Discussant's response to "Assessing control risk: Effects of procedural differences on auditor consensus";

              Discussant's Response to
"Assessing Control Risk: Effects of Procedural
Differences on Auditor Consensus"
Richard W. Kreutzfeldt
Arthur Andersen
Statement on Auditing Standards No. 55 (SAS 55), "Consideration of the Internal Control Structure in a Financial Statement Audit," is one of the "Ex-pectations Gap" standards issued in 1988 that were intended to improve the effectiveness of audits. SAS 55 broadens the concept of internal controls, ex-pands the auditor's responsibilities with respect to internal controls, and re-vises and attempts to clarify a number of long-standing concepts. With such ambitious objectives, it is not surprising that questions are being raised about the meaning of the new standard, how to apply it in practice, and whether the new concepts themselves are sound. Morton and Felix [1989] express the concern in an earlier paper, "it appears that possibly confusing concepts are being replaced with concepts which we believe may be even more con-fusing, contradictory and ill-defined."
I too have concerns about SAS 55. But I also believe that SAS 55 adds a number of fundamental enhancements to the auditing literature. What is needed now, in my view, is not a massive overhaul of SAS 55 but a continu-ing dialogue among practitioners, academicians and standard-setters aimed at improving the understanding and application of SAS 55 and leading ulti-mately to revisions or interpretations of the standard where necessary. This paper by Morton and Felix makes a significant contribution to this continu-ing dialogue.
SAS 55: An "Evidence-Based" Approach?
The focal point of this paper is the procedure to be followed in making control risk assessments. SAS 55 provides the following guidance:
29. Assessing control risk is the process of evaluating the effec-tiveness of an entity's internal control structure policies and procedures in preventing or detecting material misstatements in the financial statements. Control risk should be assessed in terms of financial state-ment assertions. After obtaining the understanding of the internal control structure, the auditor may assess control risk at the maximum level for some or all assertions because he believes policies and pro-cedures are unlikely to pertain to an assertion, are unlikely to be ef-fective, or because evaluating their effectiveness would be inefficient.
30. Assessing control risk at below the maximum level involves-
132