Johnson, CPA, was engaged to audit the financial statements of Horizon Incorporated, which has its own computer installation. While obtaining an understanding of internal control, Johnson found that Horizon lacked proper segregation of the programming and operating functions. As a result, Johnson assessed control risk at maximum.

Required:

a. Give reasons why Johnson made this assessment.

b. What are compensating general controls that Johnson might find to lower his assessment of control risk? Do not discuss hardware and application controls.

c. If no compensating general controls were found by the auditor, what effect would this have on substantive tests?