Key points to consider when using this control library as your guide in testing control activities: 1.

Each control activity illustrated below can have different financial statement assertions, depending on the circumstances. 2. Some of the control activities illustrated below may not be a significant control. 3. To gain audit comfort over a financial statement assertion, we may need to test more than one control activity. 4. If we find exceptions through tests of control activities, we need to assess the potential that these errors may affect the financial statements because of the control breakdown, and seek compensating control(s) to mitigate that specific risk. Where there is no compensating control, we should design substantive testing procedures to address the risk. 5. The methods of testing are illustrative only. They should be tailored according to the circumstances. Descriptions of acronyms Area Information Processing Objectives Type of control Descriptions C= Completeness P = Preventive IT = IT control Frequency of control MUL = Multiple times a day M = Monthly Ad-hoc = Unplanned A = Accuracy PD = Presentation and Disclosure Control Activities We can only obtain comfort from controls within a process when all of the Information Processing Objectives have been achieved for each sub-process in the overall process. This means that controls that satisfy the objectives of completeness, accuracy, validity and restricted access are in place over the initiating, authorizing, A = Accuracy D = Detective MGT = Management control D = Daily Q = Quarterly C= Completeness V = Validity R = Restricted Access

* = Significant control COM = Combined IT and Management control F = Fortnightly W = Weekly H = Half-yearly CO = Cutoff Y = Yearly E/O = Existence/Occurre nce

Financial Statement Assertions

RO = Rights and V = Valuation Obligations

recording, processing and reporting for significant accounts and disclosures. When that is the case, we can use the controls for comfort at the assertion level. In order for a process or sub-process to be effectively controlled, all four of the information processing objectives (Completeness, Accuracy, Validity and Restricted Access - CAVR) must be achieved by the controls in the process or sub-process.

Control objective

Ref. No.

Inventory movements are input in the proper period.

1*

Description of IP FS P or Control Activity objecti Assertions D ve (C, (C, A, CO, A, V, E/O, PD, RO, R) V) For all shipments, C C, E/O, CO D requisitions, transfers, or other movements of materials, the number of the last prenumbered document issued during the period and the first number of the prenumbered document in the next period are recorded. These documents are traced on a timely basis (i.e. before the period is closed) to transactions recorded in the system to verify that inventory movements are recorded in the proper period. Discrepancies are identified, investigated and corrected on a timely basis.

IT, MGT Freq or COM

MGT

Quantities and descriptions of inventory movements are input accurately.

2*

Quantities and descriptions of inventories issued to production are reconciled to inventories received into production on a periodic basis. Discrepancies are investigated, corrected, and reprocessed as necessary on a timely basis.

C, A

C, A, V

MGT

3*

Periodic physical C, A, V inspections of raw material quantities on-hand are compared to manually or system recorded quantities. Differences are investigated and adjusted as necessary. Sequentially prenumbered production reports are grouped and a numerical total is calculated (e.g., number of documents, total quantities, hash totals) and compared to input/update transfer reports. All out of balance conditions are investigated, corrected and reentered on a timely basis. Follow-on batch totalling is completed for the re-entered data. C, A

C, A, V, E/O

MGT

Periodic updates for batch processing are appropriately executed.

4*

C, A, V

COM

Correct postings are made to inventory accounts in the general ledger.

5*

General ledger and other records are manually reviewed and compared to information contained in source documents to ensure that variances are properly recorded. Discrepancies are identified, resolved and reentered. The check occurs again for reentered data. Accuracy and completeness of production variances are periodically verified by manual re-computation, tracing to source documents, or other appropriate methods. These computations are compared to those recorded on the general ledger. Discrepancies are identified, investigated and corrected on a timely basis. The check occurs again for reentered data.

C, A

C, A, V

MGT

6*

C, A

C, A, V

MGT

Ad-hoc

7*

Management reviews financial reports, with comparisons to budgeted amounts or other financial data (by product or location where applicable), for reasonableness of inventory. Variances are investigated and corrected as necessary. Inventory is stored in secured areas and security systems prevent unauthorized personnel from gaining access to warehouses. Satisfactory security measures exist over vehicles entering or leaving the site (e.g., weighing or spot counts). Staff responsible for supervising physical inventory counts are segregated from inventory custody, shipping, purchasing and receiving functions.

C, A, V

C, A, V, E/O, RO

MGT

Access to physical inventories and related documents is restricted.

8*

Indirect for most except RO

MGT

Ad-hoc

9*

Indirect for most except RO

MGT

Standard costs are approved prior to implementation.

10

New standard costs, changes to existing standard costs, and other master file information are approved in writing, prior to input, by appropriate management. This includes review of supporting documentation. Edit checks are performed on data entered. Invalid data is rejected for re-entry or stored in a suspense file where it is investigated, corrected and reentered on a timely basis.

A, V

A, V, E/O

MGT

Ad-hoc

11

A, V

A, V, E/O

IT

Ad-hoc

Note: Those control activities identified by * are often significant controls Documentation The documentation of our validation of controls should be sufficient that a reviewer can understand what work was done, what evidence was seen and what the findings were. For show me meetings we should document: who we meet and the date of the meeting who attend from PwC concise description of what management needs to get comfort on concise description of how management gets comfort concise description of the validation performed including specific evidence examined. Exceptions should be described to the extent necessary to enable a reader to understand the nature, cause and impact on the audit of the control breakdown or exception. An overall conclusion on the result of the controls testing should be documented. Sample size

For automated or IT controls, a sample possibly as small as one transaction will need to be tested. Automated controls will apply in a consistent manner to all similar transactions. However, to place reliance on automated controls, general computer controls must be tested in the audit year. The minimum number of occurrences selected for manual or management and combined (i.e. consisting of both management and IT controls) should be as follows: 2 items for controls performed quarterly 3 items for controls performed monthly 10 items for controls performed weekly 20 items for controls performed daily 30 items for controls performed multiple times per day For controls performed on an ad-hoc basis, the number of occurrences during the year should be estimated and tested using the guidance levels provided above. Suggested tests of significant controls. Notes: 1. This table does not attempt to provide a total list of possible tests. It is illustrative only. 2. The reference numbers of the tests relate to the reference numbers of the control activities.

Ref. No. 1

Test of Control

Sample size and details

Report to client (Yes/No)

Confirm by inquiry with management and 20 items over the period of examination of documentary evidence the review. that document numbers are recorded in the proper period for all shipments, requisitions, transfers and other movements of inventories discrepancies are identified and corrections are checked and made on a timely basis documents are traced to transactions recorded in the system. Confirm by inquiry with management and examination of reconciliations that: quantities and descriptions of inventories issued to production are reconciled to inventories received into production discrepancies are investigated, corrected, and reprocessed as necessary on a timely basis. Examine documentation of investigation and assess the appropriateness of the results of the investigation. 20 items over the period of the review.

Confirm by inquiry with management and examination of raw material inspection reports that raw material quantities on-hand are compared to manually or system recorded quantities, and that differences are investigated and adjusted as necessary. Assess the appropriateness of reasons for adjustments.

Inspection reports for 2 quarters over the period of the review.

Confirm by inquiry with management and 1 transaction from as the examination of documentary evidence that: control is an automated Sequentially prenumbered production control. However, if hash reports are grouped and a numerical total is totals are manually calculated (e.g. number of documents, calculated, select 20 quantities, hash totals) and compared to batches over the period for input/update transfer reports. testing, and reperform All out of balance conditions are calculation of the hash investigated and re-entered on a timely totals. basis. Follow-on batch totalling is completed for re-entered data Note: Systems that update online vs. batch may indicate a more complex and userconfigurable computing environment (e.g., SAP, Oracle, JD Edwards). Subject matter experts from the SPA group should be consulted to ensure effective controls.

Confirm by inquiry with management and examination of documentary evidence that: General ledger and other records are reviewed and compared to information contained in source documents to ensure that variances are properly recorded. Discrepancies are identified, investigated, corrected and re-entered. The check occurs again for re-entered data. Assess the appropriateness of explanations for the discrepancies.

20 items over the period of the review .

Confirm by inquiry with management and examination of documentary evidence that: Accuracy and completeness of production variances are periodically verified by manual re-computation, tracing to source documents, or other appropriate method. These computations are compared to those recorded on the general ledger. Discrepancies are investigated and corrected on a timely basis. The check occurs again for re-entered data. Assess the appropriateness of explanations for the discrepancies.

Number of transactions tested depends on frequency of control performance.

Confirm by inquiry with management and 3 items over the period of examination of documentary evidence that: the review. Financial reports are reviewed regularly by management. The financial results are compared to budget and other financial data (by product or location where applicable), for reasonableness of inventory and inventory costs. Unusual variances are investigated and corrected as necessary. Assess the appropriateness of explanations for unusual variances.

Confirm by inquiry with management and observation that: Inventory is stored in secured areas and security systems prevent unauthorized personnel from gaining access to warehouses. Security measures exist over vehicles entering or leaving the site (e.g., weighing or spot counts). Review the warehouse visitors' log to verify that access to the warehouse is restricted to authorised staff and visitors.

Number of transactions tested depends on frequency of control performance.

30 days' logs over the period of the review.

Confirm by inquiry with management and examination of documented roles and responsibilities that: Staff responsible for supervising physical inventory counts are segregated from inventory custody, shipping, purchasing and receiving functions. This test may also be perform during a stock take observation.

Confirm once per year including obtaining an understanding of arrangements for holiday and other absences. Test once per year.

10

Confirm by inquiry with management and examination of documentary evidence that: Management approves all new standard costs, changes to existing standard costs, and other master file information in writing, prior to input. Supporting documents are reviewed.

Number of transactions sampled depends on frequency of control performance.

11

Confirm by inquiry with management and examination of documentary evidence that: Edit checks are performed on data entered. Invalid data is rejected for re-entry or stored in a suspense file where it is investigated, corrected and re-entered on a timely basis. Assess appropriateness of results of investigation.

Number of transactions sampled depends on frequency of control performance.

Results of testing If one control simply does not work or is not effective, it is important to consider whether there are other controls that provide management with comfort, and to determine whether those controls may , in fact, do the same job. What constitutes "is not working or not effective" is a matter of professional judgement. As a rule of thumb a negligible departure is less than 10 % for controls tested more than 10 times and no exception for controls tested less than 10 times. However, we need to be aware of the nature of the deviation / breakdown and the potential for the weakness to result in a material misstatement and whether the planned procedures will, overall, provide sufficient assurance over the financial statement assertions. If we conclude as a result of validation work that we are unable to obtain audit comfort as a result of weaknesses in controls ,we should: inform the client. All material weaknesses should be communicated to the board / audit committee / referring PwC office / parent company as applicable consider whether the weakness could result in a material misstatement in the financial statements if a material misstatements might have occurred, through either error or fraud, consider whether other planned audit procedures will result in sufficient assurance, and if not, design further appropriate substantive tests.