A clerk enters her own vendor record, generates a PO, signs the receiving report, and approves the invoice for payment. Eighteen months later the company discovers $240,000 paid to a vendor that exists only on paper. The II.C3 job is to look at every business process and ask: where could a transaction go wrong, and what stops it?
AU-C 315 requires the auditor to understand the entity's business processes that produce classes of transactions, account balances, and disclosures. In practice, every audit maps to the same six cycles.
- Revenue cycle: order, credit approval, shipping, billing, cash receipt. Highest-risk assertions: occurrence, cutoff, valuation.
- Purchases and payables cycle: requisition, PO, receiving, vendor invoice, voucher, disbursement. Highest-risk assertions: completeness and existence.
- Payroll cycle: hiring, time recording, gross-to-net, disbursement, tax filing. Highest-risk assertions: occurrence (do these employees exist?) and accuracy.
- Inventory cycle: production, materials issuance, conversion, finished goods, costing. Highest-risk assertions: existence, valuation, rights (consigned vs owned).
- Financing cycle: debt and equity issuance, interest, covenants, dividends. Highest-risk assertions: completeness and presentation.
Common mistakes
- Treating a walkthrough as a test of operating effectiveness. A walkthrough confirms design and implementation by tracing one transaction. Operating effectiveness requires a sample across the period. The exam often describes a walkthrough with no exceptions and asks whether the auditor can rely on the control. The answer is no.
- Calling a bank reconciliation a preventive control. A bank reconciliation is detective. Preventive controls would be approval requirements before a check is written, dual signatures, or system-enforced disbursement limits.
- Missing the ARC violation when the title is not the obvious culprit. The exam may bury the violation in a CFO's role or a "trusted long-term employee." The test is functional, not titular: which functions does the person perform?
Bottom line
- Six core cycles drive every audit: revenue, purchases/payables, payroll, inventory, financing, investing. Each carries predictable risks tied to specific assertions.
- Document understanding three ways: flowcharts (visual), narratives (written), walkthroughs (trace one transaction). A walkthrough is required for every significant process and confirms design and implementation, not operating effectiveness.
- Controls classify by timing: preventive (stop errors before they happen), detective (catch errors after), corrective (fix once detected). A healthy environment relies primarily on preventive controls.
- Segregation of duties follows ARC: Authorization, Recordkeeping, Custody. No one person should hold two of three for the same asset class.
Exam shortcut
When the exam describes a transaction, identify the cycle first. The cycle tells you which assertions are most at risk. Revenue → occurrence and cutoff. Purchases → completeness and existence. Payroll → occurrence and accuracy. Inventory → existence and valuation. For segregation-of-duties questions, use ARC. Walk through who does what, label each function as Authorization, Recordkeeping, or Custody, and look for one person holding two.
The full lesson (about 5,304 words, 35 min read) adds 8 worked examples, all 7 common mistakes, a self-check, free in the app.
Learning objectives
- II.C3
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.