Omega Ltd.

Omega Ltd. has implemented an automated three-way matching system for purchases.

The system prevents recording of a purchase invoice unless:

the purchase order exists,
the goods-received note is available, and
the invoice quantity does not exceed the quantity received.

During the audit, the auditor identifies the following:

the system administrator can modify the matching parameters;
changes to the parameters are logged;
the administrator’s changes are reviewed monthly by the CFO;
the CFO’s review is documented;
during the year, the administrator changed the tolerance level from 2% to 15% for three months;
the CFO’s monthly review identified the change but did not investigate it because purchase-price differences were considered individually immaterial.

The auditor initially assessed the risk of material misstatement in purchases as low because the three-way matching control is automated.

After understanding the above facts, the engagement partner states:

“The existence of an automated control is sufficient to conclude that the risk is low because an automated control operates consistently unless there is evidence that the system itself has failed.”

Which ONE of the following is most appropriate?

A. The partner is correct because automated controls generally operate consistently and therefore their existence substantially eliminates the need to consider management intervention.

B. The partner is incorrect because the auditor must consider the design and implementation of controls, including the possibility that authorised users can override or alter relevant control parameters.

C. The partner is correct because the CFO reviewed the changes monthly, and therefore any weakness in the automated control is automatically compensated by the review control.

D. The partner is incorrect only because the auditor is required to perform substantive procedures on every purchase transaction whenever an automated control is used.