Unpredictable Audit Procedures

In this article I explain how you can use unpredictable audit procedures.

The audit standards require elements of unpredictability. Why? So clients can’t guess what the auditor is going to do. Clients naturally observe and learn what auditors normally do. The client’s knowledge of what is audited (and what is not) makes it easier to steal. The client takes from unaudited areas. This knowledge also enables the company to manipulate numbers. The client alters unaudited balances.

The purpose of the unpredictable element is to create uncertainty–in the client’s mind–regarding audit procedures. We do so by using unpredictable audit procedures.

Elements of Unpredictability – The Audit Standards

AU-C 240.29 states the following:

In determining overall responses to address the assessed risks of material misstatement due to fraud at the financial statement level, the auditor should…incorporate an element of unpredictability in the selection of the nature, timing, and extent of audit procedures.

AU-C 240.A42 states:

Incorporating an element of unpredictability in the selection of the nature, timing, and extent of audit procedures to be performed is important because individuals within the entity who are familiar with the audit procedures normally performed on engagements may be better able to conceal fraudulent financial reporting. This can be achieved by, for example,

• performing substantive procedures on selected account balances and assertions not otherwise tested due to their materiality or risk.
• adjusting the timing of audit procedures from that otherwise expected.
• using different sampling methods.
• performing audit procedures at different locations or at locations on an unannounced basis.

Unpredictable Audit Procedures 

To introduce elements of unpredictability, perform procedures such as these:

• Examine payments less than your normal threshold in your search for unrecorded liabilities (e.g., in the last three years your threshold was $7,000; this year, it’s $3,000)
• Perform a surprise unannounced review of teller cash (for a bank client)
• Make a physical visit to the inventory location one month after the end of the year and review inventory records (assuming you don’t normally do so)
• Review payroll salary authorization sheets for ten employees and agree to amounts in the payroll master table (in the payroll software)
• Test a bank reconciliation for the seventh month in the year being audited (in addition to the year-end bank reconciliation)
• Confirm an immaterial bank account that you haven’t confirmed in the past
• Pick ten vendors at random and perform procedures to verify their existence (as a test for fictitious vendors)

Document Your Unpredictable Audit Procedures

Since unpredictable tests are required in every audit, document where you performed this procedure. Reference your audit program step for unpredictable tests to the work performed. Title your work paper, “Unpredictable Test,” and then add a purpose statement such as, “Purpose: To confirm the immaterial bank account with ABC Bank as an unpredictable test.” Doing so will eliminate the potential for a peer reviewer to say, “that’s a normal procedure.” You are overtly stating the purpose of the test is to satisfy the unpredictable test requirement.

Change Your Unpredictable Tests Annually

Change your unpredictable tests annually. Otherwise, they will–over time–become predictable.