The purpose of test of control is to provide reasonable assurance that the

Our sites

• myACCA
• ACCA mail
• ACCA Careers
• ACCA Career Navigator
• ACCA Learning Community
• Your Future

Useful links

• Make a payment
• ACCA-X online courses
• Find an accountant
• ACCA Rulebook
• News
• Work for us

Most popular

• Professional insights
• ACCA Qualification
• Member events and CPD
• Supporting Ukraine
• Past exam papers

In order for an audit firm to be able to provide reasonable assurance and issue an opinion on an organization’s compliance with SOC 1 or SOC 2 audits, they have to test the internal controls that each organization has in place and verify that they are working as intended. To do this, auditors typically perform three types of tests of controls: interviews, reviews, and observations.

1. Interview: Interviews play a critical role in an assessment because auditors are able to talk to an organization’s employees – the people responsible for effectively implementing your internal controls. During the interview, auditors will want to find that an organization’s employees have an understanding of the purpose of the controls they’re responsible for and how they have been trained to effectively implement them.
2. Review: During an audit, auditors need to ensure that organizations are doing what they say they’re going to do, and to verify that this is happening, they’ll want to review documentation, such as policies and procedures. For example, if an organization’s policies and procedures say that when they hire employees, they are put through initial security awareness training and then are to take courses annually thereafter, an auditor will want to see documentation, such as completion reports, to ensure this is taking place.
3. Observation: While interviewing and physically reviewing documents allow auditors to test an organization’s internal controls, observing how those controls are implemented is also a way auditors can verify that controls are implemented and functioning as intended. For example, if your organization claims that you use antivirus software that updates every day, every four hours, an auditor would want to observe that that is taking place.

To find out how your auditor completed these tests of controls, organizations can refer to the section in their audit report labeled “Auditor’s Test of Controls.” This is where audit firms disclose what they did to test an organization’s controls and how they based their opinion upon those tests.

Video Transcription

In your audit report, you’ll see a section that’s titled “Auditor’s Test of Controls.” This is the section where we disclose what we did and what we used to base our opinion upon. We’re trying to achieve that level of reasonable assurance and our tests help us to get there. There are three types of tests that we typically perform here at KirkpatrickPrice: review, observation, and interview. Interview is where we talk to your employees, the people who are responsible for your controls. We make sure that they understand the purpose of the control and what it is that they’ve been trained to do to execute their tasks at their job. Review is usually reviewing documentation. If you state that you have a policy that governs your information security practices or you have a policy that governs your hiring and termination practices, you have training materials that your employees follow after they’re hired and annually thereafter, we will review evidence of that documentation and those policies to make sure that those things are in place, enforced, and updated on an on-going basis. Finally, we have observation as a test of control. This is where you might say to us, “We have put this system in place to monitor the health of our network. We have this software development lifecycle that our developers follow. We have antivirus installed and it updates every day every four hours.” These are things that we will observe in order to make sure the controls are actually there, in place, and operating effectively. Anytime that we perform these tests and we find something that’s not working the way it’s supposed to, we bring those issues to management and let you know about those things immediately, so that you can remediate anything that’s critical in nature.

Tags: Auditing Basics

Share this entry

• Share on Facebook
• Share on Twitter
• Share on Linkedin
• Share by Mail

//kirkpatrickprice.com/wp-content/uploads/2019/05/Auditing_Basics_Auditors_Test_of_Controls_700x500_png_rCCPCeBq.jpg

Why is the primary purpose of tests of controls?

The aim of tests of control in auditing is to determine whether these internal controls are sufficient to detect or prevent risks of material misstatements. A robust internal control system is essential for businesses to keep their financial records accurate.

Which of the following is ordinarily considered a test of a control audit procedure?

Which of the following is ordinarily considered a test of a control? Obtain or prepare reconciliations of bank accounts as of the balance sheet date.

Which of the following is considered a control environment factor by the COSO definition?

Control environment factors include the integrity, ethical values and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility and organizes and develops its people; and the attention and direction provided by the board of directors.

Which is most likely to be considered a limitation of internal control?

While a company performs the control function, it involves the judgment of many individuals, and their different perspectives on the same problem can be considered as an inherent limitation of the internal control.