Nature, Timing and Extent: The Three Levers of Audit Response

A larger sample can still leave the important question unanswered. If the procedure examines the wrong evidence or covers the wrong period, doing more of it may add volume without adding assurance.

Nature, timing and extent offer a practical way to make an audit response deliberate. The question is how to combine them around the risk being examined.

Start with the event that could go wrong

Consider an original fictional spare-parts distributor approaching year-end. A new interface sends warehouse dispatch events into the invoicing system. Some orders are prepared before the reporting boundary but collected by the carrier afterwards. Managers are concerned that the accounting record may use the interface timestamp without checking the relevant transaction facts.

The internal audit objective is to evaluate whether the cut-off process identifies and resolves timing differences appropriately. The example is illustrative; it does not establish a recognition rule for every contract or accounting framework.

Before choosing a sample, define the possible failure: the event used for recording may differ from the event that supports the appropriate reporting period. Map the relevant contract terms, physical movement, system processing and accounting treatment.

Nature: choose work that can answer the question

Nature concerns the purpose and method of the work. Asking a supervisor to describe the interface helps explain the process. It does not, by itself, demonstrate that exceptions were detected and resolved.

To evaluate the control, inspect how the cut-off reconciliation was performed: its inputs, who reviewed differences, when they reviewed them and what happened next. To examine the transactions directly, compare selected accounting entries with dispatch records, carrier evidence and relevant contract terms.

Select reconciliation occurrences for control testing separately from the transactions used for direct testing. A shared document can serve both purposes only when each purpose is evaluated explicitly. These procedures answer different questions. A review sign-off is evidence about a control activity; supporting transaction records help evaluate the resulting accounting. One cannot automatically replace the other.

In the fictional case, the useful change is to move beyond invoice-only checking. The response connects system events to corroborating operational support whose source and reliability have been assessed and the applicable accounting rationale.

Timing: match evidence to the vulnerable period

Timing has two dimensions: when the auditor performs the work and the period the evidence concerns. A procedure performed in January can examine December activity; a November walkthrough cannot establish how a changed interface operated at year-end.

Here, inspect transactions on both sides of the reporting boundary and consider the interface change date. Cover relevant operation before and after the change rather than assuming one year-end inspection represents both. Preserve relevant logs before retention rules overwrite them. If earlier testing is used, determine what additional work is needed to cover the intervening period and any process changes.

The window should reflect how transactions actually move through the business. A standard number of days is not automatically suitable for a distributor with delayed carrier collection or batch processing.

Extent: decide coverage after relevance

Extent concerns how much work is performed. It includes transaction coverage, observations and the distribution of testing across relevant periods or locations.

The fictional team identifies interface exceptions and transactions with conflicting dates for targeted examination. It separately decides how to examine the remaining population. Targeted cases may reveal specific problems, but their exception rate cannot simply be projected to all transactions as if the selection were representative.

No universal sample percentage follows from a risk label. Document the population, selection method, coverage rationale and what the results can support. If the source extract omits failed interface records, examining every row in that extract still leaves a completeness gap.

Make the three decisions work together

A defensible response might combine reconciliation testing, direct examination around the reporting boundary and coverage of the changed interface period. If testing reveals unexplained differences, revisit the assessed risk and adjust the work rather than merely increasing the original sample.

Try writing one sentence before testing: “Because this event could produce this error, we will perform this work over this period, using this coverage, to support this conclusion.” If the link is unclear, the audit response needs more design.

The three terms are discussed in ISA 330 for financial statement audits. This case uses them as an original planning exercise; internal audit follows its own engagement objectives and methodology. The relevant professional framework and local requirements must be considered for the actual engagement.