Auditing and Assurance Services 9th Edition by Alvin Arens,Mark Beasley,Randy Elder

Exercise 23

Following are three examples of controls for accounts that you have determined are significant for the audit of ICFR. For each control, determine the nature, timing, and extent of testing of the design and operating effectiveness. Refer to Exhibit 7-3 for a way to format your answer.
Control 1. Monthly Manual Reconciliation: Through discussions with entity personnel and review of entity documentation, you find that entity personnel reconcile the accounts receivable subsidiary ledger to the general ledger on a monthly basis. To determine whether misstatements in accounts receivable (existence, valuation, and completeness) would be detected on a timely basis, you decide to test the control provided by the monthly reconciliation process.
Control 2. Daily Manual Preventive Control: Through discussions with entity personnel, you learn that entity personnel make a cash disbursement only after they have matched the vendor invoice to the receiving report and purchase order. To determine whether misstatements in cash (existence) and accounts payable (existence, valuation, and completeness) would be prevented on a timely basis, you decide to test the control over making a cash disbursement only after matching the invoice with the receiving report and purchase order.
Control 3. Programmed Preventive Control and Weekly Information Technology-Dependent Manual Detective Control: Through discussions with entity personnel, you learn that the entity's computer system performs a three-way match of the receiving report, purchase order, and invoice. If there are any exceptions, the system produces a list of unmatched items that employees review and follow up on weekly. The computer match is a programmed application control, and the review and follow-up of the unmatched items report is a manual detective control. To determine whether misstatements in cash (existence) and accounts payable-inventory (existence, valuation, and completeness) would be prevented or detected on a timely basis, you decide to test the programmed application control of matching the receiving report, purchase order, and invoice, as well as the review and follow-up control over unmatched items.
EXHIBIT 7-3 An Example of an Auditor's Tests of a Daily Information Technology-Dependent Manual Control