## Audit of Sales Revenue – Risk Assessment & Internal Control Testing

### Overview

Before testing individual transactions, the auditor must understand and assess the internal controls over the sales cycle. The strength of controls determines how much substantive testing is needed.

---

### Procedure (i) – Obtain Understanding of Internal Controls over Sales

The auditor asks management and documents:

Control Question	Why It Matters
Is there segregation of duties?	Prevents one person from committing and concealing fraud
Who checks credit limits?	Prevents sales to customers who cannot pay
Who authorises the sale order?	Ensures only valid orders are accepted
Who raises the sale invoice?	Separating this from dispatch prevents fictitious invoices
Who collects the amount received from the debtor?	Separating collection from recording reduces theft risk
Who records the transaction in the books?	Recording should be independent of authorisation
Who ensures risk & reward has transferred?	Ensures revenue is recognised only when earned

---

### Procedure (ii) – Test the Controls

After understanding, the auditor tests whether controls actually operate as described:

Select a sample of sales transactions.
For each: verify that the control steps (credit check, order authorisation, invoice raising, dispatch confirmation) were all followed.
Evaluate how strong and reliable the controls are.

#### Impact on Audit Strategy:

Control Strength	Auditor's Response
Internal Controls Strong	Reduce the extent of substantive procedures
Internal Controls Weak	Increase substantive testing; communicate the deficiency to management/TCWG

---

### Procedure (iii) – Sample of Transactions

Select a random sample of transactions.
Examine supporting documents for each: customer orders, invoices, dispatch notes, receipt confirmations.

---

### Procedure (iv) – Substantive Audit Procedures Are Mandatory

Even if internal controls are very strong, the auditor must perform some substantive audit procedures on revenue. Controls testing alone is not sufficient — it only confirms that controls operated, not that the financial statements are free from material misstatement.

Worked example

### Example 1

Example – Evaluating Segregation of Duties:

In a small company, the same person raises the invoice AND records the receipt. This is a control weakness. The auditor should: (a) note the deficiency, (b) communicate it to management in writing, (c) increase the extent of substantive procedures on sales and debtors, particularly checking for fictitious sales and misappropriated cash receipts.

### Example 2

Example – Control Testing Result:

The auditor tests 25 sales transactions to check if credit limits were verified before sales orders were approved. In 4 out of 25 cases, there is no evidence of credit limit check. Conclusion: The control is not operating effectively. The auditor should expand substantive testing and consider whether any sales to over-limit customers are now unrecoverable (impacting the recoverability of debtors).

⚠️ Common exam mistakes

Relying entirely on control testing without performing any substantive procedures — SA 330 requires some substantive procedures regardless of control strength.
Not documenting the understanding of internal controls — the auditor must record the basis for the assessed risk.
Treating verbal assurances from management as evidence that controls exist — controls must be tested through observation, inspection of documents, or re-performance.
Forgetting to communicate internal control deficiencies to management or those charged with governance (TCWG) in writing.
Using the same sample for control testing and substantive testing without recognising that their objectives differ.

Reference:

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →