Tests of details are the auditor's primary responses to risks of material misstatement. Today I tell you what a test of details is and how you can best use this substantive approach..

Further Audit Procedures

What is a Test of Details?

Tests of Details - Selection of Procedures

So, how do you determine which response is best? 

AU-C 330 tells us to pay attention to the nature of the risk. Doing so allows us to determine the what, when and how of our procedures. The audit standards refer to this as the nature, timing and extent. So, here is the way to design appropriate responses to your client’s risks of material misstatement. 

1. Nature of Evidence

First, let's discuss the type of procedures or, as the audit standards call it, the nature of evidence. If an auditor believes that receivables might be overstated, then she might send confirmations to customers. Why confirmations? To prove the existence of the receivables. And confirmations provide third party evidence which is better than that from within the company. Customers usually have no reason to respond in a dishonest manner, so the third party evidence is more reliable.

Prepaid assets, by contrast, usually has a low risk of material misstatement. They are not complex. The volume of transactions is low. They are not an estimate. So, in this instance, the auditor could use substantive analytics. Again, the nature of the risk drives your response.

Your responses are critical. If your tests don't address the risk of material misstatement, what good are they? 

In addition to the nature of evidence, timing matters as well.

2. Timing of Evidence

So, should you perform interim audit procedures? The answer depends on the reliability of the accounting system. Interim work is more easily done when you audit reliable systems. Consider waiting until period-end to audit unreliable systems. Why? If your interim work yields significant problems, you may not feel comfortable with roll-forward procedures. In other words, you may have to re-perform your interim work at period end. 

Do you perform a search for unrecorded liabilities? Then some time must pass from period-end before you do this procedure. The entity needs time to receive period-end invoices and make payments before you can review them. Likewise, if you are examining subsequent period receivable collections, some time must pass before you do so. Wait at least three or four weeks from period end before you perform these types of procedures.  

In addition to the nature and timing, the quantity of information is critical.

3. Extent of Evidence

The extent or quantity of evidence is another decision. Higher risks call for more evidence. If accounts payable has been materially understated the last two years, then consider lowering your search threshold for unrecorded liabilities. If you've used $10,000, you could, for example, move it to $3,000. The lower threshold will yield more evidence. The main point here is you want more evidential matter as risk increases.

But can you audit too much information? The answer is yes, unless you have an unlimited time budget. So, you want to examine enough information without overdoing it.

A question to ask in designing your quantity is, “Will this test allow me to detect a material misstatement?” For instance, you might plan a sample. But once you total the individually significant items, you see the remaining amount is immaterial. Then test the individually significant items and stop. 

Choosing Your Tests of Details

So there you are. A summary of nature, timing and extent as they relate tests of details. Learning to match your procedures with risks is one of the most important things you'll do as an auditor. Using canned audit programs or the same-as-last-year approach can lead to significant problems. Therefore, know your risks. Then design and perform responsive procedures.

Tests of Details by Account Balance

Auditing cash tends to be straightforward. We usually just obtain the bank reconciliations and test them. We send confirmations and vouch the outstanding reconciling items to the subsequent month’s bank statement. But are such procedures always adequate? Hardly. 

Recall the Parmalat and ZZZZ Best Carpet Cleaning frauds. In those businesses, the theft of cash was covered up with fake bank statements and fake confirmation responses. Millions were lost and reputations we’re sullied.

In this post, we will take a look at the following:

• Primary cash assertions
• Cash walkthrough
• Directional risk for cash
• Primary risks for cash
• Common cash control deficiencies
• Risk of material misstatement for cash
• Substantive procedures for cash
• Common cash work papers

The primary relevant cash assertions are:

• Existence
• Completeness
• Rights
• Accuracy
• Cutoff

Of these assertions, I believe existence, accuracy, and cutoff are most important. The audit client is asserting that the cash balance exists, that it’s accurate, and that only transactions within the period are included.

Classification is normally not a relevant assertion. Cash is almost always a current asset. But when bank overdrafts occur, classification can be in play. The negative cash balance can be presented as cash or as a payable depending on the circumstances. 

As we perform walkthroughs of cash, we normally look for ways that cash might be overstated (though it can also be understated as well). We are asking, “What can go wrong?” whether intentionally or by mistake.

In performing cash walkthroughs, ask questions such as:

• Are timely bank reconciliations performed by competent personnel?
• Are all bank accounts reconciled?
• Are the bank reconciliations reviewed by a second person?
• Are all bank accounts on the general ledger?
• Are transactions appropriately cut off at period-end (with no subsequent period transactions appearing in the current year)?
• Is there appropriate segregation between persons handling cash, recording cash, making payments, and  reconciling the bank statements
• What bank accounts were opened in the period?
• What bank accounts were closed in the period?
• Are there any restrictions on the bank accounts?
• What persons are on the bank signature cards?
• Who has the authority to open and/or close bank accounts?
• What is the nature of each bank account (e.g., payroll bank account)?
• Are there any cash equivalents (e.g., investments of less than three months)
• Were there any held checks (checks written but unreleased) at period-end?

As we ask questions, we also inspect documents (e.g., bank reconciliations) and make observations (who is doing what?).

If controls weaknesses exist, we create audit procedures to address them. For example, if during the walkthrough we review three monthly bank reconciliations and they all have obvious errors, we will perform more substantive work to prove the year-end bank reconciliation. For example, we might vouch every outstanding deposit and disbursement.

What is directional risk? It’s the potential bias that a client has regarding an account balance. A client might desire an overstatement of assets and an understatement of liabilities  since each makes the balance sheet appear healthier.

The directional risk for cash is overstatement. So, in performing your audit procedures, perform procedures such as testing the bank reconciliation to ensure that cash is not overstated.

The primary risks are:

1. Cash is stolen
2. Cash is intentionally overstated to cover up theft
3. Not all cash accounts are on the general ledger
4. Cash is misstated due to errors in the bank reconciliation
5. Cash is misstated due to improper cutoff

In smaller entities, it is common to have the following control deficiencies:

• One person receipts and/or disburses monies, records those transactions in the general ledger, and reconciles the related bank accounts
• The person performing the bank reconciliation does not possess the skill to perform the duty
• Bank reconciliations are not timely performed

In my smaller audit engagements, I usually assess control risk at high for each assertion. If control risk is assessed at less than high, then controls must be tested to support the lower risk assessment. Assessing risks at high is usually more efficient than testing controls.

When control risk is assessed at high, inherent risk becomes the driver of the risk of material misstatement (control risk X inherent risk = risk of material misstatement). For example, if control risk is high and inherent risk is moderate, then my RMM is moderate. 

The assertions that concern me the most are existence, accuracy, and cutoff. So my RMM for these assertions is usually moderate to high. 

My response to higher risk assessments is to perform certain substantive procedures: namely, bank confirmations and testing of the bank reconciliations. As RMM increases I examine more of the period-end bank reconciliations and more of the outstanding reconciling items. Also, I am more inclined confirm the balances.

My customary audit tests are as follows:

1. Confirm cash balances
2. Vouch reconciling items to the subsequent month’s bank statement
3. Ask if all bank accounts are included on the general ledger
4. Inspect final deposits and disbursements for proper cutoff

The auditor should send confirmations directly to the bank. Some individuals create false bank statements to cover up theft. Those same persons provide false confirmation addresses. Then the confirmation is sent to an individual (the fraudster) rather than a bank. Once received, the fraudster replies to the confirmation as though the bank is doing so. You can lessen the chance of fraudulent confirmations by using Confirmation.com, a company that specializes in bank confirmations. Alternatively, you might Google the confirmation address to verify its existence.

Agree the confirmed bank balance to the period-end bank reconciliation (e.g., December 31, 20X7). Then, agree the reconciling items on the bank reconciliation to the bank statement subsequent to the period-end. For example, examine the January 20X8 bank statement activity when clearing the December 20X7 reconciling items. Finally, agree the reconciled balance to the general ledger cash balance for the period-end (e.g., December 31, 20X7).

Cut-off bank statements (e.g., January 20, 20X8 bank statement) may be used to test the outstanding items. Such statements, similar to bank confirmations, are mailed directly to the auditor. Alternatively, the auditor might examine the reconciling items by viewing online bank statements. (Read-only rights can be given to the auditor.)

My cash work papers normally include the following:

• An understanding of cash-related internal controls 
• Risk assessment of cash assertions at the assertion level
• Documentation of any control deficiencies
• Cash audit program
• Bank reconciliations for each significant account
• Bank confirmations

We’ve discussed how to perform cash risk assessment procedures, the relevant cash assertions, the cash risk assessments, and substantive cash procedures. 

Next we’ll examine how to audit receivables and revenues.

Get Your Copy of The Why and How of Auditing

Click the book below to see it on Amazon.

Are you using substantive analytics in your audits? Many auditors rely solely on a test of detail when a better option is available. Substantive analytics, in some cases, provide better evidential matter. And they are often more efficient than a test of detail.

This article focuses on substantive analytics. But before we look at what substantive analytics are and how we can use them, let's see how analytics in general are used in an audit.

Documentation of Substantive Analytics

In performing substantive analytics, make sure you document your expectations and conclusions:

Expectation – Document what you expect the result of the computation or comparison to be (you can use a range).

A common peer review finding is the lack of a documented expectation. Prior to computing a ratio or comparing numbers to prior periods, document your expectation.

Conclusion – Document whether the computation or comparison falls within your expectation. If it does not, inquire of the client. You may need to perform a test of details if the substantive analytic result is not within an acceptable range. Regardless, make sure you respond to unexplained results (i.e., those that fall outside an acceptable range) and that you document your response.

Overall Substantive Analytical Considerations

Substantive analytics are not required. So, think of them as an efficient alternative to test of details.

But are there audits where substantive analytics don't work as well? Yes. If the company has weak internal controls or a history of significant errors, you may want to rely more on tests of details. Substantive analytics work better in stable environments.