The auditor is not entitled to place any reliance on internal controls based solely on his preliminary evaluation. He should carry out compliance tests to obtain reasonable assurance that the controls on which he wishes to rely were functioning both properly and throughout the period.
Compliance tests are defined as those tests which seek to provide audit evidence that internal control procedures are being applied as prescribed. We have seen that the auditor first ascertains a system of internal control through various means, he then records that system again through various possible means, then through the use of walkthrough tests he seeks to corroborate the record. After corroboration he must carry out an evaluation of the system to determine whether conceptually it is reliable, or has certain key controls upon which he can place reliance.
If he evaluates the system and reaches the conclusion that the system has controls upon which he can place reliance, then the auditor has to make a further decision and this is whether he should carry out compliance tests or not. A point must be made here, it is the application of the system that is being tested not the transactions although the testing is through the medium of transactions. So in carrying out his compliance tests and as exceptions are noted where the system has not been complied with in any particular, then the auditor may need to revise his system description and re-evaluate its effectiveness. He also will need to determine if the failure of compliance was an isolated case or is symptomatic.
Controls and their exercise can leave a visible trail like a signature or a stamp on a document or they may leave no visible trail. Compliance tests therefore can be carried out through inspection of documents to determine whether appropriate signatures and evidence of approval and checking exists, or through observation whereby there is no evidence that a procedure was carried out as expected. The tests carried out by examination of documents can usually be extended and conclusions extrapolated to cover the whole population concerned. However, for those subject to observation we can only draw conclusions based on what was actually observed and we have no evidence that the procedure is performed that way throughout the period.
In compliance tests the issue of materiality does not arise. Every exception is material and should be investigated. If compliance tests disclose no exceptions the auditor may reasonably place reliance on the effective functioning of the internal controls tested. He can therefore limit his substantive tests on the relevant information in the accounting records.
The accountant is concerned as far as every transaction is concerned that it has been recorded and processed completely and accurately and that it is valid. Internal controls are arrangements established by the management to ensure that this is so, therefore compliance tests provide the auditor with indirect evidence that all transactions have been completely and accurately processed and recorded. Example: A key control that the auditor wishes to rely on may be that before the payroll is paid the chief accountant, the personnel manager, and the managing director must sign to approve it. The auditor would therefore select a sample of payrolls and going through them seek to confirm that the appropriate signatures have been appended. Now if he finds that the appropriate signatures are actually appended then it gives him some assurance that everything relating to the payrolls was completely and accurately processed and recorded and all the resultant entries are valid. This is so because we would not expect the chief accountant, the personnel manager and the managing director to approve a payroll that is wrong in some particular. You can see from this that the auditor has not referred to any information contained in any records or any financial statements and yet he has some assurance. Therefore as a result of this, he may limit his detailed tests on the payroll to a minimum.
If the compliance tests have disclosed exceptions which indicate that the control being tested was not operating properly in practice the auditor should determine the reason for this. He needs to assess whether each exception is only an isolated departure or is representative of others and whether it indicates the possible existence of errors in the accounting records. If the explanation he receives suggest that the exception is only an isolated departure then he must confirm the validity of the explanation for example by carrying out further tests. If the explanation or the further tests confirm that the control being tested was not operating properly throughout the period then he cannot rely on that control. In these circumstances, the auditor is unable to restrict his substantive testing unless he can identify an alternative control on which to rely. Before relying on the alternative control he must carry out suitable compliance tests on it. Example: In our payroll example above, suppose the auditor picks five payrolls and on further examination finds that one of them does not have the appropriate signatures. This may mean that maybe responsible officials were on leave in which case the control was not exercised. He could therefore select five more payrolls to confirm that the exception was an isolated one. If he finds out that the payroll is never approved by the three officials as required then he cannot limit his detailed substantive tests and he will have to look for evidence that all the employees on the payroll were genuine, they were paid for work done and the recording was correctly done.