Hi all,
I'm a little confused on setting control risk and am trying to work through it. My understanding is this:
When setting control risk, we use our understanding of the design of controls and test to see if they are implemented correctly. When testing for our assessment of controls, we can use procedures such as walk-through, inquiry, observation, and inspection.
If, based on our assessment of controls, we believe controls are strong we can then test for the effectiveness of controls. These tests can be performed using inquiry, re-performance, observation, and inspection. The results of control testing will affect the nature, extent, and timing of substantive procedures. Likewise, if controls are initially assessed as weak, we jump right to substantive testing.
So, assuming my thinking is correct, is there any real difference in procedures performed for assessing control risk and then testing controls effectiveness?
Thanks in advance for any responses!