R1. (a) It is acceptable to use the same set of samples when testing both controls, as each “transaction” should pass through all of the controls in a business process. It becomes more efficient to test the same set, because the audit team could request a comprehensive documents package from the client.
The sample size table in Appendix A indicates that a sample size of 58 is acceptable for the first control, but the higher estimated population deviation rate for the second control suggests that a larger sample size of 77 is necessary in order to gather sufficient evidence and obtain reasonable assurance over the control. The larger of the possible sample sizes should be selected for testing, because the results based on 58 samples does not give sufficient assurance to conclude that the second control is working effectively.
(b) I agree with Darrell’s conclusion for the first control, because the evaluation table in Appendix A suggests that the computed upper deviation rate is approximately 8% (which is equal to the firm’s tolerable deviation rate for a moderately important control).
The sample size table suggests that 2 deviations are acceptable for the second control, had Darrell tested 77 samples. However, his sample size consisted of only 58 items, so the 2 deviations found are not acceptable unless further testing is conducted. The evaluation table also indicates that the computed upper deviation rate is approximately 11%, which is higher than the acceptable deviation rate for the control. More evidence must be gathered before it can be concluded that the control is reliable.
(c) To support his assessment that both controls are operating effectively, Darrell must test 19 additional transactions for the second control. Per the sample size table, no further deviations should be identified in order for him to conclude that the control is reliable, seeing as he previously identified 2 deviations.
R2 (a) A sample size of 74 should be