I would say the use of auditor judgment or instinct is not only acceptable, but also required. The text explains this best: "GAAS and the SASs should be looked on by practitioners as minimum standards of performance rather than as maximum standards or ideals. Any professional auditor who seeks means of reducing the scope of the audit by relying only on the standards, rather than evaluating the substance of the situation, fails to satisfy the spirit of the standards. At the same time, the existence of auditing standards does not mean the auditor must always follow them blindly. If an auditor believes that the requirement of a standard is impractical or impossible to perform, the auditor is justified in following an alternative course of action. Similarly, if the issue in question is immaterial in amount, it is also unnecessary to follow the standard. However, the burden of justifying departures from the standards falls on the auditor. (Arens et al., 2006, p. 36)"
Reference: Arens, A. A., Elder, R. J., & Beasley, M. S. (2006). Auditing and assurance services: An integrated approach (11th ed.). New York, NY: Pearsons.
This is correct. If the account that the auditor is auditing is based on an ineffective control environment, due to multiple people having access to the account, or another lack of controls, the auditor needs to follow the minimum standards as well as go outside the scope of the minimum standards. The auditor has a duty of care to perform testing and procedures on the account as deemed appropriate, based on the client's internal control environment, and based on ...
The solution discusses if the statement that says the "use of auditor judgment or instinct is not only acceptable, but also required" is correct.