An auditor is testing the operating effectiveness of a client's control that requires all cash disbursements over $5,000 to be approved by two authorized managers. The auditor selects a sample of 40 cash disbursements over $5,000 from the population and finds that 3 of them lacked the required second approval. The auditor's tolerable deviation rate is 5%, and the expected deviation rate is 1%. Based on this sample, what is the most appropriate conclusion regarding the control's operating effectiveness?
- AThe control is not operating effectively, as the sample deviation rate exceeds the expected deviation rate.
- BThe auditor should expand the sample size to obtain more evidence before concluding.
- CThe control is not operating effectively, as the upper deviation rate likely exceeds the tolerable deviation rate.
- DThe control is operating effectively, as the sample deviation rate is less than the tolerable deviation rate.
Show answer & explanationAnswer & explanation
Correct answer: C. The control is not operating effectively, as the upper deviation rate likely exceeds the tolerable deviation rate.
The sample deviation rate is 3/40 = 7.5%. This rate (7.5%) is greater than the tolerable deviation rate (5%). When the sample deviation rate exceeds the tolerable deviation rate, even without calculating the exact upper deviation rate, it is highly likely that the calculated upper deviation rate will also exceed the tolerable deviation rate. Therefore, the auditor would conclude that the control is not operating effectively.
Why the other options are wrong
- A. While the sample deviation rate (7.5%) does exceed the expected deviation rate (1%), this alone doesn't definitively conclude ineffectiveness. The comparison should be to the tolerable deviation rate.
- B. Expanding the sample size is typically considered if the sample deviation rate is *close* to the tolerable deviation rate, or if the initial sample was too small. Here, the deviation is already significantly higher than tolerable, suggesting ineffectiveness, not just uncertainty.
- D. The sample deviation rate (7.5%) is actually greater than the tolerable deviation rate (5%), so this conclusion is incorrect.
Evaluating Control Deviations in Attributes Sampling
In attributes sampling for tests of controls, auditors compare the calculated upper deviation rate (which accounts for sampling risk) to the tolerable deviation rate. If the upper deviation rate exceeds the tolerable deviation rate, the control is deemed not to be operating effectively.
- Sample Deviation Rate = Number of Deviations / Sample Size.
- The Upper Deviation Rate is calculated using the sample deviation rate and an allowance for sampling risk.
- If Sample Deviation Rate > Tolerable Deviation Rate, the control is likely ineffective without even calculating the exact upper limit.
- If Upper Deviation Rate > Tolerable Deviation Rate, the control is not operating effectively; if ≤, it is operating effectively.
Memory trick: If the SAMPLE'S DEVIATION is TOO HIGH, the CONTROL is likely BROKEN.