Auditing standards indicate that if the preliminary control risk assessment is low, the auditor must gain assurance that the controls are operating effectively.
a. What is meant by testing the operating effectiveness of control procedures? How does an auditor decide which controls to test?
b. How is the auditor's assessment of control risk affected if a documented control procedure is not operating effectively? Explain the effect of such an assessment on substantive audit procedures.