a. The types of control activities are:

1. Performance Reviews: These activities include reviewing and analyzing actual performance versus budgets and prior periods, analyzing data relationships, and comparing internal data with external information.
   • Example: In a purchases and payables system, performance reviews involve ensuring that orders placed are within budget limits, with regular comparisons of actual purchases to budgeted amounts and investigating variances.
2. Information Processing – Application Controls: These controls focus on individual applications, such as revenue, purchases, and payroll, ensuring transactions occur as authorized and are accurately recorded.
   • Example: Verifying supplier invoices to ensure the correct amount is payable. Requisitioning should be done by authorized officers using specified forms, with acknowledgment of received services.
3. Information Processing – General IT Controls: These cover policies and procedures for IT applications, supporting effective application control operations.
   • Example: Restricting access to programs and data to prevent unauthorized supplier file changes that could lead to fraudulent payments.
4. Physical Controls: Concerned with securing assets and records to prevent unauthorized use or damage.
   • Example: Goods received should be inspected, matched to orders, and recorded on pre-numbered Goods Received Notes.
5. Segregation of Duties: Ensures that different individuals authorize transactions, record them, and maintain custody of assets to reduce fraud risk.
   • Example: Payables ledger entries should be handled by personnel separate from those responsible for ordering, receiving goods, and managing the invoice register.

b. The auditor relies on effective internal controls for recording transactions. However, internal control systems have inherent limitations and are not infallible due to human error, poor judgment, collusion, or management override. As a result, substantive procedures are necessary to test the balances and transactions in financial statements beyond control tests to account for these limitations.