| Course | AC503 Advanced Auditing |
|---|---|
| Unit | Unit 4 |
| Paper type | Control testing workpaper |
| Length | About 600 words, 5 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | MS in Accounting |
| Updated | October 2026 |
Free sample paper for AC503 Unit 4
Four Changes the Log Never Saw: A Unit 4 Control Testing Workpaper on Rate-Change Approval
[Student Name]
Purdue University Global
AC503: Advanced Auditing
Unit 4 Control Testing Workpaper
[Instructor Name]
[Date]
Polar Ridge Cold Logistics, its staff and every figure are composite; the standards and textbook cited are real.
Header
Client: Polar Ridge Cold Logistics. Year end: December 31, 2026. Index: C-4. Objective: to determine whether the rate-change approval control operated effectively throughout the year. Prepared by: audit staff. Reviewed by: left blank for the senior.
Page 1: The Control
The client's procedure manual states: "No change to a customer rate in the warehouse management system may be activated until the pricing manager has approved it in the change log and attached the signed contract amendment." The control addresses the risk that customers are billed at rates they never agreed to, which affects the accuracy and occurrence of storage revenue. Three attributes are tested for each change: approval by the pricing manager, approval dated on or before activation, and agreement of the new rate to a signed amendment.
Page 2: Testing the Population First
A sample drawn from the change log can only tell us about changes that reached the log. Before sampling, we obtained month-end copies of the rate master file for all twelve months and compared each month to the next by script, listing every rate that changed. The script found 218 changes. The log holds 214. The four missing changes were all made on November 3 under the system administrator account, not the pricing user, and raised rates for four customers by between 6 and 9 percent. None had a contract amendment. The IT manager confirmed that the administrator account can edit rates directly without going through the change log.
A control tested only on the items it recorded can look effective while the changes that bypassed it never appear, which is why the population was tested against an independent source before a single sample item was chosen.
Page 3: The Sample
We selected 25 of the 214 logged changes at random, a size consistent with a control operating many times a year and a low tolerable deviation rate (Arens et al., 2020). Twenty-four met all three attributes. One change, in July, was approved by the pricing manager three days after activation; the rate agreed to a signed amendment, and the customer was billed correctly. That deviation is a timing failure with no misbilling.
Page 4: Conclusion
The control did not operate effectively. The sample alone showed one deviation in 25, which at our tolerable rate might have supported partial reliance. The four bypassed changes are a different kind of failure: they show that the control can be avoided entirely by anyone using the administrator account. The control cannot be relied on to reduce substantive testing of storage revenue, so the analytical procedures in Unit 7 will be performed at the lower threshold set for a combined high risk, and the four customers' billings will be recomputed. The deficiency will be evaluated for severity and reported in writing to the controller and to the owner's board representatives (American Institute of Certified Public Accountants [AICPA], 2012).
Matters for the Senior
The administrator account's access should be reviewed under IT general controls, and the November 3 changes should be discussed with the controller to find out who used the account and why. The client should also be asked whether any other system tables can be changed the same way, because the answer affects other controls the file relies on (AICPA, 2021).
References
American Institute of Certified Public Accountants. (2012). Communicating internal control related matters identified in an audit (AU-C Section 265). AICPA.
American Institute of Certified Public Accountants. (2021). Understanding the entity and its environment and assessing the risks of material misstatement (Statement on Auditing Standards No. 145). AICPA.
Arens, A. A., Elder, R. J., Beasley, M. S., & Hogan, C. E. (2020). Auditing and assurance services (17th ed.). Pearson.
The Purdue Global AC503 Unit 4 instructions
Unit 4 of AC503 asks you to prepare a workpaper testing a control's operating effectiveness. Use a standard header with client, period, index, objective, preparer and reviewer. Quote the control as the client documents it, name the risk it addresses and list the attributes you will test. Before sampling, test the completeness of the population against an independent source, because a sample drawn from an incomplete listing says nothing about what is missing. Select a sample sized for how often the control operates and how much reliance is planned, test each attribute and record deviations with their nature. Conclude on reliance and state the effect on substantive work. Note matters for the reviewer, including follow-up on any bypass. Back the workpaper with the two standards it applies and the assigned text, formatted in APA 7.
How the AC 503 Unit 4 example is put together
The sample's header indexes the workpaper C-4 and leaves the reviewer block blank. Page one quotes the procedure manual and lists three attributes: approval by the pricing manager, approval before activation and agreement to a signed amendment. Page two compares twelve monthly copies of the rate master file by script and finds four November 3 changes made through the administrator account. The highlighted sentence explains why completeness comes first. Page three tests 25 of 214 logged changes and finds one approval three days late with correct billing. Page four concludes the control cannot be relied on, lowers the analytics threshold and recomputes four customers' billings. Matters for the senior cover administrator access and other tables.
Where the points sit in the AC503 Unit 4 rubric
Control testing workpapers in AC503 are graded on documentation quality and sound reasoning about reliance. Points go to a precise statement of the control and its attributes and to a completeness test of the population before sampling. Graders reward students who distinguish a sample deviation from a bypass of the control, since the second is a different and usually more serious failure. Sample size should be justified by frequency and planned reliance. The conclusion must state clearly whether the control can be relied on and how substantive work changes. Workpapers that sample from an untested log, or that conclude effectiveness despite a bypass, are marked down. Cite the standards the workpaper applies in APA 7.
AC503 Unit 4 help: mistakes that cost points
The most common Unit 4 error is sampling from the client's log without testing whether the log is complete. Students then report a low deviation rate and conclude the control works. Bypasses through privileged accounts are treated as sample deviations rather than as evidence the control can be avoided. Attributes are vague, such as testing that changes were reviewed without saying by whom or when. The conclusion stops at effective or not effective and never states the effect on substantive procedures. Follow-up questions for the senior are missing. If your section assigned a different control or a practice data set, our writers can document the test with your attributes and population.
Get an AC503 Unit 4 example written to your instructions
Share the control your Unit 4 prompt describes, the population data and any testing template your section uses, plus the rubric. Completeness is tested first, then attributes item by item, and every exception is evaluated for cause, in a workpaper returned within 24-48h. The first custom sample is free, with reviewer lines left open. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More AC503 papers and MS in Accounting samples
- AC503 Unit 1: Industry Audit Risk Discussion
- AC503 Unit 2: Audit Engagement Planning Memo
- AC503 Unit 3: Risk Assessment Worksheet
- AC503 Unit 5: Sampling Plan
- AC503 Unit 6: Substantive Procedures Set
- AC503 Unit 7: Analytical Procedures Exercise
- AC503 Unit 8: Seminar Reflection
- AC503 Unit 9: Going Concern Evaluation
- AC503 Unit 10: Audit Report Analysis
- AC502 Unit 4: Agency and Respondeat Superior Problem
- AC501 Unit 4: GAAP Research Memo
AC503 Unit 4 questions, answered
Why test the change log before sampling from it?
Because a sample can only represent the population it was drawn from. If the log omits changes, a clean sample says nothing about the omitted ones. Information produced by the client and used in a control test needs its own evidence of completeness and accuracy, and the AC503 example obtains it by comparing independent copies of the rate file against the log.
Are the four unlogged changes deviations?
Not in the sampling sense. They show the control could be bypassed entirely through an administrator account, which is a failure of access controls and possibly management override, not an instance of the pricing manager forgetting to approve. The example evaluates them separately from the sample, and that separation carries much of the workpaper's grade.
How large should a sample be for a control like this?
Firms publish their own guidance, typically scaling sample size to how often a control operates and how much reliance is planned. A control performed a few hundred times a year often draws around twenty-five items. The example cites a firm table as its basis, states the planned reliance, and notes that your section may set a different figure.
Where can I find a free AC503 Unit 4 sample paper?
This page holds a full AC503 Unit 4 control testing workpaper on rate-change approval at Polar Ridge Cold Logistics with a completeness test, a 25-item sample, a reliance conclusion and APA 7 references.
How were the four missing changes found?
By comparing month-end copies of the rate master file with a script, which listed every rate that changed during the year. The script found 218 changes while the log held 214, and the four extras were made under the administrator account.