MCQ 2 — SA 330 The control actually failed — but what does that tell you? Zenith Ltd.

MCQ 2 — SA 330

The control actually failed — but what does that tell you?

Zenith Ltd. has an automated control that blocks sales invoices from being generated unless the customer’s approved credit limit is available.

The auditor intends to rely on this control for the entire year.

During testing, the auditor selects 60 instances and identifies one deviation. On investigation, the deviation arose because the system was temporarily unavailable for approximately two hours during a scheduled software update. During that period, the finance manager manually approved three invoices.

The auditor obtains evidence that:

the software update was properly authorised;
the system was restored after two hours;
the three manual approvals were subsequently reviewed;
no misstatement resulted from the three invoices.

The audit senior concludes:

“Since a deviation has been identified, the auditor can no longer rely on the control for the year and must replace the control-based approach entirely with substantive procedures.”

Which ONE of the following is most appropriate?

A. The conclusion is correct because any deviation from a control on which reliance is intended automatically prevents reliance on that control for the entire period.

B. The conclusion is incorrect because a deviation caused by a temporary system failure can never affect the auditor’s assessment of operating effectiveness if no financial statement misstatement resulted.

C. The conclusion is correct only if the deviation occurred more than once; a single deviation is irrelevant unless it indicates a recurring control failure.

D. The conclusion is premature because the auditor should inquire into the deviation and its potential consequences and then determine whether the tests performed provide an appropriate basis for reliance, whether additional tests of controls are necessary, or whether the risks should instead be addressed through substantive procedures.