Page 150 - Auditing Standards

As of December 15, 2017
The nature, timing, and extent of procedures performed in previous audits,

The results of the previous years' testing of the control, and

Whether there have been changes in the control or the process in which it operates since the
previous audit.

.59 After taking into account the risk factors identified in paragraphs .47 and .58, the additional
information available in subsequent years' audits might permit the auditor to assess the risk as lower than in

the initial year. This, in turn, might permit the auditor to reduce testing in subsequent years.

.60 The auditor may also use a benchmarking strategy for automated application controls in subsequent
years' audits. Benchmarking is described further beginning at paragraph .B28.

.61 In addition, the auditor should vary the nature, timing, and extent of testing of controls from year to
year to introduce unpredictability into the testing and respond to changes in circumstances. For this reason,

each year the auditor might test controls at a different interim period, increase or reduce the number and
types of tests performed, or change the combination of procedures used.

Evaluating Identified Deficiencies

.62 The auditor must evaluate the severity of each control deficiency that comes to his or her attention to
determine whether the deficiencies, individually or in combination, are material weaknesses as of the date of

management's assessment. In planning and performing the audit, however, the auditor is not required to
search for deficiencies that, individually or in combination, are less severe than a material weakness.

.63 The severity of a deficiency depends on -

Whether there is a reasonable possibility that the company's controls will fail to prevent or detect a
misstatement of an account balance or disclosure; and

The magnitude of the potential misstatement resulting from the deficiency or deficiencies.

.64 The severity of a deficiency does not depend on whether a misstatement actually has occurred but

rather on whether there is a reasonable possibility that the company's controls will fail to prevent or detect a
misstatement.

.65 Risk factors affect whether there is a reasonable possibility that a deficiency, or a combination of
deficiencies, will result in a misstatement of an account balance or disclosure. The factors include, but are not
limited to, the following -

147