The use and evaluation of systems of internal control by auditors

Welcome to the World of Internal Controls!

Hello there! Today, we are diving into one of the most practical and important parts of the Audit and Assurance (AA) syllabus: The use and evaluation of systems of internal control. Think of internal controls as the "safety net" a company builds to prevent mistakes and fraud. As auditors, our job is to see how strong that net is. If the net is strong, we can relax a little. If it’s full of holes, we have to work much harder!

Don't worry if this seems a bit technical at first. We’ll break it down step-by-step using simple analogies and clear explanations. Let’s get started!

1. Why do Auditors Care About Internal Controls?

Imagine you are a teacher grading 1,000 math tests. If you know the students used a high-quality calculator that prevents typing errors, you might only check a few answers. But if you know the students did everything by hand and are prone to mistakes, you’ll likely check every single line. That’s exactly how auditing works!

Key Concept: The auditor evaluates internal controls to determine the audit strategy.
- Strong Controls: We can rely on them and do less "substantive testing" (checking the actual numbers).
- Weak Controls: We cannot rely on them and must do much more "substantive testing" to make sure the accounts are correct.

Quick Review: We evaluate controls to decide the nature, timing, and extent of our audit procedures.

2. Documenting the System

Before we can evaluate a system, we need to understand it. The auditor must record how the company’s system works. There are four main ways to do this:

A. Narrative Notes

This is simply writing a story about how a process works. Example: "When a customer places an order, the sales clerk types it into the computer..."
- Pros: Easy to write; great for simple systems.
- Cons: Can become very long and confusing for complex systems; hard to spot missing controls.

B. Flowcharts

A visual map of the system using symbols and arrows.
- Pros: Very easy to see the "flow" of documents; easy to spot where a process stops or breaks.
- Cons: Can be time-consuming to draw; requires knowledge of specific symbols.

C. Internal Control Questionnaires (ICQs)

A list of questions asking if specific controls exist. Example: "Are all purchase orders signed by a manager?"
- Pros: Ensures you don’t forget to ask about important controls.
- Cons: Can lead to "ticking boxes" without really understanding the system.

D. Internal Control Evaluation Questionnaires (ICEQs)

These focus on objectives rather than specific rules. Example: "Is there reasonable assurance that only valid sales are recorded?"
- Pros: Focuses on the "big picture" and risks.
- Cons: Requires more experience to answer correctly.

Did you know? Most modern auditors use a mix of these! They might use a flowchart to see the process and an ICEQ to evaluate if it's actually safe.

3. Evaluating the System: "Walkthrough" Tests

Once we’ve documented the system, we need to make sure we actually understood it correctly. We do this through a Walkthrough Test.

The Analogy: Imagine someone gives you directions to a shop. A "walkthrough" is you actually walking that route once to make sure the landmarks are where they said they were.
In Auditing: We take one single transaction (like one invoice) and follow it from the very beginning to the very end of the system. If the "walkthrough" matches our notes, our documentation is correct!

Common Mistake: Students often think a walkthrough test proves the system works well all year. It doesn't! It only proves that the auditor understands the system correctly.

4. Testing the Controls (ToC)

Now we know how the system is *supposed* to work. But does it actually work in practice? This is where we perform Tests of Controls (ToC).

We look for evidence that the control happened. Here are the four main methods (remember the mnemonic AEIO):

1. A - Analytical Procedures: (Usually used for substantive testing, but can be used to see if controls are producing expected results).
2. E - Enquiry: Asking staff how they perform their duties.
3. I - Inspection: Looking at a document for a signature or a stamp of approval.
4. O - Observation: Watching a staff member actually perform a control (like watching someone count inventory).

Key Takeaway: If we test the controls and they are working perfectly, we can do less checking of the final numbers (Substantive Testing).

5. Identifying Deficiencies and Reporting

What happens if we find a "hole" in the safety net? We call this a control deficiency. If it’s a big hole, it’s a significant deficiency.

Auditors have a professional duty to report these to the people in charge (Management or "Those Charged With Governance"). We usually use a Management Letter (or Letter of Weakness). For the exam, you should always structure your answer using these three columns:

1. The Deficiency: What is wrong? (e.g., "Purchase orders are not being signed.")
2. The Implication: What bad thing could happen? (e.g., "The company might buy things it doesn't need or pay for items that were never ordered, leading to a loss of cash.")
3. The Recommendation: How do they fix it? (e.g., "A policy should be implemented where the system blocks any purchase order that hasn't been digitally signed by a department head.")

Memory Aid: Think of it as Problem -> Danger -> Solution.

Summary: The Step-by-Step Process

1. Understand the system (Inquiry and Observation).
2. Document the system (Notes, Flowcharts, Questionnaires).
3. Confirm the system (Walkthrough tests).
4. Evaluate the design (Is the system "good" on paper?).
5. Test the controls (Is the system working in reality?).
6. Communicate (Tell management about the weaknesses found).

Final Encouragement: You’re doing great! Internal controls are just about logic. Ask yourself: "If I owned this business, what could go wrong, and how would I stop it?" That's exactly how an auditor thinks. Keep practicing those "Deficiency, Implication, Recommendation" questions—they are the key to passing the AA exam!