This document provides an example of applying a top-down audit approach to assess internal controls over financial reporting at Wembley Wheels. It involves the following key steps: 1. Understanding financial statement risks, such as risks of misstatement in revenue and accounts receivable. 2. Assessing entity-level controls impacting these accounts, including management's policies over revenue recognition and segregation of duties. 3. Identifying significant accounts and disclosures at risk, such as fraudulent sales or uncollectible receivables. 4. Walking through the sales process to verify controls, select a sample transaction, and trace it through the process from order to billing. This allows confirming the auditor

1. Internal controls
Wembley Case Study example of Internal Control Audit Approach

2. Top Down Approach Step 1: Understand the financial statement
risks
Step 1 in the top-down approach is to understand the overall risks to internal control over the
financial statements by reviewing the items reported in the financial statements.
► Identifying risks at the financial statement level helps the auditor to focus on the right
questions in Steps 2 through 5.
At the financial statement level, there is risk that revenue and accounts receivable, as
presented in the financial statements, could be materially misstated if there are any problems in
the sales process.
Introduction to auditing internal controls Page 2

3. Continuing with the sales process, the auditors will assess entity-level controls that impact the
accounts identified in Step 1 (i.e., revenue and accounts receivable). Based on discussions with
management of Wembley Wheels, you note the following:
► Management has formal policies and procedures over the sales process and, specifically, revenue
recognition.
► Management and the board discuss, review and monitor any material estimates, assumptions or
uncertainty surrounding revenue recognition.
► The internal audit function regularly reviews the sales process controls and revenue recognition
practices, including who authorizes or makes sales-related manual journal entries.
► The chief internal auditor reports directly to the audit committee chair.
► Revenue budgets provide a reasonable expectation of revenues and variations are investigated and
resolved timely.
► The company hires competent accountants with skills and knowledge of revenue recognition.
► Management reviews and updates credit policies each quarter.
► Management strictly enforces segregation of duties.
► Management has guidelines for establishing prices and offering discounts.
Introduction to auditing internal controls Page 3
Step 2: Assess the quality of entity-level controls

4. In the sales process, revenue and accounts receivable are significant accounts. Significant
accounts are accounts where there is a risk of material misstatement from specific risk factors.
You produce a list of the risks of material misstatement in the significant accounts you identified
related to the sales process.
► There is a risk that revenue could be materially misstated due to events such as:
► Fraudulent sales
► Revenue recognized in the wrong period
► Incorrect revenue amounts recorded
► Incomplete disclosures
► There is a risk that accounts receivable could be materially misstated due to:
► Fraudulent customers
► Uncollectible amounts owed to the company
Introduction to auditing internal controls Page 4
Step 3: Identify significant accounts and disclosures

5. Once the significant accounts and disclosures are identified, Step 4 is to consider which
assertions are at risk of material misstatement. Identifying at-risk assertions is important because
controls are designed to address assertion risks. For instance, if the entity is concerned about the
existence of fraudulent customers and the valuation of uncollectible accounts receivable, the
control procedures to mitigate these risks are different.
You list the assertions associated with the risk for material misstatement you identified for the
sales process.
• Revenue:
• Fraudulent sales (i.e., occurrence)
• Revenue recognized in the wrong period (i.e., occurrence and completeness)
• Incorrect revenue amounts recorded (i.e., occurrence)
• Incomplete disclosures (i.e., presentation and disclosure)
• There is a risk that accounts receivable could be materially misstated due to:
• Fraudulent customers (i.e., existence)
• Uncollectible amounts owed to the company (i.e., valuation)
Introduction to auditing internal controls Page 5
Step 4: Identify assertions at risk for material misstatement

6. Page 6
Step 5: Identify controls that address assessed risks
Introduction to auditing internal controls
Sales Order Process – Groups 1 and 5
Shipping Process – Groups 2 and 6
Billing Process – Group 3 and 7
Manage Documents, Journal Entry and Post Process – Group 4
Questions:
1.What could go wrong in the process?
2.Which assertions are affected by what could go wrong?
3.Which controls has management implemented to mitigate
what could go wrong?
4.What additional controls would you expect to be
implemented?

7. Perform walk-through of sales process at Wembley Wheels
► Walk-throughs confirm:
► The auditor’s understanding of internal controls
► Whether controls have been designed and
implemented effectively
► Begin by reviewing the Wembley Wheels
internal auditor–prepared sales process
documents.
Page 7
Part 2: Designing tests of internal controls

8. Walk-through example: sales process
The sales process at Wembley Wheels involves these functions. You will need to arrange to speak to people
who perform or oversee these functions. Each step in the sales process involves not only people, but IT
applications and programs that are supported by ITGCs. You should verify your understanding of the IT
processes and the ITGCs. Keep in mind the risks in the process flow and how those risks might increase if
there are ineffective controls or ITGCs.
► Sales Department: receive customer order
► Sales Department: create sales order, including establishing sales prices
► Credit Department: credit check or assignment
► Warehouse: order assembly takes place from the picking slip
► Warehouse: completed order noted in system, goods move to shipping dock
► Shipping Department (e.g., dock): completed order to shipper
► Shipping Department: shipper signs goods delivered note
► Shipping Department: triggers invoice in system
► Accounting Department: reviews and compares sales orders and goods delivered notes, creates and delivers
invoices, triggers journal entry recording
► IT Department: programs create and post journal entries to journal and ledgers
Page 8
Part 2: Designing tests of internal controls

9. Walk-through example: sales process
► The next step is to select a transaction to walk through the sales process. A transaction is
selected and a walk-through is performed for every significant financial reporting process. You
are assigned the sales process for this exercise.
► The walk-through will require talking with people in various functions about the processes they
perform and verifying how the transaction is processed, including through various IT
applications.
► You select sales order No. 4228767. This sales order required credit manager approval before
the sales order was created. Recall that this is one of the three identified classes of sales
transactions. The others are sales that don’t require credit approval and sales that require
exceptions from the standard pricing, such as discounts. Walk-throughs need to be performed
for these classes of transactions as well, but they are not part of this example.
► You will trace sales order No. 4228767 through Wembley’s sales process, beginning with the
creation of the sales order and until the transaction is recorded in the financial statements.
Page 9
Part 2: Designing tests of internal controls

10. Walk-through example: sales department
Meet with Sharon Baker, Wembley Wheels Sales
Manager.
► Ask to see sales order No. 4228767.
► Confirm your understanding of the sales order
creation process, including that the internal control
procedures are being followed and that there is
appropriate segregation of duties.
► Walk through the process of creating sales order No.
4228767, including how it is:
► Initiated, authorized, processed, recorded and reported
► The data elements on the sales order that you will
need to trace through the IT system are:
► Sales order number
► Sales date
► Customer
► Item description
► Quantity purchased by customer
Page 10
Part 2: Designing tests of internal controls

11. Walk-through example: sales department
Meet with Sharon Baker, Wembley Wheels Sales Manager.
► Confirm your understanding of how the price for the sale
included on the sales order was determined and:
► How and when prices are updated
► How prices are verified for completeness and accuracy
► How any discounts are granted
► Verify that the internal control procedures are being
followed, and that there is appropriate segregation of
duties.
Page 11
Part 2: Designing tests of internal controls

12. Walk-through example: credit department
Meet with Jennifer Lee, Wembley Wheels Credit Manager.
► Sales order No. 4228767 was created for a new customer,
requiring credit approval.
► Inquire of the credit manager to further corroborate your
understanding of Wembley’s process to create sales order
No. 4228767, particularly for granting credit to new
customers.
► Verify that the internal control procedures are being
followed, and that there is appropriate segregation of
duties.
► Ask Jennifer to show you the credit report that
management requires to grant new customers credit, and
the credit limit established for Hot Rod Automotive.
Page 12
Part 2: Designing tests of internal controls

13. Walk-through example: Continue through the process
Meet with Rex Manard, Wembley Wheels Warehouse Manager.
Meet with Havel Patel, Wembley Wheels Shipping Manager.
Meet with Tra Trang, Wembley Wheels Billing Clerk, in the Accounting
Department.
You meet with Fiona McGregor, Wembley Wheels IT Manager.
► Confirm your understanding of the process using the sales order No. 4228767
generated by the IT system.
► Verify that the internal control procedures are being followed and that there is
appropriate segregation of duties.
► Verify that the information in each subsequent step matches the sales order.
Page 13
Part 2: Designing tests of internal controls

14. Walk-through example conclusion
Now that you have completed the sales process walk-through for Wembley
Wheels, you should conclude whether:
► The sales process documentation is adequate, or it should be updated.
► You understand the sales process and the internal controls involved.
► You have obtained sufficient evidence to conclude that internal controls, including
ITGCs, have been designed effectively and that the entity has actually implemented
the control as described in the design.
What are the outcomes and implications if internal controls are not designed and
implemented correctly (for example what is the implication if, in performing a
walk-through, the auditor selects an SO for an existing customer that does not
have sufficient credit established?
Page 14
Part 2: Designing tests of internal controls

15. Tests of a control design considerations
► Control tests are considered “attribute” tests. This type of
testing is usually a pass or fail evaluation (i.e., if the
credit manager correctly established a credit limit for a
new customer).
► Auditors design tests of a control by considering the
attributes of the controls. The attributes of a control
address the:
► Who
► What
► Where
► When
► Why
► How
Page 15
Part 2: Designing tests of internal controls

16. Design attributes of a control: who
Who refers to the control owner: the individual who performs the control procedures. The persons
performing the control must be competent to perform the control. Also, they must be objective and
without any conflicting duties (i.e., segregation-of-duties concerns).
Example: The Wembley Wheels Sales Manager,
Sharon Baker, has responsibilities for approving
sales orders, but she cannot establish or authorize
credit for customers (i.e., has authorization, but not
custody or recording duties).
Page 16
Part 2: Designing tests of internal controls

17. Design attributes of a control: what
What refers to specific procedures that the control owner
performs to address the specific risks. The design of a control
should include the detailed and objective factors, criteria and
parameters used by the control owner to assess if a problem
exists or may exist, as well as what follow-up and resolution
procedures are performed by the control owner in such instances.
Simply put, an effective control must stop (i.e., prevent) a
problem from happening or identify (i.e., detect) and resolve
(i.e., correct) a problem timely.
Example: Wembley Wheels Credit Manager, Jennifer Lee, is required
to formally evaluate requests from new customers to purchase goods
using credit. Company policy requires that new customers have a
business credit score greater than 70 before a credit limit can be
established.
By adhering to this policy, the company prevents adding fictitious
customers and has lower bad debt expense.
Page 17
Part 2: Designing tests of internal controls

18. Design attributes of a control: where
Where addresses instances in which systems are decentralized due to geographic or other
reasons and, consequently, there may be more than one control owner or control environment for
a certain control. If this is the case, the auditor will need assess “who” and “what” as they relate to
the decentralized environment.
Example: A multinational corporation will have different people, and possibly different application
and ITGC, considerations in the different locations that could cause the processing of
transactions to vary from the main location.
The Wembley Wheels One location has a centralized IT system overseen by the IT Manager,
Fiona McGregor.
Page 18
Part 2: Designing tests of internal controls

19. Design attributes of a control: when
When refers to the timeliness of the control being performed, meaning whether the control
functions are timely enough to identify and correct material errors or fraud before the financial
statements are prepared. It may be appropriate for certain controls to function quarterly or
annually, whereas other controls need to function more frequently.
Example: Wembley’s Accounts
Receivable Clerk, Tammy Ying,
prepares a reconciliation of the
accounts receivable subledger to
the general ledger by the 10th of
each month. The Accounting
Manager, Kwame Ababio, reviews
the reconciliation by the 12th of
each month.
Page 19
Part 2: Designing tests of internal controls

20. Design attributes of a control: why
Why addresses why a control exists and is performed to mitigate an identified risk. The why asks
the “what could go wrong” question.
Example: Wembley’s billing
application compares the sales
order and goods delivered note
before creating an invoice and the
journal entry to record the sale.
This matching process prevents
recording sales and accounts
receivable before the time that the
sale should be recognized,
prevents recording fictitious
customers and prevents recording
incorrect amounts.
Page 20
Part 2: Designing tests of internal controls

21. Design attributes of a control: how
How is the consideration of the effect of “how” other components of internal control (e.g., such as
management’s control consciousness) affect a control.
Example: Management establishes qualifications and competencies that employees must have
for key positions. At Wembley Wheels, management establishes credit policies and hires
competent employees to carry out management’s directives.
Hiring competent employees and emphasizing the importance of following internal control
procedures can result in employees making fewer mistakes and making better estimates and
judgments.
Page 21
Part 2: Designing tests of internal controls

22. Testing outcomes and implications
Generally, there are two possible outcomes for control testing.
► No exceptions are noted from the testing.
► When testing is completed as planned without noting control failures,
significant changes in controls or other control-related matters, the
auditor generally is in a position to complete their overall audit strategy
(e.g., integrated audit, financial statement–only audit) as planned.
► When exceptions are encountered, an audit response is required.
► The response depends on, among other things, the nature of the audit
being performed (e.g., an integrated audit vs. a financial statement
audit where no ICFR opinion is rendered).
► Various courses of action might include testing a larger sample of
controls, testing compensating controls, changing the ITGCs testing
strategy (e.g., from a reliance strategy to substantive strategy) or
revising the audit strategy over the audit of the financial statements
(e.g., expand substantive testing due to control ineffectiveness).
Page 22
Part 2: Designing tests of internal controls

23. More about exceptions identified by the auditor
► If the testing identifies a control instance in which the control did not operate as the auditor had
understood, did not operate at all, operated incorrectly, lacked evidence of the control being
performed or had other deficiencies, the auditor:
► Would consider that a control exception occurred (i.e., existed), meaning that the entity’s control had
not functioned as designed. This lack of functioning includes when audit evidence for the failed
control instance was not created, not retained or is otherwise not available to demonstrate that the
control functioned as intended. Keep in mind that oral representations by the entity are not sufficient
audit evidence.
► If the auditor concludes that a control exception did occur, the auditor:
► Makes inquiries of various entity personnel and performs other procedures to understand what went wrong
(i.e., the nature of the exception) and why (i.e., the cause of the exception).
► Determines if the exception was a systematic or random occurrence (it is generally difficult to justify the view
that an exception is random or an isolated instance) and considers if the exception may have been due to
fraud.
► Evaluates the effect of the exception on their planned audit strategy (e.g., reliance strategy) and related
planned audit procedures.
Page 23
Part 2: Designing tests of internal controls
Source: International Standard on Auditing 330.17; American Institute of Certified Public Accountans AU-C 330.17; Public Company Accounting Oversight Board AS 2301.24.

24. Summary: overview of tests of controls – assuming design
effectiveness
Conclude on the operating
effectiveness of controls
Select controls to test Design tests of controls Execute tests of controls
Address control exceptions
Do not rely on controls Rely on controls
Any control exceptions discovered?
Determine the appropriate audit response
Yes No
Page 24
Part 2: Designing tests of internal controls