What is design and implementation assessment in audit?
A design and implementation assessment considers whether a control is capable of addressing the relevant risk and whether the control has actually been put into use.
Design asks whether the control, individually or together with other controls, could prevent or detect and correct a material misstatement. Implementation asks whether the control exists in practice, rather than only in a policy or process description. Enquiry alone is generally not enough to establish implementation; auditors normally use inspection, observation or other procedures alongside the discussion.
This is different from testing operating effectiveness. A control can be suitably designed and implemented but still fail to operate consistently throughout the period. Operating-effectiveness testing addresses that separate question where the audit plans to rely on the control.
AI can prepare the assessment by identifying the control objective, relevant evidence and potential gaps. The auditor should review whether the evidence supports both parts of the conclusion and whether the control is precise enough for the risk it is intended to address.
Platformed capability: Platformed separates design from implementation, links each assessment to evidence and records the auditor's review. It can prepare the work, but it cannot turn enquiry alone into evidence of implementation or decide that a control is relevant for the auditor.
References: ISA 315 risk assessment resources · Platformed control assurance