appropriate basis for evaluating operating effectiveness?

1. Accept the verbal explanations because inquiry is sufficient whenever management identifies the person responsible for the control.
2. Obtain a written representation confirming the approvals and treat it as conclusive evidence that the control operated throughout the year.
3. Inspect the company's organisation chart and conclude that the finance controller was authorised to approve every supplier invoice.
4. Combine inquiries with inspection of supporting approval evidence or reperformance of relevant control procedures, as appropriate. (correct answer)

Answer: D — Combine inquiries with inspection of supporting approval evidence or reperformance of relevant control procedures, as appropriate.

Explanation. SA 330 and ICAI Study Material, Chapter 3, §8.1, require procedures in addition to inquiry when testing operating effectiveness. Inquiry alone is insufficient. Inspection of supporting documents can establish whether required approvals were actually evidenced, while reperformance can independently test whether a control was correctly executed. Written explanations and organisation charts do not demonstrate that individual transactions received the prescribed approval. The auditor should select procedures appropriate to the nature of the control and evidence required.

Where it goes wrong. Treating inquiry or a written management explanation as sufficient evidence of operating effectiveness.

Authority. SA 330

Question 9 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s K. Mehta & Co is conducting the statutory audit of Suryodaya Retail Ltd, which operates 75 stores and processes daily cash collections through store-level cash offices. Company policy requires each store to reconcile cash receipts with point-of-sale reports every day, while the regional finance team reviews bank reconciliations monthly. The head office also performs an annual physical inventory count on 31 March, with independent count supervisors assigned to each store. The auditor intends to rely on the daily cash reconciliation and monthly bank reconciliation controls throughout the financial year. However, the audit team initially tests only transactions from the final quarter. The team discovers that two regional accountants were transferred in July, and the replacement staff received no documented training. In addition, the festive season caused transaction volumes to increase substantially between October and December. At one store, management cannot produce signed daily reconciliations for several weeks, while the regional manager states that the reviews were performed informally. The inventory count procedure, by contrast, is designed to operate specifically on the year-end count date. The engagement partner asks the team to distinguish between a control that operates at a particular point in time and controls on which reliance is intended over an entire period. The team must assess how frequently each control is performed, how long reliance is planned, the expected rate of deviation and the relevance of evidence from other controls. It must also investigate whether the staffing changes and seasonal fluctuations require additional coverage. The findings may require a revision of control risk and changes to the nature, timing and extent of substantive procedures over cash, bank balances and inventory.

The auditor intends to evaluate Suryodaya's control over the annual physical inventory count conducted specifically on 31 March. Which approach to timing is most appropriate?

1. Test the inventory-count control at several randomly selected dates during the year because every internal control must operate continuously.
2. Test the inventory-count control only during the first quarter because early testing establishes its operation at the reporting date.
3. Obtain evidence relating to the particular year-end inventory-count date because evidence about a control operating at one point in time may be sufficient. (correct answer)
4. Avoid testing the inventory-count control because physical inventory verification is exclusively a substantive procedure and cannot involve internal controls.

Answer: C — Obtain evidence relating to the particular year-end inventory-count date because evidence about a control operating at one point in time may be sufficient.

Explanation. SA 330, paragraph 11, and ICAI Study Material, Chapter 3, §8.2, require testing controls for the particular time or period for which reliance is intended. Evidence relating to a point in time may be sufficient where the control itself operates at a specific time, such as the entity's physical inventory-count control at the reporting date. It would be inappropriate to assume that testing at an unrelated earlier date establishes the control's functioning on 31 March.

Where it goes wrong. Applying a full-period testing approach to a control that is specifically designed to operate at one identifiable point in time.

Authority. SA 330

Question 10 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The auditor intends to rely on daily cash reconciliations and monthly bank reconciliations throughout the financial year. Testing has so far been restricted to the final quarter. What is the most appropriate response?

1. Extend testing to obtain evidence that the controls operated effectively at relevant times throughout the period on which the auditor intends to rely. (correct answer)
2. Retain the final-quarter sample because controls operating effectively at year-end are presumed to have operated effectively earlier.
3. Restrict further testing to the month immediately preceding the audit report because earlier transactions are no longer relevant.
4. Replace all tests of controls with management representations because daily reconciliation is an internal administrative activity.

Answer: A — Extend testing to obtain evidence that the controls operated effectively at relevant times throughout the period on which the auditor intends to rely.

Explanation. SA 330, paragraph 11, and ICAI Study Material, Chapter 3, §8.2, require the auditor to test controls for the particular time or throughout the period for which reliance is intended. When reliance is planned throughout the financial year, evidence should support operation at relevant times during that period. A sample confined to the final quarter does not automatically establish consistent functioning throughout the earlier months. The auditor must obtain appropriate evidence covering the intended period of reliance.

Where it goes wrong. Assuming that successful control testing at year-end automatically establishes effective operation throughout the year.

Authority. SA 330

Question 11 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The audit senior is determining the appropriate extent of tests over Suryodaya's monthly bank reconciliations. Which combination of factors is specifically relevant under the study material?

1. Only the monetary amount of the bank balance and the number of bank branches maintained by the company.
2. Only management's confidence in the finance department and the number of employees assigned to reconciliation work.
3. Only the number of reconciliation statements available at year-end and the audit firm's previous experience with retail clients.
4. Control frequency, the period of intended reliance, expected deviations, evidence reliability and evidence from related controls. (correct answer)

Answer: D — Control frequency, the period of intended reliance, expected deviations, evidence reliability and evidence from related controls.

Explanation. SA 330, paragraph 10, and ICAI Study Material, Chapter 3, §8.1, identify relevant factors in determining the extent of tests of controls. These include the frequency of control performance, the length of the period of intended reliance, expected deviation rates, relevance and reliability of evidence, and evidence obtained from testing other related controls. The auditor should not determine sample extent solely by considering the monetary balance or management's confidence.

Where it goes wrong. Selecting the extent of control testing solely by reference to account balance size without considering the frequency and expected reliability of the control.

Authority. SA 330

Question 12 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Several weeks of signed daily reconciliations are missing, and two regional accountants were replaced during the year. The auditor's preliminary assessment assumes that the reconciliation control operated effectively. What is the most appropriate course of action?

1. Retain the original assessment because missing signatures are administrative deviations that cannot affect control risk.
2. Investigate the deviations, determine whether the original control risk assessment remains supported and modify substantive procedures if necessary. (correct answer)
3. Accept the regional manager's verbal assurance and avoid additional procedures because the company has a documented reconciliation policy.
4. Treat the reconciliation control as permanently ineffective and automatically issue a modified audit opinion without evaluating its consequences.

Answer: B — Investigate the deviations, determine whether the original control risk assessment remains supported and modify substantive procedures if necessary.

Explanation. SA 330, particularly its requirements concerning evaluation of test results, together with ICAI Study Material, Chapter 3, §7, requires the auditor to investigate control deviations and assess their implications. If the deviations do not support the preliminary control risk assessment, that assessment must be revised unless other tests provide sufficient supporting evidence. The auditor should then modify the nature, timing and extent of planned substantive procedures. Missing documentation does not automatically require a modified opinion.

Where it goes wrong. Assuming that every control deviation has no consequence or, conversely, automatically requires a modified audit opinion.

Authority. SA 330

Question 13 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s Rajan & Co is auditing a small trading business where purchasing, inventory receipt and payment procedures are performed informally by a proprietor and three employees. No formal procedure manual exists. The auditor wants an exhaustive description of the system as actually found in operation. Which method and limitation should be recognised?

M/s Rajan & Co is auditing a small trading business where purchasing, inventory receipt and payment procedures are performed informally by a proprietor and three employees. No formal procedure manual exists. The auditor wants an exhaustive description of the system as actually found in operation. Which method and limitation should be recognised?

1. Narrative record; it is suitable for small businesses but may make the system difficult to comprehend and weaknesses difficult to identify. (correct answer)
2. Check-list; it is suitable because it automatically records every transaction and eliminates the need for observation.
3. Internal control questionnaire; it is suitable because management's Yes responses provide an exhaustive description of actual procedures.
4. Flow chart; it is suitable because graphical representation provides every operational detail without requiring further explanations.

Answer: A — Narrative record; it is suitable for small businesses but may make the system difficult to comprehend and weaknesses difficult to identify.

Explanation. ICAI Study Material, Chapter 3, §6.2(A), describes narrative records as complete and exhaustive descriptions of the system as found in operation. They are particularly appropriate for smaller businesses and situations without a formal control system. However, their disadvantages include difficulty in comprehending the system, identifying weaknesses and incorporating changes caused by personnel reshuffling. A flow chart is more concise, but a graphical overview does not necessarily provide an exhaustive written description.

Where it goes wrong. Assuming that narrative records are always the most effective documentation method despite their difficulties in identifying gaps and incorporating changes.

Authority. SA 315; SA 330

Question 14 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. An audit partner is reviewing the documentation methods used for a large manufacturing client's purchase and payment cycle. The partner wants to identify missing authorisation stages and understand how documents and materials move between departments. Which method would be most useful?

An audit partner is reviewing the documentation methods used for a large manufacturing client's purchase and payment cycle. The partner wants to identify missing authorisation stages and understand how documents and materials move between departments. Which method would be most useful?

1. A narrative record containing an exhaustive written description of each employee's responsibilities and daily activities.
2. A check-list containing standard questions about purchasing procedures to be completed and initialled by audit staff.
3. An internal control questionnaire requesting written Yes, No and Not Applicable responses from responsible executives.
4. A flow chart showing the graphical movement of documents, materials and transactions across departments and control points. (correct answer)

Answer: D — A flow chart showing the graphical movement of documents, materials and transactions across departments and control points.

Explanation. ICAI Study Material, Chapter 3, §6.2(D), explains that a flow chart gives a bird's-eye view of the internal control system and presents transaction flows and their integration concisely. It helps identify gaps and suggest improvements. Narrative records provide extensive written details, whereas check-lists and questionnaires are question-based documentation methods. In a complex manufacturing environment, graphical representation can make missing approval stages and disconnected transaction flows easier to identify.

Where it goes wrong. Choosing a lengthy written description when the audit objective is to understand transaction flows and their interrelationships.

Authority. SA 315; SA 330

Question 15 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A statutory auditor proposes issuing a comprehensive questionnaire annually to concerned executives. The auditor expects that the responses will assist in identifying control weaknesses and ensuring that significant review procedures are not overlooked. Which statement correctly describes this method?

A statutory auditor proposes issuing a comprehensive questionnaire annually to concerned executives. The auditor expects that the responses will assist in identifying control weaknesses and ensuring that significant review procedures are not overlooked. Which statement correctly describes this method?

1. It is a check-list because audit staff must initial every instruction after performing the corresponding audit procedure.
2. It is a narrative record because every employee must describe the complete system in chronological written form.
3. It is an Internal Control Questionnaire, which provides an orderly and comprehensive means of identifying control deficiencies. (correct answer)
4. It is a flow chart because the answers received from employees automatically create a graphical representation of transaction flows.

Answer: C — It is an Internal Control Questionnaire, which provides an orderly and comprehensive means of identifying control deficiencies.

Explanation. ICAI Study Material, Chapter 3, §6.2(C), describes an Internal Control Questionnaire as a comprehensive series of questions concerning internal control and a widely used method of collecting information about its existence, operation and efficiency. It reduces the likelihood of overlooking significant review procedures, allows systematic evaluation and provides an orderly means of disclosing deficiencies. A check-list is generally an on-the-job instruction for audit staff, whereas a questionnaire is generally completed by client personnel.

Where it goes wrong. Confusing the questionnaire's systematic collection of information with the auditor's internal check-list.

Authority. SA 315; SA 330

Question 16 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. While reviewing an audit file, the engagement partner observes a series of purchase-control instructions completed by audit assistants. Each assistant has initialled the relevant instruction after checking whether tenders were invited and purchase orders were pre-numbered. Which explanation is correct?

While reviewing an audit file, the engagement partner observes a series of purchase-control instructions completed by audit assistants. Each assistant has initialled the relevant instruction after checking whether tenders were invited and purchase orders were pre-numbered. Which explanation is correct?

1. The auditors have prepared a narrative record because each initialled instruction constitutes part of a written description of actual control procedures.
2. The auditors have used a check-list, which is an on-the-job series of instructions or questions completed and initialled by audit staff. (correct answer)
3. The auditors have prepared an Internal Control Questionnaire because client executives must respond to the auditor's written questions.
4. The auditors have prepared a flow chart because each initialled instruction represents the movement of an individual transaction.

Answer: B — The auditors have used a check-list, which is an on-the-job series of instructions or questions completed and initialled by audit staff.

Explanation. ICAI Study Material, Chapter 3, §6.2(B)-(C), distinguishes a check-list from an Internal Control Questionnaire. A check-list consists of instructions or questions followed and answered by audit staff, who initial completed items. An Internal Control Questionnaire is normally issued to the client and completed by concerned executives and employees, with explanations for No responses. The fact that both methods may contain Yes, No or Not Applicable answers does not make them identical.

Where it goes wrong. Focusing on the Yes/No response format while overlooking who completes the document and for what purpose.

Authority. SA 315; SA 330

Question 17 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor evaluates the control system of a service company and intends to reduce the extent of substantive testing by relying on a documented approval control. Which requirement must be satisfied before such reliance is justified?

An auditor evaluates the control system of a service company and intends to reduce the extent of substantive testing by relying on a documented approval control. Which requirement must be satisfied before such reliance is justified?

1. The auditor must obtain written confirmation from management that the control was designed and applied throughout the financial year.
2. The auditor must establish that the control was documented in the accounting manual before the commencement of the financial year.
3. The auditor must obtain sufficient appropriate evidence about the control's operating effectiveness for the period of intended reliance. (correct answer)
4. The auditor must verify that the control was approved by the board, irrespective of whether it was followed by responsible employees.

Answer: C — The auditor must obtain sufficient appropriate evidence about the control's operating effectiveness for the period of intended reliance.

Explanation. SA 330, paragraphs 8-10, requires tests of controls where the auditor intends to rely on their operating effectiveness. ICAI Study Material, Chapter 3, §§7 and 8.1, explains that evidence must address how the control was applied, its consistency during the period and who performed it. A documented policy, written representation or board approval does not independently establish operating effectiveness. The auditor must obtain sufficient appropriate evidence to justify the planned reliance.

Where it goes wrong. Treating formal approval or documentation as a substitute for evidence of actual operating effectiveness.

Authority. SA 330

Question 18 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. A company requires the finance controller to authorise every supplier payment exceeding ₹10 lakh. The auditor wishes to verify whether this control actually operated for selected transactions. Which procedure would be most directly relevant?

A company requires the finance controller to authorise every supplier payment exceeding ₹10 lakh. The auditor wishes to verify whether this control actually operated for selected transactions. Which procedure would be most directly relevant?

1. Inspect supporting payment documents and verify that the required controller authorisation was obtained before payment. (correct answer)
2. Read the company's organisation chart and conclude that the finance controller has responsibility for payment authorisation.
3. Obtain a verbal explanation from the controller and assume that each payment was processed according to prescribed procedures.
4. Compare the current year's total supplier payments with the previous year without examining individual authorisation evidence.

Answer: A — Inspect supporting payment documents and verify that the required controller authorisation was obtained before payment.

Explanation. SA 330 and ICAI Study Material, Chapter 3, §7, recognise inspection of supporting documents as a test of controls. Where operating effectiveness is evidenced through documentation, the auditor may inspect the documents to verify that prescribed approvals were actually obtained. An organisation chart or management explanation may indicate intended responsibility but does not establish that specific payments were authorised. Substantive analytical comparison of annual payment totals also does not directly test the operation of this approval control.

Where it goes wrong. Confusing evidence of assigned responsibility with documentary evidence that a specific authorisation control actually operated.

Authority. SA 330

Question 19 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor tests the operation of a warehouse access control. The control leaves no documentary audit trail, and the auditor wishes to establish who actually permits entry into restricted inventory areas. Which procedure is most appropriate?

An auditor tests the operation of a warehouse access control. The control leaves no documentary audit trail, and the auditor wishes to establish who actually permits entry into restricted inventory areas. Which procedure is most appropriate?

1. Inspect the warehouse procedure manual and assume that the designated security officer performs the control in practice.
2. Obtain written management representation identifying the security officer without verifying the actual practice.
3. Inspect annual inventory valuation reports and infer whether restricted warehouse access was appropriately controlled.
4. Combine inquiries with observation to establish who actually performs the access control and how it operates in practice. (correct answer)

Answer: D — Combine inquiries with observation to establish who actually performs the access control and how it operates in practice.

Explanation. SA 330 and ICAI Study Material, Chapter 3, §7, recognise inquiry and observation as useful procedures for controls that leave no audit trail. The auditor must establish who actually performs the control, rather than merely who is supposed to perform it. Inspecting a manual or obtaining written management representations would only establish the prescribed arrangement. Observation of actual entry procedures, together with appropriate inquiries, provides more relevant evidence about the control's operation.

Where it goes wrong. Assuming that the employee named in the control manual is necessarily the person actually performing the control.

Authority. SA 330

Question 20 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. The audit partner increases the planned reliance on a monthly reconciliation control and wishes to obtain more persuasive evidence regarding its operating effectiveness. Which approach is most appropriate?

The audit partner increases the planned reliance on a monthly reconciliation control and wishes to obtain more persuasive evidence regarding its operating effectiveness. Which approach is most appropriate?

1. Reduce the number of transactions tested because greater reliance on a control decreases the need for audit evidence.
2. Increase the extent of testing where appropriate and obtain more persuasive evidence about the effectiveness of the control. (correct answer)
3. Perform inquiry alone because a senior employee's explanation becomes more reliable when the auditor intends greater reliance.
4. Restrict procedures to the last reconciliation because the most recent performance establishes the control's historical consistency.

Answer: B — Increase the extent of testing where appropriate and obtain more persuasive evidence about the effectiveness of the control.

Explanation. SA 330 and ICAI Study Material, Chapter 3, §8.1, explain that when more persuasive evidence is needed regarding a control's operating effectiveness, it may be appropriate to increase the extent of testing and the degree of reliance. The more reliance placed on control effectiveness, the more persuasive evidence the auditor needs. Inquiry alone is insufficient, and one recent reconciliation cannot establish consistent performance throughout the period. The auditor must design the procedures according to the intended level of reliance.

Where it goes wrong. Assuming that greater intended reliance permits reduced testing or that inquiry alone becomes sufficient.

Authority. SA 330

Question 21 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. During testing of a payroll approval control, the auditor discovers that the responsible payroll manager was replaced midway through the year. The replacement manager used a different approval process. What should the auditor consider when evaluating the test results?

During testing of a payroll approval control, the auditor discovers that the responsible payroll manager was replaced midway through the year. The replacement manager used a different approval process. What should the auditor consider when evaluating the test results?

1. The auditor should investigate the timing and implications of the personnel change and ensure that testing appropriately covers the period affected. (correct answer)
2. The auditor should disregard the change because the payroll approval procedure existed before and after the manager's replacement.
3. The auditor should test only the replacement manager's procedures because the earlier period is covered by the predecessor's responsibility.
4. The auditor should assume that the replacement manager followed the prescribed control because management continued the same payroll policy.

Answer: A — The auditor should investigate the timing and implications of the personnel change and ensure that testing appropriately covers the period affected.

Explanation. ICAI Study Material, Chapter 3, §7, requires attention to how controls were applied and by whom they were applied. Changes in key personnel may cause deviations from prescribed procedures. When such changes are identified, the auditor should make specific inquiries about their timing and ensure that tests of controls appropriately cover the affected period. The mere continuation of a written payroll policy does not prove that both managers applied the control consistently.

Where it goes wrong. Assuming continuity of a written control policy establishes continuity in its actual operation despite changes in responsible personnel.

Authority. SA 315; SA 330

Question 22 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. During a walkthrough of a company's purchase cycle, the auditor observes that the prescribed approval control is included in the workflow and is actually used for the selected transaction. The auditor intends to rely on the control throughout the year. Which conclusion is most appropriate?

During a walkthrough of a company's purchase cycle, the auditor observes that the prescribed approval control is included in the workflow and is actually used for the selected transaction. The auditor intends to rely on the control throughout the year. Which conclusion is most appropriate?

1. The walkthrough conclusively establishes that the control operated consistently for all transactions throughout the financial year.
2. The walkthrough establishes only the existence of the purchase department and provides no evidence about the control's implementation.
3. The walkthrough may provide evidence about design and implementation, but further evidence may be necessary to establish effectiveness throughout the period. (correct answer)
4. The walkthrough automatically establishes that substantive testing of the purchase cycle is no longer necessary.

Answer: C — The walkthrough may provide evidence about design and implementation, but further evidence may be necessary to establish effectiveness throughout the period.

Explanation. SA 315 and SA 330, read with ICAI Study Material, Chapter 3, §§7 and 8.1, recognise that procedures undertaken to understand the accounting and internal control systems may also provide evidence about control design and operation. However, evidence from one walkthrough does not necessarily establish consistent operation throughout the entire period. Where the auditor intends to rely on a control throughout the year, sufficient evidence covering the relevant period must be obtained.

Where it goes wrong. Treating evidence from a single walkthrough as conclusive evidence of the control's operating effectiveness throughout the year.

Authority. SA 315; SA 330

Question 23 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor initially assesses the design of an invoice-verification control and finds that it is appropriately structured to detect duplicate invoices. However, testing reveals that several invoices were processed without the prescribed verification. Which distinction is most relevant?

An auditor initially assesses the design of an invoice-verification control and finds that it is appropriately structured to detect duplicate invoices. However, testing reveals that several invoices were processed without the prescribed verification. Which distinction is most relevant?

1. The control is necessarily effective because an appropriately designed control automatically prevents all duplicate invoice payments.
2. The control may be suitably designed, but the auditor has identified weaknesses in its actual implementation or operating effectiveness. (correct answer)
3. The control is necessarily irrelevant because duplicate-invoice verification cannot form part of a purchase accounting system.
4. The control should be treated as effective because substantive testing can always replace testing of internal controls when deviations occur.

Answer: B — The control may be suitably designed, but the auditor has identified weaknesses in its actual implementation or operating effectiveness.

Explanation. SA 330 and ICAI Study Material, Chapter 3, §7, require evidence regarding both the design of the accounting and internal control system and its operation throughout the period. A control may be appropriately designed to prevent or detect duplicate invoices but fail when responsible personnel do not apply it. The auditor must evaluate the deviations and assess whether control risk requires revision. A suitable design alone does not justify reliance on an inadequately operating control.

Where it goes wrong. Confusing a control's ability to prevent misstatements when properly applied with evidence that employees actually applied it.

Authority. SA 330

Question 24 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. An auditor finds that a bank reconciliation control is performed monthly. The auditor intends to rely on it throughout the financial year and has identified an expected deviation rate higher than originally anticipated. Which conclusion regarding the extent of testing is most appropriate?

An auditor finds that a bank reconciliation control is performed monthly. The auditor intends to rely on it throughout the financial year and has identified an expected deviation rate higher than originally anticipated. Which conclusion regarding the extent of testing is most appropriate?

1. Testing should remain unchanged because the control's monthly frequency alone determines the appropriate sample size.
2. Testing should be reduced because deviations are expected and therefore do not require additional audit attention.
3. Testing should be limited to one monthly reconciliation because the existence of a recurring control establishes its operating consistency.
4. The auditor should reconsider the extent of testing by considering control frequency, expected deviations and the reliability of available evidence. (correct answer)

Answer: D — The auditor should reconsider the extent of testing by considering control frequency, expected deviations and the reliability of available evidence.

Explanation. SA 330 and ICAI Study Material, Chapter 3, §8.1, identify frequency of control performance, the period of intended reliance, expected deviation rate and relevance and reliability of audit evidence as factors governing test extent. A monthly control may require testing across multiple periods, particularly when deviations are expected. The auditor cannot determine the sample size solely from the fact that the control is performed regularly. The extent must reflect the degree of assurance required.

Where it goes wrong. Assuming that recurring performance of a control automatically justifies a limited test sample irrespective of expected deviations.

Authority. SA 330

Question 25 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. While obtaining an understanding of a company's bank reconciliation system, the auditor makes inquiries, observes the reconciliation process and inspects selected supporting statements. The evidence indicates that the control is appropriately designed and has operated effectively for the relevant assertion. Can these procedures also serve as tests of controls?

While obtaining an understanding of a company's bank reconciliation system, the auditor makes inquiries, observes the reconciliation process and inspects selected supporting statements. The evidence indicates that the control is appropriately designed and has operated effectively for the relevant assertion. Can these procedures also serve as tests of controls?

1. Yes, provided the evidence obtained is sufficient to support the auditor's control risk assessment at a level below high. (correct answer)
2. No, because any procedure originally performed to understand internal control cannot subsequently be used as a test of control.
3. No, because only reperformance of the entire bank reconciliation process can provide evidence about control effectiveness.
4. Yes, automatically, because every risk assessment procedure necessarily establishes both the design and operating effectiveness of every relevant control.

Answer: A — Yes, provided the evidence obtained is sufficient to support the auditor's control risk assessment at a level below high.

Explanation. SA 315 and SA 330, together with ICAI Study Material, Chapter 3, §7, recognise that procedures performed to obtain an understanding of the accounting and internal control systems may also provide evidence about control design and operating effectiveness. Such evidence may be used as a test of controls when it is sufficient to support a control risk assessment below a high level. However, this is not automatic; the auditor must evaluate the relevance and sufficiency of the evidence obtained.

Where it goes wrong. Assuming either that understanding procedures can never serve as tests of controls or that every understanding procedure automatically provides sufficient operating-effectiveness evidence.

Authority. SA 315; SA 330