Testing Conclusions 2725
-
I work for a consulting firm and we are helping management of our client with the overall process documentation and then testing of the key controls. We just started testing the first two quarters of the year and there are a lot of controls that are failing and having exceptions. For example we are testing a control that one individual is reviewing a daily maintenance report for account changes at the financial institution. If we tested 13 days in our initial sample and 5 were not being reviewed and therefore exceptions, what would you do? would you call the control ‘failing’ or would you just scrap the testing and say that the control is not designed effectively and then give a new effective date? Does it matter which way we report this to management? Does the external auditor care this early in the process? If we give it a new effective date we would just test from that point on. Do we need to retest a new sample for the first half of the year even though the control has many exceptions?
Any help would be great. thanks.
-
Which controls are you testing? Are you testing internal control over financial reporting and are you testing them so that management can express an opinion on the effectiveness of internal control over financial period as of the end of the fiscal year?
For the purpose of expressing an opinion on the effectiveness of internal control over financial period as of the end of the fiscal year they only need to be effective at the end of the fiscal year (or during a short-period before the end to demonstrate that they were effective for some time and not merely on one day by chance). So if they can fix or change their controls and you later test the changed controls, then the earlier failures of the old controls are irrelevant for that purpose.
However, the failures of the controls may have already led to material misstatements of the financial statements. So from this different point of view and especially when the controls relate to income statement or cash flow statement items, you want to find out whether there were any misstatements and to have them corrected. In addition, for purposes of the public accountant’s regular opinion on the financial statements, he will test some of the controls over processes that produce transactions that are inlcuded in the income statement or the cash-flow statement. So the public accountant may also test controls over transactions that occurred earlier during the year and has an interest in the correction of misstatements.
In conclusion, you can still get a clean opinion on the effectiveness of internal control over financial reporting as of the end of the fiscal year, but you will need to investigate past errors if there is a reasonable risk that the financial statements may be misstated because of those weak controls. If the aggregated amounts that have been produced by the process with weak controls up to the moment of your testing are material in relation to the amounts for the entire year (i.e. a forecast) in the financial statements (e.g. as a percentage of net profit or of net profit before taxes or shareholders’ equity or of total assets, etc.), you will need to investigate. Otherwise youd probably should not have tested the process anyhow due to its lack of materiality.