We are restoring the requested view from its saved state. Your account and work remain unchanged while you wait.
Back to the track — Internal Auditor
Management asks audit to rely on payment-file approval because every file carries a signature. The period population is 240 files worth 1,284,600.00 and the sample is 30. Timestamps show three cases transmitted before approval, and a partial rerun bypasses duplicate prevention exposing 23,000.00. Prove population and report, test the right attributes, investigate cause and decide reliance or expanded substantive work.
Control testing begins with a precise claim, not a sample. Replace ‘payments are approved’ with a statement of amount, approver, timing, version and retained evidence. Define risk, assertion, period, population, frequency, owner and evidence so the result can be disproved. Keep design and operating effectiveness separate; a larger sample cannot repair a design that misses beneficiary changes after approval.
The population is every occurrence of the control, not the easiest owner export. Define system, report, entity, dates, status, currency and extraction time; reperform record count and total and reconcile to an independent source. Include manual, cancelled, amended and emergency routes. If the owner lists 240 payments but the bank shows 246 files, resolve six missing files before sampling and retain a fixed fingerprinted version.
Inquiry explains, observation sees current operation, inspection reads a retained trace and reperformance repeats the calculation or decision. Match procedure to attribute: approval timing needs timestamps and version linkage; duplicate prevention needs a controlled replay and rejection log; report review needs the reviewer’s expectation, challenge and resolution. Combine procedures where evidence is editable or report-dependent.
A diligent reviewer can operate on an incomplete report. Understand source fields, query logic, filters, interfaces, transformations, parameters and cut-off. Test completeness from an independent source into the report and accuracy from report to evidence; inspect spreadsheet formulas and hardcodes. Agreement to 1,284,600.00 can still hide a missing 23,000.00 offset by another item. An unproven report is a conclusion gap, not system-branded assurance.
Define success, deviation and not-applicable treatment for every attribute before testing. A one-minute late approval is a deviation when prevention is the objective. Alternative evidence is acceptable only if design permits it and it proves the same fact. Do not change criteria after the first exception; document item, attribute, facts, effect, cause and possible spread, and return to design assessment when the original description was incomplete.
The treatment starts from these documents. Follow the numbers to identify recognition date, amount, counterparty, reference and approval evidence before preparing the entry.
Facts and supporting evidence
Testing proved a duplicate 23,000.00 payment that remains recoverable.
Correct treatment and entry
| Account | Debit | Credit |
|---|---|---|
| Supplier receivable — duplicate payment | 23,000.00 | |
| Cash at bank | 23,000.00 | |
| Total (SAR) | 23,000.00 | 23,000.00 |
Treatment and financial effect
The entry records the recovery asset while the preventive deviation remains separately in test results.
Reperformance starts from this case's own facts: Testing proved a duplicate 23,000.00 payment that remains recoverable. Obtain the original source that proves this event. The training drawings Payment approval control test, Duplicate-block reperformance explain field shape and reading order; they do not replace the case document or transfer their figures into it. Match entity, period, currency, reference and version to the process narrative, risk-control matrix, population and operating evidence, then confirm that the source supports the debit side (Supplier receivable — duplicate payment) and the credit side (Cash at bank). Missing ownership, date, reference or approval remains an open exception; a balancing journal or undocumented assumption does not cure it.
Remeasure from the facts before reading the proposed journal, then add it independently: total debits 23,000.00 and total credits 23,000.00. Debit detail: Supplier receivable — duplicate payment for 23,000.00. Credit detail: Cash at bank for 23,000.00. Link every line to the recognition or measurement rule explained in the lecture, then trace its reference and posting date. After posting, test the control test sheet, exception log and owner response. Equal sides prove arithmetic only, not the correct account, period or classification.
Before close, compare the correct treatment with the common alternative and record its specific effect: Payables are understated and the 23,000.00 receivable is absent. Do not close until the journal agrees with the conclusion, finding, risk rating and remediation plan and an independent reviewer can move from balance to account, reference and this event's own source. Keep the calculation, source version, journal identifier, reconciliation result and unresolved exceptions in the same workpaper. An attached file without a stated conclusion is not review evidence.
Preserve control population, report parameters and fingerprint plus approval, version and bank-transmission timestamps. Test access, change management, duplicate rule, fields and interfaces. An export does not prove completeness; reconcile file count and total to bank logs and include manual, emergency and cancelled routes.
Test 30 of 240 files: prove the 1,284,600.00 population, test approval timing and version fingerprint, document three deviations and the 23,000.00 bypass, then write the reliance conclusion.
Work output: A workbook
These are yours once downloaded, and need no account. Fill them with your own figures and keep them in your portfolio.
Reperform matching as one attribute, then identify why its success does not prove approval timing, beneficiary or report completeness.
Test a payment control through eight decisions from claim to audit-program impact.
What you haveDescription says every file is approved.
The arithmetic in this case runs in the tool itself, which is open to you any time with your own figures.
Log every claim without timing or population, report without completeness and accuracy work, attribute without a suitable procedure, and deviation without cause, spread and effect investigation.
This is not sent anywhere and not stored here. Write it down for yourself — in the workpaper you downloaded, or on paper.
Control testing defines a precise claim, proves operating population, chooses suitable attributes and procedures and tests control information and dependencies. Deviations are investigated, not replaced, for nature and spread. The conclusion states period, scope, limitations and impact on reliance and other work.
Why are signatures on thirty files insufficient to prove the approval control effective?
Answer every question. Getting them all right records this lesson; you may retry as often as you need.
Reading alone records nothing.
The complete applied walkthrough is available below while the recording is prepared.
Convert ‘every file is approved’ into a claim: treasury manager approval before transmission on the same version for every above-limit file. Prove 240 files and 1,284,600.00 to bank logs and report parameters, select thirty and test time, version and beneficiary. Three signatures followed transmission. Reperform duplicate prevention and a partial rerun passes 23,000.00. Do not replace failures; investigate cause and spread and test report, access and change management. Recovery corrects cash but not prevention. Conclude no reliance for the period, extend substantive work and raise supported design and operating gaps.
When an item fails, confirm data, selection and procedure, then determine whether cause clusters by user, branch, period or transaction type. Never replace a failed selected item with a clean one. Extend testing only to answer a defined spread question. A compensating control must be independent, precise and timely; recovering 23,000.00 corrects cash but does not make the preventive control effective.
Testing January through September does not automatically cover the final quarter. Assess changes in owner, system, authority, report, population, exception path and losses; inspect change evidence and remaining-period occurrences and perform risk-based additional work. Automated stability depends on proven change and access controls, while manual or infrequent controls need closer year-end evidence. A once-only close control must be tested when it occurs.
Conclude with control, population, period, selection, procedures, attributes, results, deviations, effect and limitations. Do not call a control effective when population or IT dependency is unproven or an exception closed only after period-end. Compare deviation rate and nature to tolerance and risk; one beneficiary-change failure can outweigh several missing formal signatures. State reliance, added substantive work, design gap or finding and link each judgement to evidence.
Facts and supporting evidence
A late-approval item showed 40,000.00 paid to an unintended beneficiary.
Correct treatment and entry
| Account | Debit | Credit |
|---|---|---|
| Recovery receivable | 40,000.00 | |
| Cash at bank | 40,000.00 | |
| Total (SAR) | 40,000.00 | 40,000.00 |
Treatment and financial effect
Deviation nature matters beyond count because beneficiary change accelerates cash loss.
Reperformance starts from this case's own facts: A late-approval item showed 40,000.00 paid to an unintended beneficiary. Obtain the original source that proves this event. The training drawings Payment approval control test, Duplicate-block reperformance explain field shape and reading order; they do not replace the case document or transfer their figures into it. Match entity, period, currency, reference and version to the process narrative, risk-control matrix, population and operating evidence, then confirm that the source supports the debit side (Recovery receivable) and the credit side (Cash at bank). Missing ownership, date, reference or approval remains an open exception; a balancing journal or undocumented assumption does not cure it.
Remeasure from the facts before reading the proposed journal, then add it independently: total debits 40,000.00 and total credits 40,000.00. Debit detail: Recovery receivable for 40,000.00. Credit detail: Cash at bank for 40,000.00. Link every line to the recognition or measurement rule explained in the lecture, then trace its reference and posting date. After posting, test the control test sheet, exception log and owner response. Equal sides prove arithmetic only, not the correct account, period or classification.
Before close, compare the correct treatment with the common alternative and record its specific effect: Expense is overstated and assets understated by 40,000.00. Do not close until the journal agrees with the conclusion, finding, risk rating and remediation plan and an independent reviewer can move from balance to account, reference and this event's own source. Keep the calculation, source version, journal identifier, reconciliation result and unresolved exceptions in the same workpaper. An attached file without a stated conclusion is not review evidence.
Facts and supporting evidence
Report-completeness testing found a received 48,000.00 service omitted from the approval population.
Correct treatment and entry
| Account | Debit | Credit |
|---|---|---|
| Service expense | 48,000.00 | |
| Accrued supplier payable | 48,000.00 | |
| Total (SAR) | 48,000.00 | 48,000.00 |
Treatment and financial effect
The control-information exception requires statement correction and prevents reliance on the incomplete report.
Reperformance starts from this case's own facts: Report-completeness testing found a received 48,000.00 service omitted from the approval population. Obtain the original source that proves this event. The training drawings Payment approval control test, Duplicate-block reperformance explain field shape and reading order; they do not replace the case document or transfer their figures into it. Match entity, period, currency, reference and version to the process narrative, risk-control matrix, population and operating evidence, then confirm that the source supports the debit side (Service expense) and the credit side (Accrued supplier payable). Missing ownership, date, reference or approval remains an open exception; a balancing journal or undocumented assumption does not cure it.
Remeasure from the facts before reading the proposed journal, then add it independently: total debits 48,000.00 and total credits 48,000.00. Debit detail: Service expense for 48,000.00. Credit detail: Accrued supplier payable for 48,000.00. Link every line to the recognition or measurement rule explained in the lecture, then trace its reference and posting date. After posting, test the control test sheet, exception log and owner response. Equal sides prove arithmetic only, not the correct account, period or classification.
Before close, compare the correct treatment with the common alternative and record its specific effect: Suspense is overstated and expense understated by 48,000.00. Do not close until the journal agrees with the conclusion, finding, risk rating and remediation plan and an independent reviewer can move from balance to account, reference and this event's own source. Keep the calculation, source version, journal identifier, reconciliation result and unresolved exceptions in the same workpaper. An attached file without a stated conclusion is not review evidence.
Facts and supporting evidence
Testing found a 75,000.00 manual journal posted by a user with create-and-approve access.
Correct treatment and entry
| Account | Debit | Credit |
|---|---|---|
| Accrued liabilities | 75,000.00 | |
| Maintenance expense | 75,000.00 | |
| Total (SAR) | 75,000.00 | 75,000.00 |
Treatment and financial effect
It reverses the wrong journal while user access remains a deviation requiring scoping and investigation.
Reperformance starts from this case's own facts: Testing found a 75,000.00 manual journal posted by a user with create-and-approve access. Obtain the original source that proves this event. The training drawings Payment approval control test, Duplicate-block reperformance explain field shape and reading order; they do not replace the case document or transfer their figures into it. Match entity, period, currency, reference and version to the process narrative, risk-control matrix, population and operating evidence, then confirm that the source supports the debit side (Accrued liabilities) and the credit side (Maintenance expense). Missing ownership, date, reference or approval remains an open exception; a balancing journal or undocumented assumption does not cure it.
Remeasure from the facts before reading the proposed journal, then add it independently: total debits 75,000.00 and total credits 75,000.00. Debit detail: Accrued liabilities for 75,000.00. Credit detail: Maintenance expense for 75,000.00. Link every line to the recognition or measurement rule explained in the lecture, then trace its reference and posting date. After posting, test the control test sheet, exception log and owner response. Equal sides prove arithmetic only, not the correct account, period or classification.
Before close, compare the correct treatment with the common alternative and record its specific effect: Expense and income are each overstated by 75,000.00. Do not close until the journal agrees with the conclusion, finding, risk rating and remediation plan and an independent reviewer can move from balance to account, reference and this event's own source. Keep the calculation, source version, journal identifier, reconciliation result and unresolved exceptions in the same workpaper. An attached file without a stated conclusion is not review evidence.