Chapter 8 “RICK HAYES”

“ANALYTICAL PROCEDURES”

8.2 Introduction

Analytical procedures are evaluations of financial information through analysis of plausible relationships
among both financial and non-financial data. Analytical procedures also encompass such investigation as
is necessary of identified fluctuations or relationships that are inconsistent with other relevant information
or that differ from expected values by a significant amount. Put another way, analytical procedures entail
the use of comparisons and relationships to determine whether account balances or other data appear
reasonable.

 Relationships Among Data

A basic premise of using analytical procedures is that there exist plausible relationships among
data and these relationships can reasonably be expected to continue. Analytical procedures
include the comparison of the entity's financial statements with prior period information,
anticipated results such as budgets, and similar industry information. For instance, an entity's
accounts receivable turnover ratio may be compared to that ratio for the industry or for a similar
company.
Analytical procedures are used to determine relationships among financial information that would
be expected to conform to predictable patterns based on the entity’s experience, such as gross
margin percentages, and between financial and non-financial information such as the relationship
between payroll costs and the number of employees.
 Types of Analytical Procedure
General analytical procedures include trend analysis, ratio analysis, statistical and data mining
analysis, and reasonableness tests. Trend analysis is the analysis of changes in an account balance
over time. Ratio analysis is the comparison of relationships between financial statement accounts,
the comparison of an account with non-financial data, or the comparison of relationships between
firms in an industry. Reasonableness testing is the analysis of account balances or changes in
account balances within an accounting period terms of their ‘reasonableness’ in light of expected
relationships between accounts. Data mining is a set of computer-assisted techniques that use
sophisticated statistical analysis, including artificial intelligence techniques, to examine large
volumes of data with the objective of indicating hidden or unexpected information or patterns.
For these tests auditors generally use computer-aided audit software (CAATs).
  When to Use Analytical Procedures
The auditor shall design and perform analytical procedures near the end of the audit that assist the
auditor when forming an overall conclusion as to whether the financial statements are consistent
with the auditor's understanding of the entity according to ISA 520. In the overall review stage (at
the end of the audit) the objective of analytical procedures is to assess the conclusions reached
and evaluate the overall financial statement presentation. It may be used to detect material
misstatement that other tests can overlook, such as fraud or understatement errors.
Analytical procedures may also be used in planning and applied to substantive testing. In the
planning stage analytical procedures may be used to highlight risk area to narrow the focus of
planning the nature, timing, and extent of auditing procedures. In the substantive testing stage of
the audit, analytical procedures are used to see ‘the big picture’, i.e. obtain evidence to identify
misstatements in account balances and thus to reduce the risk of misstatements.
 Computer Assisted Audit Techniques (CAATs)
The use of computer assisted audit techniques (CAATs) may enable more extensive testing of
electronic transactions and account files. CAATs can be used to select sample transactions from
key electronic files, to sort transactions with specific characteristics, or to test an entire
population instead of a sample. CAATs generally include data manipulation, calculation, data
selection, data analysis, identification of exceptions and unusual transactions, regression analysis
and statistical analysis. CAATs are available on generalised audit software (GAS) which provides
the auditors with the ability to access, manipulate, manage, analyse and report data in a variety of
formats. Data mining software may also be used for analytical procedures.
When analytical procedures identify significant fluctuations or relationships that are inconsistent
with other relevant information or that deviate from predicted amounts, the auditor should
investigate and obtain adequate explanations and appropriate corroborative evidence. The
investigation of unusual fluctuations and relationships ordinarily begins with inquiries of
management followed by corroboration of management’s responses and other audit procedures
based on other audit procedures based on the results of these inquiries.

8.3 The Analytical Review Process

The process of planning, executing, and drawing conclusions from analytical procedures is called
analytical review. There are several views, theoretical and practical, of the sub- processes involved in
analytical review.
The theoretical view is that the review process consists of four diagnostic processes:

1 mental representation,

2 hypothesis generation,

3 information search,

4 hypothesis evaluation.

In particular, auditors hypothesise causes and related probabilities, gather evidence to test the hypotheses,
and ultimately select which hypotheses are most likely to cause the fluctuation.

 Four-Phase Process
Here we use a practitioner approach, the four-phase process most common in professional
literature:
 phase one - formulate expectations (expectations);
 phase two - compare the expected value to the recorded amount (identification);
 phase three - investigate possible explanations for a difference between expected and
recorded values (investigation);
 phase four - evaluate the impact of the differences between expectation and recorded
amounts on the audit and the financial statements (evaluation).

8.4 Formulating Expectations

Expectations are developed by identifying plausible relationships that are reasonably expected to exist
based on the auditor's understanding of the client and of his industry. These relationships may be
determined by comparisons with the following sources:

 comparable information for prior periods;

 anticipated results (such as budgets and forecasts, or auditor expectations);
 elements of financial information within the period;
 similar industry information;
 non-financial information.
  Sources of Information and Precision Of Expectations
The source of information on which the expectations are based (e.g. prior period statements,
forecasts, industry information) determines, in part, the precision with which the auditor predicts
an account balance. For example, information from other, similar stores in the same retail chain is
more precise than general industry information. Recent years' financial statements are more
precise a predictor of this year's balance than older financial statements. The desired precision of
the expectation varies according to the purpose of the analytical procedure. Expectations
developed at a detailed level generally have a greater chance of detecting misstatement of a given
amount than do broad comparisons. Monthly amounts will generally be more effective than
annual amounts and comparisons by location or line of business usually will be more effective
than company-wide comparisons. Precision is more important for analytical procedures used as
substantive tests than for those used in planning.
 Nature of Account and Characteristics of Data
The effectiveness of an analytical procedure is a function of the nature of the account and the
reliability and other characteristics of the data. In determining the nature of the account we
consider whether the balance is based on estimates or accumulations of transactions, the number
of transactions represented by the balance, and the control environment. Subjectively determined
balances are more easily manipulated than accumulations of transactions. If the characteristic of
the account is that it comprises millions of transactions (e.g. retail revenue), it should be more
predictable than those comprising a few transactions (e.g. obsolete inventory). Fixed expenses
(e.g. leases) are more predictable than variable expenses (e.g. shipping).

8.5 General Analytical Procedures

The general analytical procedures are trend analysis, ratio analysis, statistical and data mining analysis,
and reasonableness tests. Determining which type of analytical procedure is appropriate is a matter of
professional judgement. A review of audit practice indicates that simple judgemental approaches (such as
comparison and ratio analysis) are used more frequently than complex statistical approaches (such as time
series modelling or regression analysis). These tests are generally carried out using computer software
(i.e. CAATs). Trend analysis, ratio analysis and reasonableness tests are discussed in this section.
Statistical and data mining analysis is discussed in the following section on CAATs.

 Trend Analytical
 Trend analysis is the analysis of changes in an account balance or ratio over time. Trend analysis
could compare last year's account balance to the current unaudited balance or balances in many
time periods. Trend analysis works best when the account or relationship is fairly predictable (e.g.
rent expense in a stable environment). It is less effective when the audited entity has experienced
significant operating or accounting changes. The number of years used in the trend analysis is a
function of the stability of operations. The more stable the operations over time, the more
predictable the relations and the more appropriate the use of multiple time periods. Trend analysis
at an aggregate level (e.g. on consolidated basis) is relatively imprecise because a material
misstatement is often small relative to the aggregate account balance. The most precise trend
analysis would be on disaggregated data (e.g. by segment, product or location, and monthly or
quarterly rather than on an annual basis).
 Ratio Analysis
Ratio analysis is the comparison of relationships between financial statement accounts, the
comparison of an account with non-financial data, or the comparison of relationships between
firms in an industry. Another example of ratio analysis (which is sometimes referred to as
common size analysis) is to set all the account balances as either a percentage of total assets or
revenue.
Ration analysis is most appropriate when the relationship between accounts is fairly predictable
and stable (e.g. the relationship between sales and accounts receivable). Ratio analysis can be
more effective than trend analysis because comparisons between the balance sheet and income
statement can often reveal unusual fluctuations that an analysis of the individual accounts would
not. Like trend analysis, ration analysis at an aggregate level is relatively imprecise because a
material misstatement is often small relative to the natural variations in the ratios.
Types of Ratio Analysis
There are five types of ratio analysis used in analytical procedures:
1. Ratios that compare client and industry data
2. Ratios that compare client data with similar prior period data
3. Ratios that compare client data with client-determined expected results
4. Ratios that compare client data with auditor-determined expected results
5. Ratios that compare client data with expected results using non-financial data

The Risk Management Association (RMA), Standard & Poors, Dun & Bradstreet, Ibis World and
others publish standard ratios by industry. Similar ratios for both industry and entity may be
compared to indicate differences that might affect the auditor’s judgement of the nature and
extent of audit procedures. The ratios indicate entity liquidity, solvency, profitability and activity.
 Reasonableness Testing
Reasonableness testing is the analysis of account balances or changes in account balances within
an accounting period in terms of their 'reasonableness' in light of expected relationships between
accounts. This involves the development of an expectation based on financial data, non-financial
data, or both. For example, using the number of employees hired and terminated, the timing of
pay changes, and the effect of vacation and sick days, the model could predict the change in
payroll expense from the previous year to the current balance within a fairly narrow dollar range.
In contrast to both trend and ratio analyses (which implicitly assume stable relationships),
reasonableness tests use information to develop an explicit prediction of the account balance. The
auditor develops assumptions for each of the key factors (e.g. industry and economic factors) to
estimate the account balance. Considering the number of units sold, the unit price by product line,
different pricing structures, and an understanding of industry trends during the period could
explicitly from a reasonableness test for sales. This is in contrast to an implicit trend expectation
for sales based on last year’s sales. The latter expectation is appropriate only if there were no
other factors affecting sales during the current year, which is not the usual situation.
 Trend Analysis, Ratio Analysis and Reasonableness Test Compared
Trend analysis, ratio analysis and reasonableness tests differ as to the number of independent
predictive variables considered, use of external data, and statistical precision. Trend analysis is
limited to a single predictor, that is, the prior periods' data for that account. Trend analysis, by
relying on a single predictor, does not allow the use of potentially relevant operating data, as do
the other types of procedures. Because ratio analysis employs two or more related financial or
non-financial sources of information, the result is a more precise expectation. Reasonableness
tests and regression analysis further improve the precision of the expectation by allowing
potentially as many variables (financial and non-financial) as are relevant for forming the
expectation. Reasonableness tests and regression analysis are able to use external data (e.g.
general economic and industry data) directly in forming the expectation. The most statistically
precise expectations are formed using statistical and data mining analysis.
 Standard Client and Industry Ratios
At the planning stage of an audit, there are certain customary ratios that are always calculated to
determine accounts that may represent significant risks to the entity of liquidity, solvency,
profitability and activity. These ratios help to answer some key questions:
 1. Is there a possible going concern problem (liquidity ratios)?
2. Is the entity's capital structure sustainable (solvency ratios)?
3. Is gross margin reasonable (profitability)?
4. Could inventory be overstated (activity)?
 Liquidity and Going Concern
Auditors must determine the possibility that the company is having liquidity problems that is, is
there a possibility that the company may no longer be a going concern? ISA 570 states that under
the going concern assumption, an entity is viewed as continuing in business for the foreseeable
future. General purpose financial statements are prepared on a going concern basis, unless
management either intends to liquidate the entity or to cease operations, or has no realistic
alternative but to do so. When the use of the going concern assumption is appropriate, assets and
liabilities are recorded on the basis that the entity will be able to realise its assets and discharge its
liabilities in the normal course of business.

8.6 Analytical Procedures During Different Phases in Audit Process

Analytical procedures are used: (a) to assist the auditor in planning the nature, timing and extent of audit
procedures; (b) as substantive procedures; and (c) as an overall review of the financial statements in the
final stage of the audit. The auditor is required to apply analytical procedures at overall review stages of
the audit.

 Planning
Analytical procedures performed in the planning stage are used to identify unusual changes in the
financial statements, or the absence of expected changes, and specific risks. During the planning
stage, analytical procedures are usually focused on account balances aggregated at the financial
statement level and relationships. Application of analytical procedures at the planning stage
indicates aspects of the business of which the auditor was unaware and will assist in determining
the nature, timing and extent of other audit procedures. Surveys of auditors show that the most
extensive use of analytical procedures has been in the planning and completion stages.
 Substantive Testing
During the substantive testing stage, analytical procedures are performed to obtain assurance that
financial statement account balances do not contain material misstatements. In substantive
testing, analytical procedures focus on underlying factors that affect those account balances
through the development of an expectation of how the recorded balance should look.
 Overall Review
 Analytical procedures performing during the overall review stage are designed to assist the
auditor in assessing that all significant fluctuations and other unusual items have been adequately
explained and that the overall financial statement presentation makes sense based on the audit
results and an understanding of the business.
According to ISA 520, “The auditor shall design and perform analytical procedures near the end
of the audit that assist the auditor when forming an overall conclusion as to whether the financial
statements are consistent with the auditor's understanding of the entity. Analytical procedures at
the review stage are intended to corroborate conclusions formed during the audit of individual
components of the financial statements. Moreover, they assist in determining the reasonableness
of the financial statements. They may also identify areas requiring further procedures.
 Test of Controls Over Information Used For Analytical
An important consideration in applying analytical procedures is tests of controls over the
preparation of information used for analytics. When those controls are effective, the auditor will
have more confidence in the reliability of the information and, therefore, in the results of
analytical procedures.
The controls over non-financial information can often be tested in conjunction with tests of
accounting-related controls. For example, a company’s controls over the processing of sales
invoices may include controls over the recording of unit sales; therefore, an auditor could test the
controls over the recording of unit sales in conjunction with tests of the controls over the
processing of sales invoices.

8.7 Analytical Procedures as Substantive Test

Substantive procedures in the audit are designed to reduce detection risk relating to specific financial
statement assertions. Substantive tests include tests of details (either of balances or of transactions) and
analytical procedures. Auditors use analytical procedures to identify situations that require increased use
of other procedures (i.e. tests of control. substantive audit procedures), but seldom to reduce audit effort.

 Analytical Procedures Instead of Test if Details

There are a number of advantages of performing substantive analytical procedures instead of tests
of details. One advantage is that the auditor may use his understanding of the client’s business
obtained during planning procedures. The key factors affecting business may be expected to
reflect underlying financial data. Substantive analytical procedures often enable auditors to focus
on a few key factors that affect the account balance. Substantive analytical procedures may be
more efficient in performing understatement tests.
 In planning an audit that uses analytical procedures as substantive procedures, the auditor should:
a) Determine the suitability of particular substantive analytical procedures for given
assertions, considering the assessed risks of material misstatement.
b) Evaluate the reliability of data from which the auditor's expectation is developed, taking
account of quality of controls, as well as the source, comparability and relevance of the
information.
c) Evaluate whether the expectation is sufficiently precise to identify a misstatement that
may cause the financial statements to be materially misstated.
d) Determine the amount of any difference of recorded amounts from expected values that is
acceptable without further investigation.

 Disadvantages of Analytical Procedures

Substantive analytical procedures have some disadvantages. They may be more time consuming
initially to design and might be less effective than performing tests of details of balances.
Obtaining data used to develop an expectation and ensuring the reliability of that data at a
disaggregated level can take a substantial amount of the time otherwise spent performing tests of
details. Analytical procedures may be less effective when applied to the financial statements as a
whole than when applied to financial information on individual sections of an operation or to
financial statements of components of a the company.
 Corroboration
To corroborate an explanation, one or more of the following techniques may be used:
a) inquiries of persons outside the client's organisation including bankers, suppliers,
customers, etc.;
b) inquiries of independent persons inside the client's organisation (e.g. an explanation
received from the Chief Financial Officer for an increase in advertising expenditures
might be corroborated with the marketing director: it is normally inappropriate to
corroborate explanations only by discussion with other accounting department
personnel);
c) evidence obtained from other auditing procedures;
d) examination of supporting evidence. The auditor may examine supporting documentary
evidence of transactions to corroborate explanations. For example, if an increase in cost
of sales in one month was attributed to an unusually large sales contract, the auditor
might examine supporting documentation, such as the sales contract and delivery
dockets.
  Substantive Analytical Procedures Examples
Fraudulent payments are often in large amounts. An analytical procedure to detect this is the use
of a CAATs program (discussed in the next section) to stratify the payments by size and then
extract all large payments. The auditor may sort the records by type of purchase, since the size of
an expenditure is related to the typical cost of the product or service.
By analyzing revenue over at least three years, the auditor can detect unexpected trends in
revenues. Sales can also be analysed by type, activity, salesperson, month, or customer. The sales
data can be stratified to determine if sales in a certain area or by a certain salesperson are made up
of a few large or unusual transactions.
 Payroll
If the auditor suspects fraud in the payroll area, he may do a number of substantive tests to detect
a 'ghost employee', an employee who still 'works for the company’ even though his employment
has been terminated, or excessive overtime charges. Three types of analytical tests can be
performed to help detect these kinds of irregularities: duplicate and validity tests, exception
testing and recalculations.
Duplicate and validity tests are used to detect a ghost or a terminated employee. A CAATs
program can help the auditor check for duplicate social security numbers, names, or, if direct
deposit is used, bank account numbers. To find ghost employees, an auditor can also identify
employees who take no sick or annual leave, or those who do not have insurance or other
deductions taken out of their pay. Additionally, a CAATs program can be verify that each
employee’s salary or wage is within the ranges for his job description and that tax withholding
amounts are reasonable.

8.8 Computer Assisted Audit Techniques (CAATs) and Generalised Audit Software (GAS)

The use of computer assisted audit techniques (CAATs) may enable more extensive testing of electronic
transactions and account files. CAATs can be used to select sample transactions from key electronic files,
to sort transactions with specific characteristics, or to test an entire population instead of a sample.
CAATs generally include regression and statistical analysis as well as the more widely used the file
interrogation techniques using generalized audit software (GAS) such as data manipulation, calculation,
data selection, data analysis, identification of exceptions and unusual transactions.

 Regression Analysis
 Complicated analytical procedures may use regression analysis. Regression analysis is the use of
statistical models to quantify the auditor's expectation in financial (euro, dollar) terms, with
measurable risk and precision levels. For example, an expectation for sales may be developed
based on management's sales forecast, commission expense, and changes in advertising
expenditures. Regression analysis provides a very high level of precision because an explicit
expectation is formed in which the relevant data can be incorporated in a model to predict current
year sales.
Regression analysis potentially can take into account all of the relevant operating data (sales
volume by product), changes in operations (changes in advertising levels, changes in product
lines or product mix), and changes in economic conditions. Regression analysis provides the
benefits of statistical precision. The statistical model provides not only a ‘best’ expectation given
the data at hand, but also provides quantitative measures of the ‘fit’ of the model.
 Generalised Audit Software (GAS)
Generalised audit software (GAS) packages contain numerous computer-assisted audit techniques
for both doing analytical procedures and statistical sampling bundled into one piece of software.
There are widely used GAS packages such as ACL and IDEA, and the Big Four audit firms have
their own software such as Deloitte and Touche’s STAR and MINI MAX. GAS packages provide
the auditors with the ability to access, manipulate, manage, analyse, and report data in a variety of
formats. This software allows the auditor to move from analytical procedures to statistical
sampling for analytical procedures fairly easily.
 Audit Tasks
In general terms, file interrogation can accomplish the following six types of audit task:
a) convert client data into common format:
b) analyse data;
c) compare different sets of data;
d) confirm the accuracy of calculations and make computations;
e) sample statistically;
f) test for gaps or duplicates in a sequence.

Convert Client Data into a Common Format

The auditor can use GAS (e.g. ACL)) to convert client data into a common format (e.g. files
ending in the extension*.fil) that can be manipulated by the software. Audit work is more
efficient since data does not have to be manually entered and the conversion is usually performed
 with 100 per cent accuracy. The data can then be used by the GAS or exported as several formats
such as plain text, comma delimited, XML, Microsoft Word, Excel or Access.

Analyse Data

GAS can handle large volumes of data quickly. Often, file interrogation can be used to analyse an
entire population in less time than it would take to test a sample of items manually. The auditor
can identify all records in a data file that meet specified criteria or reformat and aggregate data in
a variety of ways.

Audit Test that can be performed with GAS include the following:

a) Identify all inventory items relating to products no longer sold.

b) Select all inventory items with no recorded location.
c) Summarise inventory items by location to facilitate physical observation.
d) Review account receivable balances for amounts over credit limits or older than a
specified period.
e) Summarise accounts receivable by age for comparison to the client’s schedules.
f) Review inventory quantities and unit costs for negative or unusually large amounts
g) Isolate all inventory items that have not moved since a specified date
h) Review assets for negative net book values
i) Summarise inventory by age to assess the reasonableness of obsolescence provisions.

Compare Different Sets of Data

If records on separate files contain comparable data, GAS can be used to compare the different
sets of data. For example, the auditor could compare the following:

a) changes in accounts receivable balances between two dates with the details of sales and
cash receipts on transaction files;
b) payroll details with personnel records;
c) current inventory files with prior period files to identify potentially obsolete or
slowmoving items;
d) portfolio positions recorded in the accounting records of an investment company with the
records maintained by the custodian.

8.9 Analytical Procedures Using Data Mining Techniques

Data mining is a set of computer-assisted techniques that use sophisticated statistical analysis, including
artificial intelligence techniques, to examine large volumes of data with the objective of indicating hidden
or unexpected information of patterns. In database terms, data mining is referred to as knowledge
discovery in databases (KDD). Data mining can be used in all types of databases or other information
repositories. Data to be mined can be numerical data, textual data or even graphics and audio.

Used most extensively in customer relationship management (CRM) and fraud detection, data mining is
for both verification and discovery objectives. Data mining is used in a top-down approach to verify
auditors’ expectations or explain events or conditions observed.

 GAS and Data Mining

GAS's capability to assist in the overall audit process while requiring little technical skill is a
major reason for its success. However, GAS has been criticised because it makes some tasks
easier but it cannot complete any data analysis by itself. Data mining, on the other hand, analyses
data automatically but is more difficult to employ.
Data mining may use many methods and techniques and algorithms to analyse client data. Data
mining methods include data description, dependency analysis, classification and prediction,
cluster analysis, outlier analysis and evolution analysis.
The purpose of dependency analysis is to search for the most significant relationship across large
number of variables or attributes. Classification is the process of finding models, also known as
classifiers, or functions that map records into one of several discrete prescribed classes.
The objective of data description is to provide an overall description of data, either in itself or in
each class or concept. There are two main approaches in obtaining data description – data
characterization and data discrimination.
The objective of evolution analysis is to determine the most significant changes in data sets over
time.
The objective of cluster analysis is to separate data with similar characteristics from the dissimilar
ones. Outliers are data items that are distinctly dissimilar to others and can be viewed as noises or
errors.

 Algorithms - Decision Tree, Apriori, Neural Network

Data Mining most frequently used three algorithms.
a) A decision tree is a predictive model that classifies data with a hierarchical structure. It
consists of nodes, which contain classification questions, and branches that are the result
 of the questions. (For example the question, 'Does this item increase at the same rate as
revenue?' may be answered yes which leads to one branch 'growth similar to revenue' or
may be answered no - which leads to another branch.)
b) The apriori algorithm attempts to discover frequent item sets using rules to find
associations between the presence or absence of items (Boolean association rules). The
group of item sets that most: come together is identified.
c) A neural network is a computer model based on the architecture of the brain. It first
detects a pattern from data sets then predicts the best classifiers of that pattern, and finally
learns from the mistakes.

8.10 Follow Up in Case of Unexpected Deviations

When analytical procedures identify significant fluctuations or relationships that are inconsistent with
other relevant information or that deviate from predicted amounts, the auditor should investigate and
obtain adequate explanations and appropriate corroborative evidence. A comparison of actual results with
expected should include a consideration of why there is a difference.

There are primarily two reasons for a significant fluctuation or inconsistency. One is that there is genuine
business reason that was not obvious during planning procedures. The second reason is that there is a
misstatement. Work must be done to determine which reason.

 Investigation
The investigation of unusual fluctuations and relationships ordinarily begins with inquiries of
management, followed by corroboration of management responses and determination if
additional audit procedures are needed. Management's responses may be corroborated by
comparing them with the auditor's knowledge of the business and other evidence obtained during
the course of the audit.
If a reasonable explanation cannot be obtained, the auditor aggregates misstatements that the
entity has not corrected. The auditor would then consider whether, in relation to individual
amounts, subtotals, or totals in the financial statements, they materially misstate the financial
statements taken as a whole. If management cannot provide a satisfactory explanation and there is
possibility of material misstatement, other audit procedures should be determine.
Upon finding unexpected deviations that exceed the threshold, there may be a need to do some
root cause analysis. In that root cause analyses, a reassessment of the effectiveness of controls
may be necessary. If the auditor detects deviations from controls upon which he intends to rely,
he must make specific inquiries to understand these matters and their potential consequences.
Furthermore, he must determine whether;
a) the tests of controls show an appropriate basis for reliance on the controls:
b) additional tests of controls are necessary; or
c) the potential risks of misstatement need to be addressed using substantive procedures.