Client Name Working Paper Title Balance Sheet Date Objective Working Paper # Preparer/Date Reviewer/Date: effectiveness. To document the auditor's assessment of audit strategies. To map each of the questions with the possible risks and proposed control objective/description. To document the type of control and the frequency in which it is applied, as well as the assessment of each relevant control's design and implementation. To capture descriptions of any additional SSAE identified and noted impact to operating Audit Strategies Possible Risks Proposed Internal Control / Description Type of Control Preventive/ Detective Manual/ Automated Frequency? How to test the control? What occurs if the control is working properly and what audit standard applies? What happens isnot w Audit Strategies Identify the audit strategies and related financial statement risks (Existence or Occurrence, Completeness, Valuation, Rights and Obligations, Presentation and Disclosure, Accuracy, Classification, Cutoff) that are applicable. Identify the control objective and description of procedures in place that is relevant to mitigate the identified risk of material misstatement and achieve the objective. Include a detailed description of the control procedures noting the following: 1) Who performs the control procedures? 2) How is/are the procedure(s) performed? 3) How is the performance of the control activity documented (i.e., what forms are used)? 4) How is performance of the control activity evidenced (i.e., signature and date on |form)? Note whether control is preventive (i.e., acts before error, omission, or misstatement may occur) or detective (acts after error/misstatement has occurred). Identify whether the control activity is performed manually (e.g., manual authorization or review of a reconciliation), is automated (i.e., system edit checks, system access restrictions and authorizations, automated review and approvals, etc.), or performed manually using system generated information (i.e., physically verifying existence of inventory using system generated inventory report). Indicate the |frequency in which the control takes place (e.g., annual, quarterly, monthly, daily, every time a transaction is processed). Indicate whether the control is designed effectively (i.e., is the control, individually or in combination with other controls, capable of effectively mitigating the key risk(s) of material misstatement and achieving the control objective?). What outcomes occur if the control works effectively? What outcome control is not w properly or is d Note: Design d occurs when th not effectively: meet its object control, individ combination w controls, is not effectively prev detecting and material misstc 1. Identified GAAS 2. Basic assumptions 3. Consistent premises 4. Logical principles 5. Requirements Working Paper # Preparer/Date Reviewer/Date: b map each of the questions with the possible risks and proposed control objective/description. To document the type of control and the f each relevant control's design and implementation. To capture descriptions of any additional SSAE identified and noted impact to operating Type of Control What occurs if the ible Risks Proposed Internal Control / Description 7 Frequency? meee the ae What happens if the control ea (ae hott Preventive/ Manual/ control? zs is not working? 5 Detective Automated audit standard apply? effectiveness? applies? ludit strategies and |Identify the control objective and Note whether control is __ | Identify whether the control activity is Indicate the Indicate whether the _ | What outcomes occur if| What outcomes occur if the |What applicable | Indicate how the control tial statement risks | description of procedures in place that is preventive (i.e., acts before | performed manually (e.g., manual frequency in control is designed the control works control is not working Statement of improves operating Occurrence, relevant to mitigate the identified risk of error, omission, or authorization or review of a reconciliation), | which the control | effectively (i.e., isthe | effectively? properly or is deficient? Standards for effectiveness. \\s, Valuation, Rights | material misstatement and achieve the misstatement may occur) |is automated (i.e., system edit checks, takes place (e.g., | control, individually or Attestation ns, Presentation _| objective. Include a detailed description of _| or detective (acts after system access restrictions and annual, quarterly, |in combination with Note: Design deficiency Engagements re, Accuracy, the control procedures noting the following: |error/misstatement has _ | authorizations, automated review and monthly, daily, | other controls, capable occurs when the controlis | apply? Cutoff) that are 1) Who performs the control procedures? 2) How is/are the procedure(s) performed? 3) How is the performance of the control activity documented (i.e., what forms are used)? 4) How is performance of the control activity evidenced (i.e., signature and date on form)? occurred). approvals, etc.), or performed manually using system generated information (i.e., physically verifying existence of inventory using system generated inventory report). every time a transaction is processed). of effectively mitigating the key risk(s) of material misstatement and achieving the control objective ?). not effectively designed to meet its objective (e.g., the control, individually or in combination with other controls, is not capable of effectively preventing or detecting and correcting material misstatements)