All 18 Internal Controls Evaluation questions
More in Internal Controls Evaluation
What is the difference between design effectiveness and operating effectiveness? What are entity-level controls versus process-level (transaction) controls? What is the difference between manual and automated controls? When does the auditor decide to test controls versus take a fully substantive approach? What are compensating controls and how do they affect the audit? What is the difference between a deficiency, a significant deficiency, and a material weakness? What are IT general controls (ITGCs) and why do they matter? How does management override of controls create risk, and how do auditors address it? How do you evaluate controls in a system that uses a service organization (SOC reports)? What is the auditor's responsibility for reporting internal control deficiencies?
Advertisement
Back to results for “Internal Controls Evaluation”
Auditing & Assurance › Internal Controls Evaluation

How do you document the understanding of internal controls?

Intermediate

Answer

Common documentation includes narrative descriptions, flowcharts of processes, internal control questionnaires (ICQs), and walkthrough records. The documentation captures the flow of transactions, the controls at each point, and the auditor's evaluation of design and implementation—supporting the risk assessment and any planned reliance on controls.
Real-world example A flowchart plus an ICQ documents the sales process controls and highlights a missing segregation of duties.

Common follow-ups: What forms can control documentation take? | What should the documentation capture?

Audit Evidence & Procedures ISA Standards Internal Controls Evaluation
All 18 Internal Controls Evaluation questions