Page 15 - CIMA SCS Workbook August 2018 - Day 1 Suggested Solutions

SUGGESTED SOLUTIONS

EXERCISE 3

Audit testing occurs after an auditor has ascertained the controls that are in place. The internal
audit function (IA) must first be sure of all the risks that may occur in FNG’s operation i.e. all the
ways that their websites/publications may be compromised or staff may be hurt and so on.
Following on from this, all controls must be ascertained. They may feel that some controls are
missing (which may result in an audit “point” or “finding”), others are inadequate (and testing
must be done to prove this) or that controls are in place but need to be tested to ensure that they
are adequate.

At this point, IA may begin testing.

In the case of FNG, it would be important to establish who the internal audit function would
report to. Ideally IA reports would be given to an independent party to review, however we do
not know if such a body exists within FNG. Although we have not been given any reason to
assume this may happen, if they report directly to Den Rice (CFO) or Guy Lomas (CEO) they may
cover up or ignore the report. It would therefore have no worth to FNG as a monitoring activity
even if the quality of the audit is good.

The IA must feel they have the experience to audit the operations of the publications/websites,
once this is established they may start compliance and substantive testing.

An example of a compliance test would be observing staff doing checks and following the
procedure, IA checking the story answers the six important questions and pages allow the
required advertising space and so on. Essentially, a compliance check is checking to ensure that
any control identified is being complied with.

The IA may choose to look at any documentation or evidence available first to see if there has
been any health and safety issue. This would be a substantive test. This type of testing looks at
the outputs of a system to see what has happened in the past, which may guide the IA in where to
concentrate testing.

A form of substantive testing is an analytical review. Analytical review is the examination of ratios,
trends and changes in the business from one period to the next, to obtain a broad understanding
of the results of operations, and to identify any items requiring further investigation. When the
results appear abnormal the auditors will investigate more closely to find out the cause(s) by
performing further work. The IA may choose to do this at the very start of an audit when they are
doing their audit planning.

FNG is able to provide detailed information regarding its publications and circulation, this can be
extremely useful. A drop in circulation may help to highlight where there have been potential
issues in providing accurate or relevant new stories and this insight can be then used to plan more
relevant compliance tests focussed on that region. IA does not have the time to check everything
and this information can help decide where to focus their attention.

NB. Not all compliance tests require substantive work to be done first.

Audit testing, both compliance and substantive, involves observing, analysing, monitoring,
reconciling and checking. It will also probably be necessary to undertake some form of sampling.
Sampling is testing a proportion of a population to gain assurance about the population as a

KAPLAN PUBLISHING 53