When control risk is assessed at the maximum, which statement about documentation of the reason is true?

When control risk is assessed at the maximum, which statement about documentation of the reason is true?

• A. If the auditor assesses the level of control risk at the maximum, no documentation of the reason is necessary.
• B. If the auditor assesses the level control risk at less than maximum, no documentation of the reason is necessary
• C. If the auditor assesses the level of control risk at the maximum, documentation of the reason is necessary
• D. All of the given choices

Answer: (A)

Focusing on how auditors handle documentation when control risk is assessed at its maximum, the key idea is that you are not relying on the client's internal controls at all. That stance drives the audit plan toward pure substantive procedures to obtain adequate evidence, rather than testing and documenting operating effectiveness of controls. Because the decision to not rely on controls is inherently reflected in the audit approach, there isn’t a separate requirement to document a rationale for assigning the maximum level of control risk. The justification for not testing controls is effectively embedded in choosing a substantive, control-independent strategy. If control risk were assessed as less than maximum, you would typically document the basis for that assessment, since it supports a plan that includes tests of controls and a reduced level of substantive procedures. The option suggesting documentation is unnecessary in that scenario would be incorrect. The option implying that documentation is required when control risk is maximum also contradicts this approach, and saying all statements are true is not accurate.

Focusing on how auditors handle documentation when control risk is assessed at its maximum, the key idea is that you are not relying on the client's internal controls at all. That stance drives the audit plan toward pure substantive procedures to obtain adequate evidence, rather than testing and documenting operating effectiveness of controls. Because the decision to not rely on controls is inherently reflected in the audit approach, there isn’t a separate requirement to document a rationale for assigning the maximum level of control risk. The justification for not testing controls is effectively embedded in choosing a substantive, control-independent strategy.

If control risk were assessed as less than maximum, you would typically document the basis for that assessment, since it supports a plan that includes tests of controls and a reduced level of substantive procedures. The option suggesting documentation is unnecessary in that scenario would be incorrect. The option implying that documentation is required when control risk is maximum also contradicts this approach, and saying all statements are true is not accurate.