The Auditor’s Sampling Decision in The Presence of Redundant Internal Controls

Abstract

Redundant internal controls are commonplace and auditors must decide how best to test them. Professional literature provides four approaches. The first tests only one control at low risk of overreliance. The second transaction-links redundant controls with a deviation defined as lapse of both and tests at low risk of overreliance. The third tests one control at low risk of overreliance and tests the other at higher risk. The fourth tests both controls at moderate risk of overreliance. This paper applies utility theory to the auditor’s decision regarding the third and fourth approaches and considers implications for the other two approaches