I started my career with the UK firm of what was then Cooper Brothers (it later became Coopers & Lybrand before morphing into PwC). Coopers practiced controls auditing, as did all the major external audit firms at that time. They believed in identifying and then assessing the design and operation of management’s controls over risks (in their case, to the filed financial statements) rather than relying only on what we called ‘bashing the balance sheet’. In other words, rather than a lot of testing of transactions (their validity, accounting treatment, and so on) they preferred to rely on the system of internal controls with limited testing of transactions.
When you have confidence in the system of internal control(s), you have assurance that the transactions they manage will be handled appropriately. (Caveat: as COSO reminds us in their internal control framework, there are limitations to the effectiveness of internal control, such as collusion and the fact that humans make occasional innocent mistakes.)
When you test the transactions directly, you need confidence that your sample is sufficiently representative of the total population. Not only that, but you need to spread your test over the period of the population you want assurance on.
After I passed the exams for the Chartered Accountant…
