An auditor is performing tests of controls for a client's purchasing process. The client's control requires that all purchase orders (POs) over $5,000 be approved by two authorized managers. The auditor selects a sample of POs over $5,000 and examines them for the two required signatures. Out of a sample of 50 POs, 4 were found to have only one signature. The auditor determines that this deviation rate is unacceptable. Which of the following is the MOST appropriate next step for the auditor?
- ADiscuss the findings with management and request that they immediately implement corrective actions.
- BIncrease the sample size to obtain more conclusive evidence about the control's effectiveness.
- CConclude that the control is ineffective and increase the scope of substantive procedures related to purchases.
- DDocument the findings and issue a qualified opinion due to the control deficiency.
Show answer & explanationAnswer & explanation
Correct answer: C. Conclude that the control is ineffective and increase the scope of substantive procedures related to purchases.
If the auditor determines that the control deviation rate is unacceptable, it means the control cannot be relied upon. The appropriate response is to reassess the control risk as high and adjust the audit strategy by increasing the scope of substantive procedures to compensate for the ineffective control.
Why the other options are wrong
- A. While discussing findings with management is important, it's not the *most appropriate immediate next step* in terms of adjusting the audit strategy to address the increased risk.
- B. Increasing sample size might confirm the high deviation rate but won't change the conclusion that the control is ineffective if the current rate is already deemed unacceptable.
- D. A control deficiency, by itself, does not automatically lead to a qualified audit opinion unless it results in a material misstatement that is uncorrected, or indicates a material weakness in internal control over financial reporting (for integrated audits), and even then, a qualified opinion is not the only outcome. The immediate next step is to adjust the audit approach.
Control Deficiency Impact on Audit Strategy
When an auditor identifies a control deficiency that leads to an unacceptable deviation rate, the control cannot be relied upon. This necessitates an increase in the scope of substantive procedures to gather sufficient appropriate evidence.
- Unacceptable deviation rate means the control is ineffective.
- Increased control risk requires more substantive testing.
- Adjusting audit strategy is the immediate priority.
Memory trick: If the control is BROKEN, you can't trust it; you must look harder.