To guide the audit intern on the team, Robert outlined the process to identify the controls to be tested at Blocktastic. James and Partners use a top-down, risk-based approach to accomplish this. Starting with identifying the entity-level controls, the audit team then moves on to identify the significant accounts and disclosures. This helps them understand where the likely sources of misstatements are. Based on this information, the audit team then selects which controls to test. Robert emphasised that the most critical aspect of this entire process is that the audit team must have an in-depth knowledge and understanding of Blocktastic. Without a clear understanding of the Blocktastic, it is not possible to effectively identify which controls to test as part of the audit. Robert also highlighted that the audit team does not need to test all controlsonly controls that are important to the audit opinion. Those controls are often referred to as "key" controls and can be preventive controls, detective controls, or a combination of both. Robert concluded by stating that identifying the controls to be tested requires professional judgment and lots of experience.

Below are some examples of controls at Blocktastic documented after through discussions with entity personnel and review of entity documents:

Control 1: The accounting team at Blocktastic reconciles the accounts receivable subsidiary ledger to the general ledger using a monthly reconciliation process and passed to the team's manager for review. The audit team is relying heavily on the operating effectiveness of this control.

Control 2: Before generating an invoice, Blocktastic's computer system performs a three-way match of the customer order, shipping order, and bill of lading. As this control takes place for every invoice, it is performed very often.

Control 3: The cash payments team at Blocktastic make a cash disbursement only after they have matched the vendor invoice to the receiving report and purchase order. Those documents would be attached together and marked as paid. As this control takes place for every cash disbursement, it is performed very often.

Control 4: Blocktastic has a policy of numbering all suppliers' invoices using pre- numbered vouchers. This control works with a number of other controls to ensure all purchases are recorded.

a) Identify control risks associated with each control and explain why is it a control risk?

b) State a control test for each of the identified control risk that you could undertake to test the control is operating as expected.

answer according to Australian auditing standards and justify your answer