When the auditor believes the design of controls of a non-public company is effective but does not test the controls,the auditor can assess control risk as moderate in some circumstances but otherwise it should be assessed as high.

Question

Quizplus · Accepted Answer

If the auditor does not test the controls, they cannot rely on them to reduce substantive testing, so control risk is typically assessed as high unless there is a specific reason to assess it as moderate.

When the Auditor Believes the Design of Controls of a Non-Public