Testing Internal Controls – Audit Tools that Help

Earlier this month, the PCAOB released annual inspection reports for the Big Four accounting firms and eight other firms. The reports revealed deficiencies in 52 out of 236 audits conducted by the Big Four, or 22% of audits examined. Further, peer reviewers noted deficiencies in nearly one-third of audits reviewed (41 of 130) at the eight other firms. What caused the majority of deficiencies noted? As a matter of fact, in one firm after another, deficiencies identified mostly related to testing of internal controls.

Additionally, in its Enhancing Audit Quality: 2019 Highlights and Progress report, the AICPA noted, “47% of the audits reviewed did not comply with AU-C Section 315 and/or AU-C Section 330 because auditors did not properly address their clients’ controls.” AICPA research further revealed that auditors’ most common internal control missteps involved:

• Assuming clients have no controls
• Not understanding which controls are relevant to the audit
• Failing to evaluate internal control design and implementation
• Improper risk assessment around control risk
• Failing to link further procedures to control-related risks

Delve into common audit deficiencies in Spotlight on Risk Assessment by AICPA Technical Issues Committee member, Melisa Galasso.

Address testing internal controls with advanced audit technology

Clearly, testing internal controls continues to represent a challenge to every firm’s quest to elevate audit quality. But there’s good news. By leveraging advanced technologies, your firm can help the staff tremendously when it comes to auditing internal controls.

Audit Technology: Amazing Realizations by Wolters Kluwer’s Vice President of Product Management, Cathy Rowe, explains how future-ready firms are leveraging new technologies to provide better quality audits at higher profitability.

Two Wolters Kluwer audit solutions provide auditors with a comprehensive toolkit to address internal controls:

• First, CCH Axcess ™ Knowledge Coach and CCH® ProSystem fx® Knowledge Coach infuses your audits with a patented, risk-based audit approach, delivered in the cloud or on-premise.
• Second, TeamMate® Analytics offers more than 150 tools specifically designed to meet the analytic needs of CPA firm auditors, along with the guidance to help auditors know where and how to use them. 

Individually, each solution helps firms improve their navigation of controls risk during an audit. However, using them together delivers far greater value to the auditor. Let’s explore how they deliver a knock out punch to internal controls deficiencies, and ultimately, lead to better peer review results.

Identifying internal controls

The first step to auditing controls lies in identifying internal controls in place at each client. Believe it or not, this step is where a good number of Peer Reviewers find deficiencies. Especially when conducting audits of small businesses, many auditors simply don’t think those clients have any controls at all. However, the AICPA cautions that all entities likely have some level of internal control, and it’s critical for auditors to identify it and evaluate it.

CCH Axcess™ Knowledge Coach and CCH® ProSystem fx® Knowledge Coach require the auditor to scope an engagement based on materiality, significant risk, fraud risk, and the nature of transactions. As auditors scope engagements, Knowledge Coach prompts them to identify the level of internal control understanding needed for each significant account, class of transactions, or disclosure based on these factors. In turn, this drives risk assessment and development of further audit procedures.

Perform risk assessment

Improper risk assessment around control risk is a common audit deficiency uncovered during peer review. Often this stems from an auditor’s failure to really understand the risks associated with an internal control they’ve identified.

Knowledge Coach is a risk-based methodology that directs the auditor to obtain a thorough understanding of the entity, its environment, and its internal controls. With this understanding, the auditor can more easily identify all of the specific risks associated with the engagement. In addition, the auditor is prompted to consider and assess in every phase of the engagement and at the end of every workpaper whether the results of procedures performed have identified risks that need to be documented and linked to an appropriate response. Knowledge Coach then allows the auditor to add these risks quickly and easily from anywhere in the engagement.

Plan responsive audit procedures

Auditors can avoid over/under auditing by taking time to identify controls, assess risks, and tailor an effective audit plan. Moreover, Wolters Kluwer designed Knowledge Coach to guide and assist auditors through precisely these critical steps.

Another common deficiency occurs when auditors perform risk assessment but fail to identify procedures that respond to risks. To be effective, audit programs must be tailored according to the client’s unique risks. If you skip planning, even performing 100% of procedures in an audit program provides no guarantee specific risks were addressed.

Knowledge Coach is designed to specifically link program steps to identified risks. Additionally, it alerts the auditor when this linkage has not been completed. This encourages the auditor to consider why he or she is performing a specific step. Consequently, it helps ensure the auditor does not over/under audit in response to the risk assessment.

Perform internal controls testing

It is increasingly difficult to gain sufficient audit evidence and risk coverage using traditional manual audit methods such as sampling alone. With ever-evolving AICPA Standards and stricter requirements, it’s critical that every auditor has access to an easy to use data analytics tool.

Audit data analytics help auditors carry out more work, in less time, with greater coverage. Audit analytics reduce risk by testing 100% of the data population. However, auditors still exercise judgment to select appropriate tests for a given situation and define critical variables. Further, auditors interpret the test results and decide if those results merit further investigation. Learn more about when to use Audit Data Analytics in the Audit Process.

There are many ways TeamMate® Analytics can help auditors improve internal controls testing. For example, it can assist auditors in selecting samples for testing controls. Additionally, it can perform a complete 3-Way Match between sales invoices, shipping documents and a master price list. Furthermore, setting up Expert Analyzers will allow auditors to run a batch of multiple tests all in one go. This empowers firms to share best practice audit tests across the entire staff. Firms can create Expert Analyzers around internal controls testing that are specific to industries or entity types.

Revisit risk assessment when needed

Diagnostics within Knowledge Coach help auditors make sure their testing addresses control risk appropriately. If auditors assess control risk at less than maximum and indicate they are not testing operating effectiveness of controls, Knowledge Coach provides a diagnostic alert indicating a discrepancy in the audit plan. To clear this diagnostic, auditors must either set control risk to maximum or test the operating effectiveness of controls. Read more about diagnostics in this blog, Diagnostics – a Check Audit Warning Light.

Strengthen your firm’s peer review results

Spanning the profession at firms both large and small, mistakes around internal controls are a major source of audit deficiencies. But, there’s a lot your firm can do with technology to improve audit quality in this area. First, avoid mistakes and save time by utilizing integrated audit technologies. Second, choose tools that support a knowledge-based, data-driven methodology, like Wolters Kluwer’s Integrated Audit Approach. Third, make sure your audit technology is easy to use and guides auditors through a good workflow that reinforces quality. Finally, firms should leverage technology that provides powerful risk-assessment and audit diagnostics and also links procedures to risks. Future-ready firms enhance quality by incorporating audit analytics into testing plans.

For additional insights from the AICPA, peer reviewers, and audit firms, read our 6 Tips to Better Peer Review eBook.