AUD · Assessing Risk and Developing a Planned Response · 6 practice questions
Audit Response to Midyear Control Failures
When exceptions undermine planned reliance, reassess affected assertions and reliance periods and obtain evidence through control testing, substantive procedures, or both. Below: judge responses to midyear overrides and remediation that does not prove earlier effectiveness.
Try one first
Hint
Map each fact to the COSO components (especially control environment and monitoring); if multiple foundational components are weak, think about whether controls can reasonably be relied on or whether substantive procedures should be increased.
Answer B. The identified weaknesses affect foundational COSO components (control environment and monitoring) and key control activities (segregation of duties, reconciliations, and IT change management), undermining the reliability of controls for inventory and revenue. When controls are pervasive or the control environment is weak, the auditor should assess control risk as high and expand substantive procedures, often increasing sample sizes and performing substantive tests at or near year‑end. The auditor should also document and communicate the deficiencies to management and those charged with governance.
Why not A: This is tempting because auditors often test controls before deciding reliance, but the weaknesses here are systemic (control environment and monitoring); additional walk-throughs are unlikely to provide a sufficient basis to rely on controls, so substantive testing should be increased instead.
Why not C: This option overreacts: declaring a material weakness requires assessment of the likelihood and magnitude of misstatement, and withdrawal is not the immediate required action solely due to weak controls. The auditor should first assess risk, expand substantive procedures, and communicate deficiencies before reaching conclusions about material weaknesses or considering withdrawal.
Why not D: Physical security and an automated costing system without proper change‑management controls do not compensate for lack of segregation, independent reconciliations, and monitoring. Management inquiry and limited testing are insufficient given the pervasive control weaknesses, so substantive testing must be increased rather than limited.
What should you do?
The situation
Trendline, a nonissuer, implemented an automated revenue-recognition control in January. The auditor planned reliance and reduced substantive procedures. September 30 testing found recurring manual overrides in July and August. Management reconfigured the control and documented remediation in October. Year-end is December 31. How should the auditor respond?
Reassess now; revise reliance and procedures for affected revenue assertions and periods.
Best Test October remediation before reliance. Address July and August separately; year-end control tests alone cannot establish earlier effectiveness.
Avoid reliance for July and August; expand substantive testing for affected revenue assertions.
Acceptable This can address the failure period, but reliance outside that period still needs evidence of operating effectiveness.
Accept October remediation and retain the original reduced substantive plan.
Wrong A documented repair does not prove effective operation during July and August or after remediation.
Test the repaired control at year-end and rely on it for the entire year.
Wrong Year-end effectiveness cannot establish that the control operated effectively during the earlier override period.
Treat any control failure as requiring expanded substantive testing for the entire year.
Wrong The response must follow reassessment of affected assertions and periods, not an automatic whole-year expansion.
Key points
- Remember: A repaired control does not prove the control worked before the repair.
- Scope the failures by revenue assertion and period before choosing additional audit procedures.
- Additional control testing, substantive procedures, or both may provide the evidence needed to revise the reliance plan.
How the exam traps you
- Treating documented remediation as proof that the original reliance plan remains valid. Test the repaired control before reliance and separately address the earlier failure period.
- Using year-end control tests to prove July and August effectiveness. Obtain evidence that addresses the period when the overrides occurred.
- Automatically expanding substantive testing for the entire year after any control failure. Determine which revenue assertions and reliance periods the failures affect before choosing additional procedures.
Question 2
Hint
First identify which COSO components the facts implicate (e.g., segregation of duties, monitoring), then consider how weaknesses in those components affect control risk and the extent of substantive testing.
Answer B. The facts indicate control activities weaknesses (inadequate segregation of duties: one person can add vendors and approve invoices; reconciliations are late and require manual JEs) and monitoring weaknesses (internal audit lacks independence and hasn't performed post-implementation monitoring). Those deficiencies increase control risk. Accordingly, the auditor should reduce reliance on controls and expand substantive procedures that directly address vendor master changes, approvals, and the manual journal entries used to conceal or correct errors.
Why not A: Tempting because automation can reduce manual processing errors, but automated controls cannot be relied upon when segregation of duties is weak and reconciliations are unreliable; without evidence the automated controls are properly designed and operating, reliance should not be increased.
Why not C: Reporting to the CFO and lack of monitoring are indicators of monitoring weakness, but declaring a material weakness and suspending all control reliance is premature. Whether a material weakness exists depends on whether the deficiencies create a reasonable possibility of a material misstatement; the immediate audit response is to reassess control risk and increase substantive testing.
Why not D: Better system data can support analytics, but analytical procedures are less effective at detecting unauthorized vendor creation, improper approvals, or concealment via manual journal entries. Given the specific control and monitoring deficiencies, expanded tests of details are more appropriate than substituting with analytics.
Question 3
Hint
Which condition indicates the highest urgency because it suggests management override or possible fraud by senior personnel rather than routine control design or lower‑level operational issues?
Answer C. Conditions that suggest management override of controls or suspected fraud by senior management raise the risk of material misstatement and require the auditor to obtain additional evidence immediately. Large, unusual, unsupported journal entries prepared and posted solely by the CFO without independent review are a high‑urgency trigger because they directly affect the control environment and the reliability of financial reporting. The auditor should expand substantive procedures now and consider communicating the matter to those charged with governance.
Why not A: A segregation‑of‑duties weakness at a lower‑level employee increases risk of misappropriation, but interim testing found supporting documentation and no evidence of unauthorized payments. Absent indications of actual misappropriation or senior management involvement, the auditor would typically increase year‑end substantive procedures and communicate the control deficiency rather than immediately broadening interim substantive work.
Why not B: System implementations can increase control risk, but if compensating review procedures appear to operate and no misstatements have been detected, the auditor would normally update the risk assessment and plan targeted additional testing (for example, testing migrations and reconciliations) rather than automatically expanding broad substantive procedures immediately.
Why not D: An outstanding control deficiency that historically resulted only in immaterial differences does not by itself mandate immediate expansion of substantive testing. The auditor should document the condition, follow up on remediation plans, and adjust the planned procedures, immediate expansion is required only if risk or evidence of misstatement has increased.
Question 4
Hint
Focus on whether the deficiency allowed a material misstatement to occur and remain undetected by the company's controls during the period.
Answer A. This is a material weakness because the auditor identified a material misstatement ($1.8 million) that was not prevented or detected by the company's controls. Auditing guidance treats an auditor-detected, uncorrected material misstatement as a strong indicator of a material weakness. The controller's concentration of duties, excessive IT privileges, and limited monitoring increase the severity and pervasiveness of the deficiency.
Why not B: Tempting because it is a serious control failure but wrong because the presence of an auditor-detected, uncorrected material misstatement, combined with pervasive segregation-of-duties and IT administration problems, indicates a material weakness rather than a significant deficiency.
Why not C: Tempting because the issue arose in accounts payable and part of the amount was reversed; wrong because an auditor-detected misstatement that required adjustment and remained uncorrected meets the threshold for a material weakness, not a mere control deficiency.
Why not D: Tempting because management partially reversed the payments and plans remediation; wrong because corrective actions after discovery do not remove the fact that a material misstatement occurred and was not prevented or detected by controls during the period, which is reportable as a material weakness.
Question 5
Hint
Identify which COSO components are weak (control activities and IT/information) and consider whether entity‑level controls can reasonably compensate when deciding whether to reduce substantive procedures.
Answer A. Weak IT general controls (no formal change control, shared generic credentials) and process-level segregation‑of‑duties deficiencies (CFO approving write‑offs and issuing credit memos) undermine the reliability of automated application controls. Entity‑level monitoring (audit committee, CFO reviews) is helpful but does not fully compensate for these information and control activity weaknesses. Therefore the auditor should maintain or increase substantive procedures for revenue, expand testing around customer‑master changes and write‑offs, and test ITGCs before reducing substantive testing.
Why not B: Tempting because automated preventive controls and a separate credit department appear to lower control risk; however, shared generic accounts, lack of change management, and the CFO's conflicting authority weaken access and change controls and therefore the reliability of automated application controls. The auditor should not reduce substantive testing without first addressing or testing those ITGC and segregation issues.
Why not C: Tempting because entity‑level oversight and senior management reviews provide monitoring, but such controls do not eliminate the heightened risk created by deficient control activities and IT weaknesses. Those deficiencies mean analytics and confirmations alone would not provide a sufficient audit basis.
Why not D: Tempting because a small-sample control test can feel efficient, but passing a limited sample of automated transactions does not compensate for inadequate IT general controls or poor user access controls. Without testing and remediating ITGCs and segregation issues, the auditor cannot reliably rely on automated controls and reduce substantive procedures.
Question 6
Hint
Focus on whether the ERP implementation constitutes a significant change to control design/operation and whether prior‑year tests or management monitoring provide sufficient current evidence, such changes normally require updating understanding and retiming or performing new tests of controls.
Answer D. An ERP implementation that materially changes control design and IT general controls is a significant change under COSO and auditing standards. The auditor must promptly update the understanding of internal control, reassess risks, and, when intending to rely on controls, evaluate and test the design and operating effectiveness of the new automated and IT controls in the post-implementation environment. That may require walkthroughs and retiming control tests (for example, testing after the system has operated sufficiently) rather than relying solely on prior-year evidence or management monitoring.
Why not A: Although prior-year tests and management monitoring are reassuring, they are not sufficient when controls and ITGCs have changed. Proceeding with the originally scheduled interim tests without updating the auditor's understanding risks obtaining evidence that is not relevant to the changed control design or operating effectiveness.
Why not B: Prior-year evidence and management monitoring do not automatically carry forward when system changes materially alter control design or operation. COSO and auditing standards require current evidence about controls that have changed, so prior results alone are not sufficient.
Why not C: Switching unilaterally to a substantive-only approach simply because the ERP is complex is premature. The auditor should first reassess risks, determine whether the new controls can and should be tested, and document any justified change in planned procedures rather than abandoning control evaluation for convenience.
Common questions
How should an auditor respond to recurring control overrides?
For Trendline's revenue, promptly reassess planned reliance and identify the affected assertions and periods. Determine whether additional control testing, substantive procedures, or both are needed.
Does remediation restore control reliance for the whole year?
No. Test the October repair before relying on it, and obtain sufficient evidence addressing the July and August failure period.
Can year-end control testing prove a control worked earlier?
Not by itself. Evidence that Trendline's repaired control works at year-end does not establish that it worked during July and August.
Practice AUD like the real exam
The free ChatCPA simulator: real exam layout, timed testlets, starting with a question on this topic. No account needed to start.
Open the free simulator →More on COSO
Questions from the ChatCPA bank of 17,658 CPA exam questions, each with a written reason for every wrong answer. ChatCPA is built by Nicholas Miller, CPA (Oregon #14907). How these pages are made. Spot an error? Tell us.