Internal control, systems documentation and control testing
Internal control
Internal control comprises the control environment, risk assessment, control activities, information and communication, and monitoring. Auditors need to understand internal control to identify risks and plan procedures.
Systems documentation
Auditors document systems using narratives, flowcharts, and questionnaires. They walk through transactions to confirm understanding. Documentation must be sufficient to enable engagement team to understand the system.
Control testing
Tests of controls determine if controls operate effectively. If controls are effective, auditor may reduce substantive testing. If not, substantive procedures are increased. Controls can be preventive or detective.
Traps in questions
- Confusing test of control with substantive test.
- Assuming auditor must test all controls.
- Forgetting that understanding internal control is required, but testing is optional.
- Overlooking that documentation can be in various forms.
- Mixing up preventive and detective controls.
Worked example / rule of thumb
If a control (e.g., credit check) is tested and found effective, the auditor may reduce substantive testing of receivables. Rule: test of controls = test the operating effectiveness; substantive test = test the numbers. If control is not tested, assume no reliance.
Key points
- Internal control has five components.
- Documentation methods: narrative, flowchart, questionnaire.
- Walkthrough confirms understanding.
- Tests of controls assess operating effectiveness.
- Reliance on controls can reduce substantive testing.