What does further audit procedures mean on the CPA exam?
Last reviewed
Further audit procedures. The work done in response to assessed risk: tests of controls and substantive procedures. Distinct from risk assessment procedures, which come first and cannot on their own support an opinion.
Defined against AU-C 330.
Worked example
Payroll is material for a staffing firm. The auditor walks one pay run through the system, finds the two manual controls, the payroll manager's approval of each run and a monthly reconciliation to the bank, well designed and in place, and runs a planning analytic showing payroll up 4% on a 4% rise in headcount. On that evidence the auditor rates payroll as a low-risk area and plans to rely on the controls.
Has the auditor gathered enough evidence on payroll to support the opinion?
- The walkthrough and the planning analytic are risk assessment procedures. They support the low risk assessment, but on their own they cannot support the opinion.
- Because the auditor plans to rely on the controls, it must test that they operated effectively across the year, not just that they exist.
- Whatever the controls show, payroll is material, so the auditor still performs substantive procedures for its relevant assertions. With a low risk, a substantive analytic built on headcount and pay rates may be enough.
Answer: No. The auditor still performs further audit procedures: tests of the operating effectiveness of the controls it relies on, and substantive procedures on payroll.
The trap: Counting the walkthrough as a test of controls, or the planning analytic as substantive evidence. Both come before the response to risk, and no strength of control removes the need for some substantive work on a material account.
Based on AU-C 330.08; AU-C 330.18.
Which CPA exam sections use further audit procedures?
Further audit procedures appears in the AUD section of the CPA exam.
Other terms defined against AU-C 330
- dual-purpose test: One procedure that tests a control and substantively tests the transaction at the same time, on the same sample.
- nature, timing, and extent: The three dials on any audit procedure: what kind of test, when it is run, and how much of the population it covers.
- operating effectiveness: Whether a control actually worked across the period, as opposed to whether it was well designed.
- selecting specific items: Choosing particular items to examine because of what they are, such as large or unusual ones, rather than at random.
- substantive procedures: Work aimed directly at detecting misstatement in a balance or disclosure, as opposed to testing whether a control operated.
- tests of controls: Procedures that check whether a control actually operated as described throughout the period.
- tests of details: Substantive procedures aimed at individual transactions, balances or disclosures, rather than at the relationships between numbers that analytical procedures examine.
Related terms
- risk assessment procedures: The audit procedures designed and performed to identify and assess the risks of material misstatement at the financial statement and assertion levels.
- analytical procedures: Evaluations of financial information by studying plausible relationships among financial and nonfinancial data.
- audit procedures: The specific work performed: inspection, observation, inquiry, confirmation, recalculation, reperformance and analytical procedures.
- agreed-upon procedures: An engagement where the practitioner performs procedures the parties have specified and reports the findings, expressing no opinion.
- assessed risk: The auditor's judgment about the risk of material misstatement at the assertion level, combining inherent and control risk.
- internal audit: An in-house function that evaluates controls and processes and reports to those charged with governance.