Internal Control and Control Testing
Understanding internal control
Internal control comprises the control environment, the entity's risk assessment process, the information system, control activities, and monitoring. Candidates must understand the five components and how they interact. Know the difference between preventive and detective controls, and between manual and automated controls.
Testing controls
When the auditor plans to rely on controls, they must test operating effectiveness. Tests include inquiry, observation, inspection, and reperformance. Inquiry alone is never sufficient. The auditor must consider the period of reliance, the consistency of application, by whom, and how. If controls are not operating effectively, the auditor must revise the assessment of risk and increase substantive testing.
Traps in questions
Common distractors suggest inquiry alone is adequate evidence of control effectiveness, or that a walkthrough tests operating effectiveness. A walkthrough confirms understanding, not effectiveness across the period. Another trap is confusing the auditor's tests of controls with management's monitoring activities.
Rule of thumb
If the auditor intends to rely on a control, it must be tested. If reliance is reduced or removed, substantive procedures must increase to compensate. The total evidence needed stays broadly constant; it shifts between control and substantive testing.
Worked example
An automated three-way match control is tested once and found to operate as designed. Because it is automated and not subject to human override in normal operation, the auditor may test it at a single point in time, provided general IT controls over program changes are effective.