Auditing 100 Practice Exam

Understanding internal control and testing its operating effectiveness can be done at the same time. Even if control risk is assessed as maximum, you don’t stop learning about how controls work or stop testing them; you can obtain an understanding of the controls and run tests of controls in the same engagement. These tests provide evidence about whether the controls are operating effectively, which helps you gauge whether control risk might actually be lower than initially estimated or confirm that it remains high, guiding the extent of substantive testing you’ll need. In other words, you can gather control-related evidence while continuing substantive procedures as needed, rather than choosing between them in sequence. The other statements impose false requirements—tests of controls aren’t strictly necessary just because you’re planning a mainly substantive approach, and control risk isn’t guaranteed to be at maximum after testing, nor must you always assume maximum after performing tests.