Internal Control, Internal Check, Internal Audit and Audit Evidence
What the domain tests
This section tests internal control systems, the division of duties in internal check, the role of internal audit, and the quality and sources of audit evidence.
Core rules
- Internal control comprises policies and procedures to safeguard assets, ensure reliable records, promote efficiency and encourage compliance.
- Internal check divides duties so that one person's work is automatically checked by another.
- Internal audit is an independent appraisal function reporting to management or the audit committee.
- Limitations include collusion, management override, cost-benefit constraints and human error.
- Audit evidence must be sufficient and appropriate. Procedures include inspection, observation, inquiry, confirmation, recalculation, re-performance and analytical procedures.
- Written evidence is generally better than oral evidence, and external evidence is often better than internal evidence, but reliability depends on source and controls.
Worked example
For cash sales, a counter assistant issues a cash memo, a cashier receives cash, a separate storekeeper releases goods, and an accounts clerk records the sale. Cash is banked intact and a supervisor compares cash memos with deposit slips. This is internal check. The internal auditor later tests a sample of memos against deposit slips and reports exceptions. That test produces audit evidence, but internal check does not reduce the auditor's responsibility to obtain sufficient appropriate evidence.
Traps
Do not treat internal control as absolute assurance; do not confuse internal check with internal audit; do not rely only on oral evidence; and do not ignore that evidence from a poorly controlled source is less reliable.